diff --git a/hosts/rpi4/services.nix b/hosts/rpi4/services.nix
index 404a43c..993dea5 100644
--- a/hosts/rpi4/services.nix
+++ b/hosts/rpi4/services.nix
@@ -3,6 +3,31 @@
   imports = [
     ./gitea.nix
   ];
+
+  # authelia
+  options.services.nginx = let
+    inherit (lib) types;
+    mkAttrsOfSubmoduleOpt = module: lib.mkOption { type = with types; attrsOf (submodule module); };
+
+    # make system config accessible from submodules
+    systemConfig = config;
+
+    # submodule definitions
+    locationModule' = vhostAttrs: { name, config, ... }: {
+      options.testModuleExtension = lib.mkEnableOption "module extension test";
+      config.extraConfig = lib.mkIf config.testModuleExtension ''
+        # vhostAttrs is ${vhostAttrs.name}
+        # location is ${name}
+      '';
+    };
+    vhostModule = { name, config, ... }@attrs: {
+      options.locations = mkAttrsOfSubmoduleOpt (locationModule' attrs);
+    };
+
+  in {
+    virtualHosts = mkAttrsOfSubmoduleOpt vhostModule;
+  };
+
   config = {
 
     age.secrets.cloudflaredns = {