{ pkgs, ... }:

{
  environment.systemPackages = [ pkgs.cloudflared ];

  systemd.services.cloudflared-warp = {
    description = "Cloudflared TCP tunnel for SSH";
    wantedBy = [ "multi-user.target" ];
    after = [ "network-online.target" ];
    wants = [ "network-online.target" ];
    
    serviceConfig = {
      ExecStart = "${pkgs.cloudflared}/bin/cloudflared access tcp --hostname warp.ftl.host --url localhost:4401 --destination localhost:22";
      Restart = "always";
      RestartSec = "5s";
      Type = "exec";
      StandardOutput = "journal";
      StandardError = "journal";
    };
  };
}