{
  config,
  lib,
  nixpkgs,
  ...
}:

let
  inherit (lib) escapeRegex concatStringsSep;

  host = "sso.dgnum.eu";
  port = 8443;
  domain = host;

  cert = config.security.acme.certs.${domain};

  allowedDomains = builtins.map escapeRegex (
    (builtins.map (s: "${s}.dgnum.eu") [
      # DGNum subdomains
      "cloud"
      "git"
      "videos"
      "social"
      "demarches"
      "netbird"
    ])
    ++ [
      # Extra domains
      "netbird-beta.hubrecht.ovh"
    ]
  );
in
{
  services.kanidm = {
    enableServer = true;

    package = nixpkgs.unstable.kanidm;

    serverSettings = {
      inherit domain;

      origin = "https://${domain}";

      bindaddress = "127.0.0.1:8443";
      ldapbindaddress = "0.0.0.0:636";

      trust_x_forward_for = true;

      tls_chain = "${cert.directory}/fullchain.pem";
      tls_key = "${cert.directory}/key.pem";
    };
  };

  users.users.kanidm.extraGroups = [ cert.group ];

  dgn-web.simpleProxies.kanidm = {
    inherit host port;
    vhostConfig.locations."/".extraConfig = ''
      if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {
          return 444;
      }

      set $origin $http_origin;

      if ($origin !~ '^https?://(${concatStringsSep "|" allowedDomains})$') {
          set $origin 'https://${domain}';
      }

      proxy_hide_header Access-Control-Allow-Origin;

      if ($request_method = 'OPTIONS') {
          add_header 'Access-Control-Allow-Origin' "$origin" always;
          add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
          add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
          add_header 'Access-Control-Allow-Credentials' 'true' always;

          add_header Access-Control-Max-Age 1728000;
          add_header Content-Type 'text/plain charset=UTF-8';
          add_header Content-Length 0;
          return 204;
      }

      if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
          add_header Access-Control-Allow-Origin "$origin" always;
          add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
          add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
          add_header Access-Control-Allow-Credentials true always;
      }
    '';
  };

  networking.firewall.allowedTCPPorts = [ 636 ];
  networking.firewall.allowedUDPPorts = [ 636 ];

  dgn-backups.jobs.kanidm.settings.paths = [ "/var/lib/kanidm" ];
}