{ pkgs, lib, config, inputs, hostName, hosts, ... }:
let
  domain = "autogeree.net";
  domainID = lib.replaceStrings ["."] ["_"] domain;
  inherit (builtins) attrValues;
  inherit (config) networking;
  inherit (config.services) knot;
  inherit (config.users) users;
in
{
services.knot.zones.${domain} = {
  conf = ''
    acl:
      - id: acl_localhost_acme_${domainID}
        address: 127.0.0.1
        action: update
        update-owner: name
        update-owner-match: equal
        update-owner-name: [_acme-challenge]
        update-type: [TXT]
      - id: acl_tsig_acme_${domainID}
        key: acme_${domainID}
        action: update
        update-owner: name
        update-owner-match: equal
        update-owner-name: [_acme-challenge]
        update-type: [TXT]

    zone:
      - domain: ${domain}
        file: ${domain}.zone
        serial-policy: increment
        semantic-checks: on
        notify: secondary_gandi
        #notify: secondary_muarf
        acl: acl_gandi
        #acl: acl_muarf
        acl: acl_localhost_acme_${domainID}
        acl: acl_tsig_acme_${domainID}
        dnssec-signing: off
        dnssec-policy: ed25519
  '';
  # TODO: increase the TTL once things have settled down
  data = ''
    $ORIGIN ${domain}.
    $TTL 500

    ; SOA (Start Of Authority)
    @ SOA ns root (
      ${toString inputs.self.lastModified} ; Serial number
      24h   ; Refresh
      15m   ; Retry
      1000h ; Expire (1000h)
      1d    ; Negative caching
    )

    ; NS (Name Server)
    @ NS ns
    @ NS ns6.gandi.net.
    ;@ NS ns0.muarf.org.

    ; A (DNS -> IPv4)
    @          A ${hosts.mermet._module.args.ipv4}
    mermet     A ${hosts.mermet._module.args.ipv4}
    autoconfig A ${hosts.mermet._module.args.ipv4}
    code       A ${hosts.mermet._module.args.ipv4}
    git        A ${hosts.mermet._module.args.ipv4}
    imap       A ${hosts.mermet._module.args.ipv4}
    mail       A ${hosts.mermet._module.args.ipv4}
    ns         A ${hosts.mermet._module.args.ipv4}
    pop        A ${hosts.mermet._module.args.ipv4}
    smtp       A ${hosts.mermet._module.args.ipv4}
    submission A ${hosts.mermet._module.args.ipv4}
    www        A ${hosts.mermet._module.args.ipv4}
    chomsky    A 91.216.110.36
    alpes      A 195.88.84.51

    ; SPF (Sender Policy Framework)
    @ 3600 IN SPF "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
    @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"

    ; MX (Mail eXchange)
    @ 180 MX 5 mail

    ; SRV (SeRVice)
    _git._tcp.git 18000 IN SRV 0 0 9418 git

    ; CAA (Certificate Authority Authorization)
    ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
    @ CAA 128 issue "letsencrypt.org"
  '';
};
networking.nftables.ruleset = ''
  table inet filter {
    # Gandi DNS
    set output-net-knot-ipv4 { type ipv4_addr; elements = { 217.70.177.40 }; }
    set output-net-knot-ipv6 { type ipv6_addr; elements = { 2001:4b98:d:1::40 }; }
  }
'';
services.knot = {
  keyFiles = [
    "/run/credentials/knot.service/${domain}.acme.conf"
  ];
};
systemd.services.knot.serviceConfig = {
  LoadCredentialEncrypted = [
    "${domain}.acme.conf:${inputs.self}/hosts/${hostName}/${domain}/acme.conf.cred"
  ];
};
/* Useless since the zone is public
services.unbound.settings = {
  stub-zone = {
    name = domain;
    stub-addr = "127.0.0.1@5353";
  };
};
'';
*/
}