{ ... }:
let
  acmeDomainMap = {
    "paperless.grzb.de" = "paperless.wg.grzb.de";
    "navidrome.grzb.de" = "navidrome.wg.grzb.de";
  };
in
{
  services.nginx.virtualHosts = (builtins.mapAttrs (domain: target: {
    listen = [{ 
      addr = "0.0.0.0";
      port = 80;
    }];
    locations."^~ /.well-known/acme-challenge/" = {
      proxyPass = "http://${target}:80";
    };
  }) acmeDomainMap);
}