{ pkgs, ... }:
let
  domain = "kassouni.net";
  # gpg --with-wkd-hash -k alex@kassouni.net
  hash = "cddpr77ezsy7h967hgjydxhhmnt76n8w";
  pubkey = pkgs.runCommandLocal "wkd-key-${domain}" { nativeBuildInputs = [ pkgs.gnupg ]; } ''
    gpg --dearmor < ${./pubkey.asc} > $out
  '';
  cors = ''
    add_header Access-Control-Allow-Origin "*" always;
  '';
in
{
  services.nginx.virtualHosts.${domain}.locations = {
    "= /.well-known/openpgpkey/hu/${hash}" = {
      alias = "${pubkey}";
      extraConfig = ''
        default_type application/octet-stream;
        ${cors}
      '';
    };

    "= /.well-known/openpgpkey/policy" = {
      alias = "${pkgs.emptyFile}";
      extraConfig = cors;
    };

    "= /pubkey.asc".alias = "${./pubkey.asc}";
  };
}