{self, ...}: {
  flake.nixosModules.korrosync-hive = {
    config,
    lib,
    ...
  }: let
    cfg = config.hive.korrosync;
  in {
    options.hive.korrosync = {
      enable = lib.mkEnableOption "Enable korrosync server";
      localPort = lib.mkOption {
        type = lib.types.int;
        example = 8080;
        default = 45988;
        description = "Specify the local port korrosync server uses.";
      };
      instanceFQDN = lib.mkOption {
        type = lib.types.singleLineStr;
        example = "calibre.example.com";
        description = "Fully qualified domain name of the korrosync instance";
      };
      blockUserCreation = lib.mkOption {
        type = lib.types.bool;
        description = "Disallow /user/create endpoint via nginx";
        example = true;
        default = true;
      };
    };

    imports = [
      self.nixosModules.korrosync
    ];

    config = lib.mkIf cfg.enable {
      services.korrosync = {
        enable = true;
        listen-port = cfg.localPort;
        listen-address = "127.0.0.1";
        data-path = "/srv/korrosync";
      };

      # Fallback server with only 403
      services.nginx.virtualHosts.${config.networking.domain} = lib.mkDefault {
        default = true;
        locations."/".return = 403;
        forceSSL = true;
        enableACME = true;
      };

      # Virtual host for korrosync
      services.nginx.virtualHosts."${cfg.instanceFQDN}" =
        {
          forceSSL = true;
          enableACME = true;
          locations."/" = {
            proxyPass = "http://127.0.0.1:${toString cfg.localPort}";
          };
        }
        // (lib.optionalAttrs cfg.blockUserCreation {
          locations."/users/create".return = 403;
        });
    };
  };
}