{ lib, config, inputs, hostName, hosts, ... }:
let
  domain = "autogeree.net";
  domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
  inherit (config) networking;
  inherit (config.services) knot;
in
{
  services.knot.zones.${domain} = {
    conf = ''
      acl:
        - id: acl_localhost_acme_${domainID}
          address: 127.0.0.1
          action: update
          update-owner: name
          update-owner-match: equal
          update-owner-name: [_acme-challenge]
          update-type: [TXT]
        - id: acl_tsig_acme_${domainID}
          key: acme_${domainID}
          action: update
          update-owner: name
          update-owner-match: equal
          update-owner-name: [_acme-challenge]
          update-type: [TXT]

      zone:
        - domain: ${domain}
          file: ${domain}.zone
          serial-policy: increment
          semantic-checks: on
          notify: secondary_gandi
          #notify: secondary_muarf
          acl: acl_gandi
          #acl: acl_muarf
          acl: acl_localhost_acme_${domainID}
          acl: acl_tsig_acme_${domainID}
          dnssec-signing: off
          dnssec-policy: ed25519
    '';
    # TODO: increase the TTL once things have settled down
    data = ''
      $ORIGIN ${domain}.
      $TTL 500

      ; SOA (Start Of Authority)
      @ SOA ns root (
        ${toString inputs.self.lastModified} ; Serial number
        24h   ; Refresh
        15m   ; Retry
        1000h ; Expire (1000h)
        1d    ; Negative caching
      )

      ; NS (Name Server)
      @ NS ns
      @ NS ns6.gandi.net.
      ;@ NS ns0.muarf.org.

      ; A (DNS -> IPv4)
      @          A ${hosts.mermet._module.args.ipv4}
      mermet     A ${hosts.mermet._module.args.ipv4}
      autoconfig A ${hosts.mermet._module.args.ipv4}
      code       A ${hosts.mermet._module.args.ipv4}
      git        A ${hosts.mermet._module.args.ipv4}
      imap       A ${hosts.mermet._module.args.ipv4}
      mail       A ${hosts.mermet._module.args.ipv4}
      ns         A ${hosts.mermet._module.args.ipv4}
      pop        A ${hosts.mermet._module.args.ipv4}
      smtp       A ${hosts.mermet._module.args.ipv4}
      submission A ${hosts.mermet._module.args.ipv4}
      www        A ${hosts.mermet._module.args.ipv4}
      chomsky    A 91.216.110.36
      alpes      A 195.88.84.51

      ; SPF (Sender Policy Framework)
      @ 3600 IN SPF "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
      @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"

      ; MX (Mail eXchange)
      @ 180 MX 5 mail

      ; SRV (SeRVice)
      _git._tcp.git 18000 IN SRV 0 0 9418 git

      ; CAA (Certificate Authority Authorization)
      ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
      @ CAA 128 issue "letsencrypt.org"
    '';
  };
  networking.nftables.ruleset = ''
    table inet filter {
      # Gandi DNS
      set output-net-knot-ipv4 { type ipv4_addr; elements = { 217.70.177.42 }; }
      set output-net-knot-ipv6 { type ipv6_addr; elements = { 2001:4b98:d:1::4b }; }
    }
  '';
  services.knot = {
    keyFiles = [
      "/run/credentials/knot.service/${domain}.acme.conf"
    ];
  };
  systemd.services.knot.serviceConfig = {
    LoadCredentialEncrypted = [
      "${domain}.acme.conf:${./. + "/${domain}/acme.conf.cred"}"
    ];
  };
  /* Useless since the zone is public
    services.unbound.settings = {
    stub-zone = {
    name = domain;
    stub-addr = "127.0.0.1@5353";
    };
    };
    '';
  */
}