{
  config,
  lib,
  nixpkgs,
  ...
}:

let
  inherit (lib) escapeRegex concatStringsSep;

  domain = "sso.dgnum.eu";

  cert = config.security.acme.certs.${domain};

  allowedDomains = builtins.map escapeRegex (
    (builtins.map (s: "${s}.dgnum.eu") [
      # DGNum subdomains
      "cloud"
      "git"
      "videos"
      "social"
      "demarches"
      "netbird"
    ])
    ++ [
      # Extra domains
      "netbird-beta.hubrecht.ovh"
    ]
  );
in
{
  services.kanidm = {
    enableServer = true;

    package = nixpkgs.unstable.kanidm;

    serverSettings = {
      inherit domain;

      origin = "https://${domain}";

      bindaddress = "127.0.0.1:8443";
      ldapbindaddress = "0.0.0.0:636";

      trust_x_forward_for = true;

      tls_chain = "${cert.directory}/fullchain.pem";
      tls_key = "${cert.directory}/key.pem";
    };
  };

  users.users.kanidm.extraGroups = [ cert.group ];

  services.nginx = {
    enable = true;

    virtualHosts.${domain} = {
      enableACME = true;
      forceSSL = true;
      locations."/" = {
        proxyPass = "https://127.0.0.1:8443";

        extraConfig = ''
          if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {
              return 444;
          }

          set $origin $http_origin;

          if ($origin !~ '^https?://(${concatStringsSep "|" allowedDomains})$') {
              set $origin 'https://${domain}';
          }

          proxy_hide_header Access-Control-Allow-Origin;

          if ($request_method = 'OPTIONS') {
              add_header 'Access-Control-Allow-Origin' "$origin" always;
              add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
              add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
              add_header 'Access-Control-Allow-Credentials' 'true' always;

              add_header Access-Control-Max-Age 1728000;
              add_header Content-Type 'text/plain charset=UTF-8';
              add_header Content-Length 0;
              return 204;
          }

          if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
              add_header Access-Control-Allow-Origin "$origin" always;
              add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
              add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
              add_header Access-Control-Allow-Credentials true always;
          }
        '';
      };
    };
  };

  networking.firewall.allowedTCPPorts = [ 636 ];
  networking.firewall.allowedUDPPorts = [ 636 ];

  dgn-backups.jobs.kanidm.settings.paths = [ "/var/lib/kanidm" ];
}