{
  services.matrix-continuwuity = {
    enable = true;
    settings = {
      admin = {
        enable = true;
      };
      global = {
        address = [ "127.0.0.1" ];
        server_name = "k3t.dev";
        trusted_servers = [
          "matrix.org"
          "constellatory.net"
          "unredacted.org"
          "tchncs.de"
        ];
      };
    };
  };
  services.nginx.virtualHosts = {
    "k3t.dev".locations."/.well-known/matrix/client" = {
      return = '{"m.homeserver":{"base_url":"https://matrix.k3t.dev"},"m.identity_server":{"base_url":"https://vector.im"}}';
      extraConfig = ''
        default_type application/json;
      '';
    };
    "k3t.dev".locations."/.well-known/matrix/server" = {
      return = '{"m.server": "matrix.k3t.dev:443"}';
      extraConfig = ''
        default_type application/json;
      '';
    };
    "matrix.k3t.dev" = {
      enableACME = true;
      forceSSL = true;
      locations."/" = {
        proxyPass = "http://127.0.0.1:6167";
        proxyWebsockets = true;
        extraConfig =
          # required when the target is also TLS server with multiple hosts
          "proxy_ssl_server_name on;" +
          # required when the server wants to use HTTP Authentication
          "proxy_pass_header Authorization;"
          ;
      };
    };
  };
}