{
  services.nginx.virtualHosts."media.sbruder.de" = {
    enableACME = true;
    forceSSL = true;

    basicAuthFile = "/data/media/.htpasswd";

    root = "/data/media/";

    locations."=/.htpasswd".return = "403";
  };

  services.nginx-interactive-index.virtualHosts."media.sbruder.de".locations."/".enable = true;
}