{
  services = {
    kubo.enable = true;
    tor.relay.onionServices."site".map = [
      4001
      8080
    ];
    caddy.virtualHosts."ipfs.distrust.network".extraConfig = ''
      reverse_proxy localhost:8080
    '';
  };

  networking.firewall.allowedTCPPorts = [4001];
}