{ config, ... }:

{
  services.traefik.dynamicConfigOptions.tcp = {
    routers.xmpp-web = {
      rule = "HostSNI(`chat.${config.domain}`)";
      entryPoints = [ "websecure" ];
      service = "xmpp-web";
      tls.passthrough = true;
    };

    services.xmpp-web.loadBalancer.servers = [
      {
        address = "${config.tailnetIPs.pinix}:8443";
      }
    ];
  };
}