{ pkgs, ... }:
{
  services.pocket-id = {
    enable = true;
    package = pkgs.pocket-id.overrideAttrs (old: {
      patches = (old.patches or [ ]) ++ [
        ./patches/pocket-id-oidc-email-domain-rewrites.patch
      ];
    });
    environmentFile = "/var/lib/secrets/pocket-id.env";
    settings = {
      APP_URL = "https://id.t4t.associates";
      PORT = 1411;
      TRUST_PROXY = true;
    };
  };

  services.nginx.virtualHosts = {
    "id.t4t.associates" = {
      forceSSL = true;
      enableACME = true;

      locations."/" = {
        proxyPass = "http://127.0.0.1:1411";
        proxyWebsockets = true;
        extraConfig = ''
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
        '';
      };
    };

    "ts.t4t.associates" = {
      forceSSL = true;
      enableACME = true;

      locations."= /.well-known/webfinger".extraConfig = ''
        default_type application/json;
        return 200 '{"subject":"$arg_resource","links":[{"rel":"http://openid.net/specs/connect/1.0/issuer","href":"https://id.t4t.associates"}]}';
      '';

      locations."/".extraConfig = ''
        return 404;
      '';
    };
  };
}