{pkgs, ...}: {
  services.caddy = {
    enable = true;
    virtualHosts."headscale.wanderingcrow.net".extraConfig = ''
      reverse_proxy 127.0.0.1:8088
    '';
  };

  services.headscale = {
    enable = true;
    package = pkgs.headscale;
    port = 8088;
    address = "127.0.0.1";
    settings = {
      server_url = "https://headscale.wanderingcrow.net";
      grpc_listen_addr = "0.0.0.0:50443";
      database.type = "sqlite";
      dns = {
        magic_dns = true;
        base_domain = "wce-internal";
      };
    };
  };
}