@@ -22,6 +22,7 @@ {
   imports =
     [
       <personal/modules/nixos/laminar.nix>
+      <personal/modules/nixos/goatcounter.nix>
       <home-manager/nixos>
       <agenix/modules/age.nix>
       <searchix/nix/modules>
@@ -344,6 +345,17 @@ # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
   system.stateVersion = "23.05"; # Did you read the comment?
 
+  services.goatcounter = {
+    enable = true;
+    listenAddress = "localhost";
+    port = 8082;
+    package = (import <personal> { inherit pkgs; }).goatcounter;
+    settings = {
+      tls = "proxy";
+      websocket = true;
+    };
+  };
+
   services.powerdns =
     let
       inherit (lib.lists) flatten;
@@ -597,6 +609,9 @@ certs."dns.alanpearce.eu" = {
       reloadServices = map (x: "kresd@${toString x}") (range 1 config.services.kresd.instances);
       group = "knot-resolver";
     };
+    certs."stats.alanpearce.eu" = {
+      extraDomainNames = [ "*.stats.alanpearce.eu" ];
+    };
   };
   users.groups.acme.members = [
     "caddy"
@@ -727,6 +742,17 @@ in
           {
             extraConfig = ''
               reverse_proxy ${srv.settings.bindHTTP}
+            '';
+          };
+        "stats.alanpearce.eu" =
+          let
+            srv = config.services.goatcounter;
+          in
+          {
+            useACMEHost = "stats.alanpearce.eu";
+            serverAliases = [ "*.stats.alanpearce.eu" ];
+            extraConfig = ''
+              reverse_proxy ${srv.listenAddress}:${toString srv.port}
             '';
           };
       };