{ pkgs, lib, config, servers, ... }:
let
  domain = "autogeree.net";
  domainID = lib.replaceStrings ["."] ["_"] domain;
  credentialsFile = "/var/lib/acme/.lego/${domain}/rfc2136";
  inherit (config.users) users groups;
in
{
systemd.services."acme-${domain}".after = [
  "unbound.service"
];
services.shorewall.configs.rules = ''
  # for lego to update ACME DNS-01 challenge
  DNS(ACCEPT) $FW net:${servers.mermet.ipv4} 
  # for lego to check DNS propagation on ns6.gandi.net
  DNS(ACCEPT) $FW net:217.70.177.40 {user=${users.root.name}}
  # for lego to check DNS propagation on ns0.muarf.org
  DNS(ACCEPT) $FW net:78.192.65.63 {user=${users.root.name}}
'';
security.acme.certs."${domain}" = {
  email = "root+letsencrypt@${domain}";
  extraDomains = {
    "*.${domain}" = null;
  };
  user = users.root.name;
  group = groups.acme.name;
  allowKeysForGroup = true;
  keyType = "rsa4096";
  dnsProvider = "rfc2136";
  # ns6.gandi.net takes roughly 5min to update
  # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  #dnsPropagationCheck = false;
  inherit credentialsFile;
};
install.shellHook = ''
  {
  cat <<-EOF
  RFC2136_NAMESERVER=ns.${domain}:53
  RFC2136_TSIG_ALGORITHM=hmac-sha256.
  RFC2136_TSIG_KEY=acme_${domainID}
  RFC2136_PROPAGATION_TIMEOUT=1000
  RFC2136_POLLING_INTERVAL=30
  RFC2136_SEQUENCE_INTERVAL=30
  RFC2136_DNS_TIMEOUT=1000
  RFC2136_TTL=1
  EOF
  pass "servers/losurdo/lego/${domain}/rfc2136"
  } |
  ssh "$target" install -D -m 0400 -o root -g root /dev/stdin \
   ${credentialsFile}
'';
}