{pkgs, lib, config, ...}:
with builtins;
let inherit (builtins.extraBuiltins) pass git;
    inherit (pkgs.lib) unlinesAttrs;
    inherit (config) networking;
    inherit (config.services) nsd rspamd;
    # Use the Git commit time of the ${zone}.nix file to set the serial number.
    # WARNING: the ${zone}.nix must be committed into Git for this to work.
    serial = zone: toString (git ./. [ "log" "-1" "--format=%ct" "--" (zone + ".nix") ]);
    /*
    serial = file: lib.removeSuffix "\n" (readFile
      (pkgs.runCommand "zone-serial"
        { buildInputs      = [ pkgs.git ];
          buildDepends     = [ (./. + file) ];
          preferLocalBuild = true;
          allowSubstitutes = false;
        } ''
        cd ${./.}
        ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
      ''));
    */
    # FIXME: make dedicated config options
    #ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
    ipv4 = "80.67.180.251";
    ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
    sourcephileZone = domain: ''
      ; A (DNS -> IPv4)
      @ A ${ipv4}
      ${networking.hostName} A ${ipv4}
      autoconfig A ${ipv4}
      code       A ${ipv4}
      git        A ${ipv4}
      imap       A ${ipv4}
      mail       A ${ipv4}
      ns         A ${ipv4}
      pop        A ${ipv4}
      smtp       A ${ipv4}
      submission A ${ipv4}
      www        A ${ipv4}

      ; SPF (Sender Policy Framework)
      @ 3600 IN SPF "v=spf1 mx ip4:${ipv4} -all"
      @ 3600 IN TXT "v=spf1 mx ip4:${ipv4} -all"

      ; MX (Mail eXchange)
      @ 180 MX 5 mail

      ; SRV (SeRVice)
      _git._tcp.git 18000 IN SRV 0 0 9418 git

      ; TXT (TeXT)
      ''
      + lib.optionalString rspamd.dkim.enable
          (unlinesAttrs
            (selector: sel: sel.dns)
            rspamd.dkim.domains."${domain}".selectors)
      ;
in
{
  services.nsd = {
    zones = {
      # NOTE: cannot use networking.domain as attr key: infinite recursion.
      "sourcephile.fr" = {
        data = ''
          $ORIGIN ${networking.domainBase}.fr.
          $TTL    86400

          ; SOA (Start Of Authority)
          @ SOA ns admin (
            ${serial networking.domainBase} ; Serial number
            1d      ; Refresh
            15m     ; Retry
            2592000 ; Expire
            1d      ; TTL (Time To Live) minimum
          )

          ; NS (Name Server)
          @ NS ns
          @ NS ns6.gandi.net.
        ''
        + sourcephileZone "${networking.domainBase}.fr";
      };
    };
  };
}