{ pkgs, ... }:

{
  services.fcgiwrap.enable = true;

  services.nginx.enable = true;
  services.nginx.package = pkgs.nginxMainline;

  services.nginx.recommendedOptimisation = true;
  services.nginx.recommendedTlsSettings = true;
  services.nginx.recommendedGzipSettings = true;
  services.nginx.recommendedProxySettings = true;

  services.nginx.commonHttpConfig = ''
    log_format privacy '[$time_local] $request_method '
                       '$scheme://$host$request_uri $status $body_bytes_sent';

    # systemd catches syslog, and access_log doesn't support stdout/stderr.
    access_log syslog:server=unix:/dev/log privacy;
  '';
}