i think this works

flake.nix

@@ -19,6 +19,10 @@
       inputs.nixpkgs.follows = "nixpkgs-unstable";
       url = "github:nixified-ai/flake";
     };
+    website = {
+      url = "path:/tfcconnection";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = { nixpkgs,
@@ -30,6 +34,7 @@
               simple-nixos-mailserver,
               nocodb,
               nixified-ai,
+              website,
               self,
               ... }:
     let
@@ -38,6 +43,7 @@
       pkgsForSystem = import nixpkgs {
         inherit system;
         config = { allowUnfree = true; };
+        overlays = [ (final: prev: { website = website.defaultPackage; }) ];
       };
 
       lib = nixpkgs.lib;

modules/website.nix

@@ -0,0 +1,24 @@
+{ config, lib, pkgs, ... }:
+
+let
+  dn = "tfcconnection.org";
+in 
+with lib;
+{
+  services.nginx.virtualHosts.${dn} = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:4242";
+      proxyWebsockets = true;
+    };
+  };
+  systemd.services = {
+    website = {
+      enable = true;
+      serviceConfig = {
+        ExecStart = "${pkgs.website}/bin/tfcapi";
+      };
+    };
+  };
+}

system/shen/configuration.nix

@@ -19,7 +19,7 @@ in
       ../../modules/searx.nix
       ../../modules/mail.nix
       ../../modules/vaultwarden.nix
-      # ../../modules/nocodb.nix
+      ../../modules/website.nix
       ../../modules/grist.nix
       ../../modules/keycloak.nix
       # ../../modules/comfyui.nix
@@ -132,11 +132,11 @@ in
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
 
-    virtualHosts."tfcconnection.org" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/".proxyPass = "http://localhost:4242";
-    };
+    # virtualHosts."tfcconnection.org" = {
+    #   forceSSL = true;
+    #   enableACME = true;
+    #   locations."/".proxyPass = "http://localhost:4242";
+    # };
   };
 
   # CADDY