{
  services = {
    grafana = {
      enable = true;
      settings = {
        auth.proxy = {
          enabled = true;
          header_name = "Remote-User";
          headers = "Name:Remote-Name Email:Remote-Email Groups:Remote-Groups";
        };
      };
    };
    caddy.virtualHosts."grafana.tailc50184.ts.net".extraConfig = ''
      bind tailscale/grafana
      forward_auth localhost:9091 {
        uri /api/authz/forward-auth
        copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
      }
      reverse_proxy localhost:3000
    '';
  };
}