{ config, ... }: {
  security.acme.certs."xmpp.t4t.associates" = {
    group = "certs";
    webroot = "/var/lib/acme/acme-challenge";
    reloadServices = [ "prosody.service" ];
    extraDomainNames = [ "upload.xmpp.t4t.associates" "conf.xmpp.t4t.associates" ];
  };

  services.prosody = {
    enable = true;
    admins = [ "char@xmpp.t4t.associates" ];
    ssl.cert = "/var/lib/acme/xmpp.t4t.associates/fullchain.pem";
    ssl.key = "/var/lib/acme/xmpp.t4t.associates/key.pem";

    virtualHosts."xmpp.t4t.associates" = {
      enabled = true;
      domain = "xmpp.t4t.associates";
      ssl = config.services.prosody.ssl;
    };

    muc = [{ domain = "conf.xmpp.t4t.associates"; }];
    httpFileShare.domain = "upload.xmpp.t4t.associates";

    # modules = {
    #   roster = true; tls = true; dialback = true; disco = true;
    #   carbons = true; pep = true; blocklist = true; mam = true;
    #   smacks = true; csi_simple = true; cloud_notify = true;
    #   bosh = true; websocket = true; admin_adhoc = true;
    #   vcard_legacy = true; ping = true; register = false;
    # };

    extraConfig = ''
      c2s_require_encryption = true
      s2s_require_encryption = true
      http_upload_file_size_limit = 10485760
      archive_expires_after = "4w"
    '';
  };
}