{
  users.groups.ogdo = { members = [ "nginx" "jaina" ]; };
  services.nginx = {
    enable = true;

    # ꙮ.run
    virtualHosts."xn--xx8a.run" = {
      listen = [
        {
          addr = "0.0.0.0";
          port = 80;
        }
        {
          port = 80;
          addr = "[::]";
        }
        # deliberately avoid listening with https
      ];

      rejectSSL = true;
      root = "/srv/ogdo";

      extraConfig = ''
        error_page 404 /;
        access_log /var/log/nginx/ogdo.log combined;
        add_header 'Cache-Control' 'no-cache';
      '';

      locations."/" = { index = "/index.html"; };
      locations."~ ^/.+" = {
        root = "/srv/ogdo/served-files";
        tryFiles = "$uri =404";
        extraConfig = ''
          default_type application/pdf;
        '';
      };
    };

    virtualHosts."ogdo.run" = {
      listen = [
        {
          addr = "0.0.0.0";
          port = 80;
        }
        {
          port = 80;
          addr = "[::]";
        }
      ];

      rejectSSL = true;

      locations."/".return = "301 http://xn--xx8a.run$request_uri";
    };
  };
}