{
  networking.firewall.allowedTCPPorts = [
    80
    443
  ];

  # Global robots.txt served by HAProxy for every vhost (see haproxy.cfg).
  environment.etc."haproxy/robots.txt".source = ./robots.txt;

  services.haproxy = {
    enable = true;
    config = builtins.readFile ./haproxy.cfg;
  };
}