{
  nixpkgs,
  self,
  system,
}:
let
  pkgs = nixpkgs.legacyPackages.${system};
  evaluatedSystem = nixpkgs.lib.nixosSystem {
    inherit system;
    modules = [
      self.nixosModules.default
      {
        system.stateVersion = "25.11";
        services.yisroelbaum-web = {
          enable = true;
          secretFiles = {
            borgPassphrase = "/run/secrets/borg-passphrase";
            borgPrivateKey = "/run/secrets/borg-private-key";
            forgejoMailerUser = "/run/secrets/forgejo-mailer-user";
            forgejoMailerPassword = "/run/secrets/forgejo-mailer-password";
            rabbiGerziEnvironment = "/run/secrets/rabbi-gerzi.env";
          };
        };
      }
    ];
  };
  evaluatedConfig = evaluatedSystem.config;
  virtualHosts = evaluatedConfig.services.nginx.virtualHosts;
  certificates = evaluatedConfig.security.acme.certs;
  forgejoBackup = evaluatedConfig.services.borgbackup.jobs.forgejo;
  forgejoBackupService = evaluatedConfig.systemd.services.borgbackup-job-forgejo;
  publicHostNames = [
    "yisroelbaum.com"
    "jellyfin.yisroelbaum.com"
    "git.yisroelbaum.com"
    "rabbigerzi.yisroelbaum.com"
    "rabbigerziapi.yisroelbaum.com"
  ];
in
assert evaluatedConfig.services.nginx.enable;
assert evaluatedConfig.services.jellyfin.enable;
assert evaluatedConfig.services.forgejo.enable;
assert evaluatedConfig.services.rabbi-gerzi.enable;
assert
  virtualHosts."yisroelbaum.com".locations."/".root
  == "${self.inputs.resume.packages.${system}.default}";
assert virtualHosts."jellyfin.yisroelbaum.com".locations."/".proxyPass == "http://localhost:8096";
assert virtualHosts."git.yisroelbaum.com".locations."/".proxyPass == "http://127.0.0.1:3000";
assert !virtualHosts."git.yisroelbaum.com".locations."/".recommendedProxySettings;
assert nixpkgs.lib.hasInfix "proxy_set_header X-Forwarded-Proto $scheme;"
  virtualHosts."git.yisroelbaum.com".locations."/".extraConfig;
assert builtins.all (
  hostName:
  virtualHosts.${hostName}.forceSSL
  && virtualHosts.${hostName}.enableACME
  && certificates.${hostName}.domain == hostName
) publicHostNames;
assert builtins.all (certificate: !(nixpkgs.lib.hasPrefix "*." certificate.domain)) (
  builtins.attrValues certificates
);
assert evaluatedConfig.services.forgejo.settings.server.ROOT_URL == "https://git.yisroelbaum.com/";
assert evaluatedConfig.services.forgejo.settings.server.DOMAIN == "git.yisroelbaum.com";
assert evaluatedConfig.services.forgejo.settings.server.SSH_PORT == 2222;
assert evaluatedConfig.services.forgejo.settings.mailer.FROM == "me@yisroelbaum.com";
assert evaluatedConfig.services.forgejo.secrets.mailer.USER == "/run/secrets/forgejo-mailer-user";
assert
  evaluatedConfig.services.forgejo.secrets.mailer.PASSWD == "/run/secrets/forgejo-mailer-password";
assert evaluatedConfig.services.rabbi-gerzi.frontend.hostName == "rabbigerzi.yisroelbaum.com";
assert evaluatedConfig.services.rabbi-gerzi.backend.hostName == "rabbigerziapi.yisroelbaum.com";
assert
  evaluatedConfig.services.rabbi-gerzi.backend.environmentFile == "/run/secrets/rabbi-gerzi.env";
assert forgejoBackup.repo == "ssh://n5lniyfd@n5lniyfd.repo.borgbase.com/./repo";
assert forgejoBackup.startAt == "*-*-* 03:15:00";
assert forgejoBackup.persistentTimer;
assert forgejoBackup.prune.keep.daily == 7;
assert forgejoBackup.prune.keep.weekly == 4;
assert forgejoBackup.prune.keep.monthly == 6;
assert builtins.elem evaluatedConfig.services.forgejo.stateDir forgejoBackup.paths;
assert builtins.elem "sops-install-secrets.service" forgejoBackupService.after;
pkgs.runCommand "yisroelbaum-web-module-eval" { } ''
  touch "$out"
''