{pkgs, lib, config, ...}:
let inherit (builtins) toString toPath readFile;
    inherit (config) networking;
    inherit (config.services) nsd;
    serial = zone: toString (builtins.extraBuiltins.git ./. [ "log" "-1" "--format=%ct" "--" (zone + ".nix") ]);
    /*
    serial = file: lib.removeSuffix "\n" (readFile
      (pkgs.runCommand "zone-serial"
        { buildInputs      = [ pkgs.git ];
          buildDepends     = [ (toPath ./. + file) ];
          preferLocalBuild = true;
          allowSubstitutes = false;
        } ''
        cd ${toPath ./.}
        ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
      ''));
    */
    ipv4 = networking.zones.net.ipv4;
    commonZone = ''
      ; A (DNS -> IPv4)
      @                   A ${ipv4}
      autoconfig          A ${ipv4}
      git                 A ${ipv4}
      imap                A ${ipv4}
      mail                A ${ipv4}
      ns                  A ${ipv4}
      pop                 A ${ipv4}
      redmine             A ${ipv4}
      smtp                A ${ipv4}
      submission          A ${ipv4}
      www                 A ${ipv4}

      ; SPF (Sender Policy Framework)
      @ 3600 IN SPF "v=spf1 mx ip4:${ipv4} -all"
      @ 3600 IN TXT "v=spf1 mx ip4:${ipv4} -all"

      ; MX (Mail eXchange)
      @ 180 MX 5 ${ipv4}

      ; SRV (SeRVice)
      _git._tcp.git 18000 IN SRV 0 0 9418 git
    '';
in
{
  config = {
    services.nsd = {
      zones = {
        # NOTE: cannot use networking.domain as attr key: infinite recursion
        "commonsoft.coop" = {
          data = ''
            $ORIGIN ${networking.domainBase}.coop.
            $TTL    86400

            ; SOA (Start Of Authority)
            @ SOA ns admin (
              ${serial networking.domain} ; Serial number
              1d      ; Refresh
              15m     ; Retry
              2592000 ; Expire
              1d      ; TTL (Time To Live) minimum
            )

            ; NS (Name Server)
            @ NS ns
            ;@ NS ns6.gandi.net.
          '' + commonZone;
          };
        "commonsoft.org" = {
          data = ''
            $ORIGIN ${networking.domainBase}.org.
            $TTL    86400

            ; SOA (Start Of Authority)
            @ SOA ns admin (
              ${serial networking.domain} ; Serial number
              1d      ; Refresh
              15m     ; Retry
              2592000 ; Expire
              1d      ; TTL (Time To Live) minimum
            )

            ; NS (Name Server)
            @ NS ns
            ;@ NS ns6.gandi.net.
          '' + commonZone;
          };
        "commonsoft.net" = {
          data = ''
            $ORIGIN ${networking.domainBase}.net.
            $TTL    86400

            ; SOA (Start Of Authority)
            @ SOA ns admin (
              ${serial networking.domain} ; Serial number
              1d      ; Refresh
              15m     ; Retry
              2592000 ; Expire
              1d      ; TTL (Time To Live) minimum
            )

            ; NS (Name Server)
            @ NS ns
            ;@ NS ns6.gandi.net.
          '' + commonZone;
          };
      };
    };
  };
}