{ ... }:

{
  services.nginx = {
    enable = true;
    appendHttpConfig = ''
      access_log off;

      # load the DI-Day redirect map from the webroot
      map $request_uri $did_redirect_target {
        include /var/www/did.hamburg.ccc.de/nginx-redirects.conf;
      }
    '';
  };

  networking.firewall.allowedTCPPorts = [ 8443 31820 ];
  networking.firewall.allowedUDPPorts = [ 8443 ];
}