{ config, pkgs, ... }: {
  services.nix-serve = {
    enable = true;
    secretKeyFile = "/etc/tempest/bincache/key-priv.pem";
  };

  services.nginx.virtualHosts."hemera.tempest.local" = {
    locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
  };
}