{
  config,
  lib,
  pkgs,
}:

let
  frontendConfig = config.services.rabbi-gerzi.frontend;
  backendConfig = config.services.rabbi-gerzi.backend;
  frontendVirtualHost = config.services.nginx.virtualHosts.${frontendConfig.hostName};
  backendVirtualHost = config.services.nginx.virtualHosts.${backendConfig.hostName};
  frontendCertificate = config.security.acme.certs.${frontendConfig.hostName};
  backendCertificate = config.security.acme.certs.${backendConfig.hostName};
  redirectVirtualHost = lib.attrByPath [
    "www.rabbigerzi.com"
  ] { } config.services.nginx.virtualHosts;

  assertions = [
    {
      assertion = frontendConfig.hostName == "rabbigerzi.com";
      message = "Rabbi Gerzi frontend does not use the production domain";
    }
    {
      assertion = frontendConfig.apiBaseUrl == "https://api.rabbigerzi.com";
      message = "Rabbi Gerzi frontend does not use the production API";
    }
    {
      assertion = frontendConfig.redirectHostNames == [ "www.rabbigerzi.com" ];
      message = "Rabbi Gerzi frontend redirect hosts are not configured";
    }
    {
      assertion = backendConfig.hostName == "api.rabbigerzi.com";
      message = "Rabbi Gerzi backend does not use the production API domain";
    }
    {
      assertion =
        backendConfig.corsAllowedOrigins == [
          "https://rabbigerzi.com"
        ];
      message = "Rabbi Gerzi CORS origins are not production-only";
    }
    {
      assertion = !builtins.elem "rabbigerzi.yisroelbaum.com" frontendVirtualHost.serverAliases;
      message = "Rabbi Gerzi frontend still serves the staging alias";
    }
    {
      assertion = !builtins.elem "rabbigerziapi.yisroelbaum.com" backendVirtualHost.serverAliases;
      message = "Rabbi Gerzi backend still serves the staging alias";
    }
    {
      assertion = !builtins.elem "rabbigerzi.yisroelbaum.com" frontendCertificate.extraDomainNames;
      message = "Rabbi Gerzi frontend certificate still covers staging";
    }
    {
      assertion = !builtins.elem "rabbigerziapi.yisroelbaum.com" backendCertificate.extraDomainNames;
      message = "Rabbi Gerzi backend certificate still covers staging";
    }
    {
      assertion = redirectVirtualHost.globalRedirect or null == "rabbigerzi.com";
      message = "Rabbi Gerzi www host does not redirect to the apex";
    }
    {
      assertion = redirectVirtualHost.forceSSL or false;
      message = "Rabbi Gerzi www redirect does not force HTTPS";
    }
    {
      assertion = redirectVirtualHost.enableACME or false;
      message = "Rabbi Gerzi www redirect does not enable ACME";
    }
  ];

  failedAssertions = lib.filter (assertion: !assertion.assertion) assertions;
in
pkgs.runCommand "rabbi-gerzi-production-domains"
  {
    failures = lib.concatMapStringsSep "\n" (assertion: assertion.message) failedAssertions;
    preferLocalBuild = true;
  }
  ''
    if [ -n "$failures" ]; then
      printf '%s\n' "$failures" >&2
      exit 1
    fi

    touch $out
  ''