{
  services = {
    grafana = {
      enable = true;
      settings = {
        server = {
          root_url = "https://grafana.tailc50184.ts.net";
        };
        # "auth.proxy" = {
        #   enabled = true;
        #   header_name = "Remote-User";
        #   headers = "Name:Remote-Name Email:Remote-Email Groups:Remote-Groups";
        # };
      };
    };
    caddy.virtualHosts."grafana.tailc50184.ts.net".extraConfig = ''
      bind tailscale/grafana
      # forward_auth localhost:9091 {
      #   uri /api/authz/forward-auth
      #   copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
      # }
      reverse_proxy localhost:3000
    '';
  };
}