{ ... }: {
  services.nginx = {
    enable = true;
    streamConfig = ''
      map $ssl_preread_server_name $irc_backend {
        soju.char.lt 127.0.0.1:16698;
        default      127.0.0.1:16697;
      }

      server {
        listen 6697;
        listen [::]:6697;
        ssl_preread on;
        proxy_pass $irc_backend;
        proxy_protocol on;
        proxy_timeout 1h;
      }
    '';
  };
}