{ config, ... }: {
  services = {
    hydra = {
      enable = true;
      hydraURL = "https://hydra.matri.cx";
      listenHost = "127.0.0.1";
      port = 3034;

      extraConfig = ''
        using_frontend_proxy = 1
        base_uri = "https://hydra.matri.cx"
      '';

      useSubstitutes = true;

      notificationSender = "hydra@matri.cx";
      buildMachinesFiles = [ ];
    };

    nix-serve = {
      enable = true;
      secretKeyFile = config.age.secrets.cache-key.path;
    };
  };
}