{ inputs, pkgs, lib, config, hosts, ... }:
let
  domain = "sourcephile.fr";
  domainID = lib.replaceStrings ["."] ["_"] domain;
  inherit (config) networking;
  inherit (config.security) gnupg;
  inherit (config.services) knot;
  inherit (config.users) users;
in
{
services.knot.zones."${domain}" = {
  conf = ''
    acl:
      - id: acl_localhost_acme_${domainID}
        address: 127.0.0.1
        action: update
        update-owner: name
        update-owner-match: equal
        update-owner-name: [_acme-challenge, _acme-challenge.hut]
        update-type: [TXT]
      - id: acl_tsig_acme_${domainID}
        key: acme_${domainID}
        action: update
        update-owner: name
        update-owner-match: equal
        update-owner-name: [_acme-challenge, _acme-challenge.hut]
        update-type: [TXT]
      - id: acl_tsig_bureau1_${domainID}
        key: bureau1_${domainID}
        action: update
        update-owner: name
        update-owner-match: equal
        update-owner-name: [bureau1, lan.losurdo]
        update-type: [A, AAAA]

    zone:
      - domain: ${domain}
        file: ${domain}.zone
        serial-policy: increment
        semantic-checks: on
        notify: secondary_gandi
        acl: acl_gandi
        acl: acl_localhost_acme_${domainID}
        acl: acl_tsig_acme_${domainID}
        acl: acl_tsig_bureau1_${domainID}
        dnssec-signing: on
        dnssec-policy: rsa
      - domain: whoami4.${domain}
        module: mod-whoami
        file: "${pkgs.writeText "whoami4.zone" ''
          $TTL 1
          @ SOA ns root.${domain}. (
            0     ; SERIAL
            86400 ; REFRESH
            86400 ; RETRY
            86400 ; EXPIRE
            1 ; MINIMUM
          )
          $TTL 86400
          @ NS ns
          ns A ${hosts.mermet.extraArgs.ipv4}
        ''}"
  '';
  # TODO: increase the TTL once things have settled down
  data = ''
    $ORIGIN ${domain}.
    $TTL 500

    ; SOA (Start Of Authority)
    @ SOA ns root (
      ${toString inputs.self.lastModified} ; Serial number
      24h   ; Refresh
      15m   ; Retry
      1000h ; Expire (1000h)
      1d    ; Negative caching
    )

    ; NS (Name Server)
    @ NS ns
    @ NS ns6.gandi.net.
    whoami4 NS ns.whoami4
    ns.whoami4 A ${hosts.mermet.extraArgs.ipv4}

    ; A (DNS -> IPv4)
    @            A ${hosts.mermet.extraArgs.ipv4}
    mermet       A ${hosts.mermet.extraArgs.ipv4}
    autoconfig   A ${hosts.mermet.extraArgs.ipv4}
    doc          A ${hosts.mermet.extraArgs.ipv4}
    code         A ${hosts.mermet.extraArgs.ipv4}
    git          A ${hosts.mermet.extraArgs.ipv4}
    imap         A ${hosts.mermet.extraArgs.ipv4}
    mail         A ${hosts.mermet.extraArgs.ipv4}
    mails        A ${hosts.mermet.extraArgs.ipv4}
    news         A ${hosts.mermet.extraArgs.ipv4}
    public-inbox A ${hosts.mermet.extraArgs.ipv4}
    ns           A ${hosts.mermet.extraArgs.ipv4}
    pop          A ${hosts.mermet.extraArgs.ipv4}
    smtp         A ${hosts.mermet.extraArgs.ipv4}
    submission   A ${hosts.mermet.extraArgs.ipv4}
    www          A ${hosts.mermet.extraArgs.ipv4}
    lemoutona5pattes A ${hosts.mermet.extraArgs.ipv4}
    covid19      A ${hosts.mermet.extraArgs.ipv4}
    croc         A ${hosts.mermet.extraArgs.ipv4}
    stun         A ${hosts.mermet.extraArgs.ipv4}
    turn         A ${hosts.mermet.extraArgs.ipv4}
    whoami       A ${hosts.mermet.extraArgs.ipv4}
    hut          A ${hosts.mermet.extraArgs.ipv4}
    builds.hut   A ${hosts.mermet.extraArgs.ipv4}
    dispatch.hut A ${hosts.mermet.extraArgs.ipv4}
    git.hut      A ${hosts.mermet.extraArgs.ipv4}
    hg.hut       A ${hosts.mermet.extraArgs.ipv4}
    hub.hut      A ${hosts.mermet.extraArgs.ipv4}
    lists.hut    A ${hosts.mermet.extraArgs.ipv4}
    meta.hut     A ${hosts.mermet.extraArgs.ipv4}
    man.hut      A ${hosts.mermet.extraArgs.ipv4}
    pages.hut    A ${hosts.mermet.extraArgs.ipv4}
    paste.hut    A ${hosts.mermet.extraArgs.ipv4}
    todo.hut     A ${hosts.mermet.extraArgs.ipv4}

