{pkgs, lib, config, ...}:
with builtins;
let inherit (builtins.extraBuiltins) pass;
    inherit (pkgs.lib) unlinesAttrs;
    inherit (config) networking;
    inherit (config.services) nsd /*dkim*/;
    serial = zone: toString (extraBuiltins.git ./. [ "log" "-1" "--format=%ct" "--" (zone + ".nix") ]);
    /*
    serial = file: lib.removeSuffix "\n" (readFile
      (pkgs.runCommand "zone-serial"
        { buildInputs      = [ pkgs.git ];
          buildDepends     = [ (toPath ./. + file) ];
          preferLocalBuild = true;
          allowSubstitutes = false;
        } ''
        cd ${toPath ./.}
        ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
      ''));
    */
    ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
    ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
    sourcephileZone = domain: ''
      ; A (DNS -> IPv4)
      @                   A ${ipv4}
      autoconfig          A ${ipv4}
      code                A ${ipv4}
      git                 A ${ipv4}
      imap                A ${ipv4}
      mail                A ${ipv4}
      ns                  A ${ipv4}
      pop                 A ${ipv4}
      redmine             A ${ipv4}
      smtp                A ${ipv4}
      submission          A ${ipv4}
      www                 A ${ipv4}

      ; SPF (Sender Policy Framework)
      @ 3600 IN SPF "v=spf1 mx ip4:${ipv4} -all"
      @ 3600 IN TXT "v=spf1 mx ip4:${ipv4} -all"

      ; MX (Mail eXchange)
      @ 180 MX 5 mail

      ; SRV (SeRVice)
      _git._tcp.git 18000 IN SRV 0 0 9418 git

      ; TXT (TeXT)
      ''
      /*
      + unlinesAttrs
          (selector: sel: sel.dns)
          dkim.domains."${domain}".selectors
      */;
in
{
  services.nsd = {
    zones = {
      # NOTE: cannot use networking.domain as attr key: infinite recursion.
      "sourcephile.fr" = {
        data = ''
          $ORIGIN ${networking.domainBase}.fr.
          $TTL    86400

          ; SOA (Start Of Authority)
          @ SOA ns admin (
            ${serial networking.domainBase} ; Serial number
            1d      ; Refresh
            15m     ; Retry
            2592000 ; Expire
            1d      ; TTL (Time To Live) minimum
          )

          ; NS (Name Server)
          @ NS ns
          ;@ NS ns6.gandi.net.
        ''
        + sourcephileZone "${networking.domainBase}.fr";
      };
    };
  };
  /*
  services.dkim.domains =
    let domain = rec {
      selector = "2020010101";
      selectors = {
        "2020010101" = {
          key = pass "dkim/${networking.domainBase}/2020010101/key" + "\n";
          dns = ''
            2020010101._domainkey IN TXT ( "v=DKIM1; k=rsa; "
                    "p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7EKzverbG+5JF+yFjH3MrxLyauiHyLqBbV/8LEMunoKXF8sqhBpQtAQXruLqsyUkxR/4CAyPMyzmcdrU43boMj9yFqLrg/kEz2RIvai9jXBqRoWRW1y7F0LbZmdtOTncuDSP8Zzo02XUzsOC4f/C3tEQHS5rchzfhU5FY1CeO6eBMV79qKBOvGMKahQTrrtU6olAAJxOhn6wRuwSf"
                    "+m3on1OqiuXYYIgNHKdRhJ8gDwIm/3LEpYMD0gTgJiyclCLoLGHGtKZy1Wf9xV9/7V6fHE4JW5SDivwslVTL+KPXOlIpo5NDHpMxPYOcIg2K4Rj/j7jhavo+fG43q1LhwaPkEMQMbplgnjeMY8300odRiklTkMMpH0m35ZNeHQJSRpEtV8y5xUNxVaGzfqX5iStwV/mQ1KnZSe8ORTNq+eTTFnDk6zdUXjagcf0wO6QsSTeAz/G8CqOBbwmrU+q"
                    "F8WbGAeRnhz51mH6fTTfsQ1nwjAiF4ou+eQGTkTMN23KkCKpuozJnxqx4DCEr6J1bL83fhXw7CgcfgKgTOk/HFJpeiGhqodw18r4DWBA6G57z9utm7Mr/9SoVnMq6iK9iEcbCllLR8Sz4viatLSRzhodbk7hfvXS3jmCFjILAjFmA7aMTemDMBDQhpAGF9F8sjFUbEJIZjKrWWtSTdO8DilDqN8CAwEAAQ=="
            ) ;
          '';
        };
      };
    }; in
    {
      "${networking.domainBase}.fr" = domain;
    };
  */
}