{ sources, ... }:

let
  retired_host = "retired.dgnum.eu";

  mkRetired = hosts:
    builtins.listToAttrs (builtins.map (name: {
      inherit name;
      value.to = retired_host;
    }) hosts);

  mkSub = domain: builtins.map (s: "${s}.${domain}");
  mkSubs = attrs:
    builtins.concatLists (builtins.attrValues (builtins.mapAttrs mkSub attrs));

  redirections = {
    "calendrier.eleves.ens.fr".to = "calendrier.dgnum.eu";
    "docs.beta.rz.ens.wtf".to = "pads.dgnum.eu";
    "git.rz.ens.wtf".to = "git.dgnum.eu";
    "notion.rz.ens.wtf".to = "docs.dgnum.eu";
    "nuage.beta.rz.ens.wtf".to = "cloud.dgnum.eu";
    "rdv.dgnum.eu".to = "meet.dgnum.eu";
  } // (mkRetired retired);

  retired = mkSubs {
    "ens.fr" = [ "alevins" "www.climatenavigator" ];
    "ens.wtf" = [ "photos" ];
    "rz.ens.wtf" = [ "s3" "cdn" ];
    "beta.rz.ens.wtf" = [
      "todo"
      "minecraft"
      "factorio"
      "home"
      "pads"
      "api.pads"
      "files.pads"
      "sandbox.pads"
      "jurisprudens"
      "rstudio"
    ];
  };

in {
  services.nginx.virtualHosts = {
    ${retired_host} = {
      enableACME = true;
      forceSSL = true;

      root = "${sources.dgnum-retired.outPath}/www";

      default = true;
    };
  } // (builtins.mapAttrs (host:
    { to, ssl ? true }: {
      globalRedirect = to;
      enableACME = ssl;
      forceSSL = ssl;
    }) redirections);
}