    ; CNAME (Canonical Name)
    losurdo          CNAME bureau1
    openconcerto     CNAME losurdo
    xmpp             CNAME mermet
    tmp              CNAME mermet
    proxy65          CNAME mermet
    cryptpad         CNAME losurdo
    cryptpad-api     CNAME losurdo
    cryptpad-files   CNAME losurdo
    cryptpad-sandbox CNAME losurdo
    mumble           CNAME mermet
    freeciv          CNAME losurdo
    nix-serve        CNAME losurdo
    nix-extracache   CNAME losurdo
    nix-localcache   CNAME lan.losurdo

    ; DMARC (Domain-based Message Authentication, Reporting and Conformance)
    _dmarc 3600 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:root+dmarc+aggregate@sourcephile.fr; ruf=mailto:root+dmarc+forensic@sourcephile.fr"

    ; SPF (Sender Policy Framework)
    @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet.extraArgs.ipv4} -all"

    ; MX (Mail eXchange)
    @ 1800 MX 5 mail
    lists.hut 1800 MX 5 mail

    ; SRV (SeRVice)
    _git._tcp.git             18000 IN SRV 0 0 9418 git
    _stun._udp                18000 IN SRV 0 5 3478 stun
    _xmpp-client._tcp         18000 IN SRV 0 5 5222 xmpp
    _xmpp-server._tcp         18000 IN SRV 0 5 5269 xmpp
    _xmpp-server._tcp.salons  18000 IN SRV 0 5 5269 xmpp

    ; CAA (Certificate Authority Authorization)
    ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
    @ CAA 128 issue "letsencrypt.org"
  '';
};
users.groups.keys.members = [ users.knot.name ];
services.knot = {
  keyFiles = [
    gnupg.secrets."knot/tsig/${domain}/acme.conf".path
    gnupg.secrets."knot/tsig/${domain}/bureau1.conf".path
  ];
};
security.gnupg.secrets = {
  "knot/tsig/${domain}/acme.conf" = {
    # Generated with: keymgr -t acme_${domainID}
    user = users.knot.name;
  };
  "knot/tsig/${domain}/bureau1.conf" = {
    # Generated with: keymgr -t bureau1_${domainID}
    user = users.knot.name;
  };
};
systemd.services.knot = {
  after = [
    gnupg.secrets."knot/tsig/${domain}/acme.conf".service
    gnupg.secrets."knot/tsig/${domain}/bureau1.conf".service
  ];
  wants = [
    gnupg.secrets."knot/tsig/${domain}/acme.conf".service
    gnupg.secrets."knot/tsig/${domain}/bureau1.conf".service
  ];
};
/* Useless since the zone is public
services.unbound.settings = {
  stub-zone = {
    name = domain;
    stub-addr = "127.0.0.1@5353";
  };
};
'';
*/
}