{ pkgs, lib, config, hosts, ... }:
let
  domain = "autogeree.net";
  domainID = lib.replaceStrings ["."] ["_"] domain;
  inherit (config.security) gnupg;
  inherit (config.users) users groups;
in
{
networking.nftables.ruleset = ''
  # for lego to update ACME DNS-01 challenge
  add rule inet filter fw2net ip daddr ${hosts.mermet._module.args.ipv4} meta l4proto { udp, tcp } th dport 53 counter accept comment "ACME DNS-01"
  # for lego to check DNS propagation on ns6.gandi.net
  add rule inet filter fw2net ip daddr 217.70.177.40 meta l4proto { udp, tcp } th dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  add rule inet filter fw2net ip6 daddr 2001:4b98:d:1::40 meta l4proto { udp, tcp } th dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  # for lego to check DNS propagation on ns0.muarf.org
  #add rule inet filter fw2net ip daddr 78.192.65.63 meta l4proto { udp, tcp } th dport 53 skuid ${users.acme.name} counter accept comment "DNS muarf"
'';
security.acme.certs."${domain}" = {
  email = "root+letsencrypt@${domain}";
  extraDomainNames = [
    "*.${domain}"
  ];
  group = groups.acme.name;
  keyType = "rsa4096";
  dnsProvider = "rfc2136";
  # ns6.gandi.net takes roughly 5min to update
  # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  #dnsPropagationCheck = false;
  credentialsFile = gnupg.secrets."lego/${domain}/rfc2136".path;
};
security.gnupg.secrets."lego/${domain}/rfc2136" = {
  pipe = ''
    cat - ${pkgs.writeText "env" ''
    RFC2136_NAMESERVER=ns.${domain}:53
    RFC2136_TSIG_ALGORITHM=hmac-sha256.
    RFC2136_TSIG_KEY=acme_${domainID}
    RFC2136_PROPAGATION_TIMEOUT=1000
    RFC2136_POLLING_INTERVAL=30
    RFC2136_SEQUENCE_INTERVAL=30
    RFC2136_DNS_TIMEOUT=1000
    RFC2136_TTL=1
    ''}
  '';
};
systemd.services."acme-${domain}" = {
  after = [
    "unbound.service"
    gnupg.secrets."lego/${domain}/rfc2136".service
  ];
  wants = [
    "unbound.service"
    gnupg.secrets."lego/${domain}/rfc2136".service
  ];
};
}