let
  onionUrl = "http://i3a47orggn2cebueja2jur66yjgyqd2y7kzthajar4ghuerbx2kzwqyd.onion";
in {
  services = {
    lldap = {
      enable = true;
      settings = {
        http_url = "https://login.distrust.network";
        ldap_user_email = "root@distrust.network";
        ldap_user_dn = "root";
        ldap_base_dn = "dc=distrust,dc=network";
        ldap_user_pass = "VERY_SECURE";
      };
    };

    caddy.virtualHosts."https://login.distrust.network ${onionUrl}".extraConfig = ''
      reverse_proxy localhost:17170
      header Onion-Location ${onionUrl}
    '';

    tor.relay.onionServices."lldap".map = [
      80
    ];
  };
}