{jsonConfig, ...}: {
  ${jsonConfig.domains.portainer} = {
    extraConfig = ''
      reverse_proxy localhost:9000
      header {
        # Security headers
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "strict-origin-when-cross-origin"
      }
    '';
  };
}