{ pkgs, config, ... }: {
  pkgs.config.allowUnfreePredicate = pkg:
    builtins.elem (lib.getName pkg) [ "unifi-controller" ];
  services = {
    unifi = {
      enable = true;
      unifiPackage = pkgs.unifi8;
      openFirewall = true;
    };
    nginx = {
      enable = true;
      recommendedProxySettings = true;

      virtualHosts."unifi.local" = {
        # forceSSL = true;
        # useACMEHost = "unifi.local";
        locations."/" = {
          proxyPass = "https://127.0.0.1:8443";
          proxyWebsockets = true;
        };
      };
    };
  };
}