{ pkgs, lib, config, ... }:
let
  inherit (lib) types;
  inherit (config.services) knot;
  inherit (config.users) users groups;
in
{
imports = [
  knot/autogeree.net.nix
  knot/sourcephile.fr.nix
];
options.services.knot = {
  zones = lib.mkOption {
    default = {};
    type = types.attrsOf (types.submodule ({name, ...}: {
      #config.domain = lib.mkDefault name;
      options = {
        conf = lib.mkOption {
          type = types.lines;
        };
        data = lib.mkOption {
          type = types.nullOr types.lines;
        };
      };
    }));
  };
};
config = {
systemd.services.knot.serviceConfig.ExecStartPre =
  lib.mapAttrsToList (domain: {data, ...}: ''
    +${pkgs.coreutils}/bin/install -D -o ${users.knot.name} -g ${groups."knot".name} -m 700 \
     ${pkgs.writeText "${domain}.zone" data} \
     /var/lib/knot/zones/${domain}.zone
  '') knot.zones;
/*
systemd.services.knot.postStart = lib.mkAfter ''
  PATH="/run/current-system/sw/bin:$PATH"
  knotc zone-freeze ${domain}.
  while ! knotc zone-status ${domain}. +freeze | grep -q 'freeze: yes'; do sleep 1; done
  knotc zone-flush ${domain}.
  install -o knot -g knot -m 700 ${zone} /var/lib/knot/signed/${domain}.zone
  knotc zone-reload ${domain}.
  knotc zone-thaw ${domain}.
'';
*/
networking.nftables.ruleset = ''
  table inet filter {
    chain input-net {
      meta l4proto { udp, tcp } th dport domain counter accept comment "knot: DNS"
    }
    set output-net-knot-ipv4 { type ipv4_addr; }
    set output-net-knot-ipv6 { type ipv6_addr; }
    chain output-net {
      skuid ${users.knot.name} \
        meta l4proto { udp, tcp } th dport domain \
        ip daddr @output-net-knot-ipv4 \
        counter accept \
        comment "knot: DNS notify"
      skuid ${users.knot.name} \
        meta l4proto { udp, tcp } th dport domain \
        ip6 daddr @output-net-knot-ipv6 \
        counter accept \
        comment "knot: DNS notify"
    }
  }
'';
services.knot = {
  enable = true;
  extraArgs = [ "-v" ];
  # https://www.knot-dns.cz/docs/2.6/html/reference.html
  extraConfig = ''
    server :
      # Listen on localhost to allow only there
      # dynamic updates for ACME challenges.
      listen: 127.0.0.1@5353

    mod-rrl:
      - id: default
        rate-limit: 200
        slip: 2

    template:
      - id: default
        dnssec-signing: off
        # move databases below the state directory, because they need to be writable
        storage: /var/lib/knot/zones
        # Input-only zone files
        # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3
        # prevents modification of the zonefiles, since the zonefiles are immutable
        #zonefile-sync: -1
        zonefile-load: difference
        journal-content: changes
        global-module: mod-rrl/default

    database:
        journal-db: /var/lib/knot/journal
        kasp-db: /var/lib/knot/kasp
        timer-db: /var/lib/knot/timer

    log:
      - target: syslog
        any: info

    remote:
      - id: local_resolver
        address: 127.0.0.1@53

      - id: secondary_gandi
        address: 217.70.177.40@53

      - id: secondary_muarf
        address: 78.192.65.63@53

    submission:
      - id: dnssec_validating_resolver
        parent: local_resolver

    policy:
      - id: rsa
        single-type-signing: false
        ksk-shared: false
        algorithm: RSASHA256
        ksk-size: 4096
        zsk-size: 2048
        zsk-lifetime: 30d
        ksk-lifetime: 365d
        ksk-submission: dnssec_validating_resolver

      - id: ed25519
        single-type-signing: false
        ksk-shared: false
        algorithm: ED25519
        ksk-size: 256
        zsk-size: 256
        zsk-lifetime: 30d
        ksk-lifetime: 365d
        cds-cdnskey-publish: always
        ksk-submission: dnssec_validating_resolver

    acl:
      # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
      - id: acl_gandi
        address: 217.70.177.40
        action: transfer

      - id: acl_muarf
        address: 78.192.65.63
        action: transfer

  '' + lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: {conf, ...}: conf) knot.zones);
};
};
}