{ pkgs, lib, config, ... }:
with builtins;
let
  inherit (builtins.extraBuiltins) pass git;
  inherit (pkgs.lib) unlinesAttrs;
  inherit (config) networking;
  inherit (config.services) nsd rspamd;
  # Use the Git commit time of the ${zone}.nix file to set the serial number.
  # WARNING: the ${zone}.nix must be committed into Git for this to work.
  serial = zone: toString (git ./. [ "log" "-1" "--format=%ct" "--" (zone + ".nix") ]);
  /*
  serial = file: lib.removeSuffix "\n" (readFile
    (pkgs.runCommand "zone-serial"
      { buildInputs      = [ pkgs.git ];
        buildDepends     = [ (./. + file) ];
        preferLocalBuild = true;
        allowSubstitutes = false;
      } ''
      cd ${./.}
      ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
    ''));
  */
  # FIXME: make dedicated config options
  #ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
  ipv4 = "80.67.180.129";
  #ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
  sourcephileZone = domain: ''
    ; A (DNS -> IPv4)
    @ A ${ipv4}
    ${networking.hostName} A ${ipv4}
    autoconfig A ${ipv4}
    code       A ${ipv4}
    git        A ${ipv4}
    imap       A ${ipv4}
    mail       A ${ipv4}
    ns         A ${ipv4}
    pop        A ${ipv4}
    smtp       A ${ipv4}
    submission A ${ipv4}
    www        A ${ipv4}

    ; SPF (Sender Policy Framework)
    @ 3600 IN SPF "v=spf1 mx ip4:${ipv4} -all"
    @ 3600 IN TXT "v=spf1 mx ip4:${ipv4} -all"

    ; MX (Mail eXchange)
    @ 180 MX 5 mail

    ; SRV (SeRVice)
    _git._tcp.git 18000 IN SRV 0 0 9418 git

    ; TXT (TeXT)
    ''
    + lib.optionalString rspamd.dkim.enable
        (unlinesAttrs
          (selector: sel: sel.dns)
          rspamd.dkim.domains."${domain}".selectors)
    ;
in
{
  environment.systemPackages = [
    (pkgs.bind.override { enablePython = true; })
  ];
  services.nsd = {
    zones = {
      # NOTE: cannot use networking.domain as attr key: infinite recursion.
      "sourcephile.fr" = {
        # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
        # DOC: https://www.sidn.nl/en/dnssec/dnssec-signatures-in-bind-named
        provideXFR = [ "217.70.177.40 NOKEY" ];
        notify     = [ "217.70.177.40 NOKEY" ];
        dnssec = true;
        data = ''
          $ORIGIN ${networking.domainBase}.fr.
          $TTL 500

          ; SOA (Start Of Authority)
          @ SOA ns admin (
            ${serial networking.domainBase} ; Serial number
            24h   ; Refresh
            15m   ; Retry
            1000h ; Expire (1000h)
            1d    ; Negative caching
          )

          ; NS (Name Server)
          @ NS ns
          @ NS ns6.gandi.net.
        ''
        + sourcephileZone "${networking.domainBase}.fr";
      };
    };
  };
}