{ pkgs, lib, config, ... }:
with builtins;
let
  inherit (builtins.extraBuiltins) pass git;
  inherit (pkgs.lib) unlinesAttrs types;
  inherit (config) networking;
  inherit (config.services) nsd rspamd;
  # Use the Git commit time of the ${domain}.nix file to set the serial number.
  # WARNING: the ${domain}.nix must be committed into Git for this to work.
  serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  /*
  serial = file: lib.removeSuffix "\n" (readFile
    (pkgs.runCommand "zone-serial"
      { buildInputs      = [ pkgs.git ];
        buildDepends     = [ (./. + file) ];
        preferLocalBuild = true;
        allowSubstitutes = false;
      } ''
      cd ${./.}
      ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
    ''));
  */
  # FIXME: make dedicated config options
  #ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
  mermetIPv4 = "80.67.180.129";
  domain = "sourcephile.fr";
  #ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
  sourcephileZone = domain: ''
    ; A (DNS -> IPv4)
    @ A ${mermetIPv4}
    mermet     A ${mermetIPv4}
    autoconfig A ${mermetIPv4}
    code       A ${mermetIPv4}
    git        A ${mermetIPv4}
    imap       A ${mermetIPv4}
    mail       A ${mermetIPv4}
    ns         A ${mermetIPv4}
    pop        A ${mermetIPv4}
    smtp       A ${mermetIPv4}
    submission A ${mermetIPv4}
    www        A ${mermetIPv4}

    ; SPF (Sender Policy Framework)
    @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
    @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"

    ; MX (Mail eXchange)
    @ 180 MX 5 mail

    ; SRV (SeRVice)
    _git._tcp.git 18000 IN SRV 0 0 9418 git
    '';
in
{
environment.systemPackages = [
  (pkgs.bind.override { enablePython = true; })
];
services.nsd.zones."${domain}" = {
  # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
  # DOC: https://www.sidn.nl/en/dnssec/dnssec-signatures-in-bind-named
  provideXFR = [ "217.70.177.40 NOKEY" ];
  # Not allowed by 217.70.177.40
  #notify     = [ "217.70.177.40 NOKEY" ];
  dnssec = true;
  # TODO: increase the TTL once things have settled down
  data = ''
    $ORIGIN ${domain}.
    $TTL 500

    ; SOA (Start Of Authority)
    @ SOA ns admin (
      ${serial domain} ; Serial number
      24h   ; Refresh
      15m   ; Retry
      1000h ; Expire (1000h)
      1d    ; Negative caching
    )

    ; NS (Name Server)
    @ NS ns
    @ NS ns6.gandi.net.
  ''
  + sourcephileZone "${domain}";
};
}