{ pkgs, ... }:

let
  adblockLocalZones = pkgs.stdenv.mkDerivation {
    name = "unbound-zones-adblock";

    src = (pkgs.fetchFromGitHub {
      owner = "StevenBlack";
      repo = "hosts";
      rev = "3.0.0";
      sha256 = "01g6pc9s1ah2w1cbf6bvi424762hkbpbgja9585a0w99cq0n6bxv";
    } + "/hosts");

    phases = [ "installPhase" ];

    installPhase = ''
      ${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u >  $out
    '';
  };

in {
  networking.firewall.allowedTCPPorts = [ 53 853 5353 ];
  networking.firewall.allowedUDPPorts = [ 53 853 5353 ];
  networking.extraHosts = '' 127.0.0.1 helix.domain '';
	  # These are causing errors, goes in the server file
	  # local-data = "mossnet.lan. 10800 IN A 10.0.69.4";
  services.unbound = {
    enable = true;
    settings = {
	  server = {
	    interface = [ "0.0.0.0" ];
	    tls-upstream = true;
            tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt";
	    include = "${adblockLocalZones}";
	    access-control = "0.0.0.0/0 allow";
	    verbosity = 2;
	    do-tcp = true;
	    do-ip4 = true;
	    prefetch = true;
	    prefetch-key = true;
	    rrset-roundrobin = true;
	    qname-minimisation-strict = true;
	    hide-identity = true;
	    hide-version = true;
	    local-zone = "mossnet.lan. static";
	  };
	  forward-zone = [{
            name = ".";
            forward-addr = [  "45.90.28.77#c46fd3.dns1.nextdns.io" "2a07:a8c0::#c46fd3.dns1.nextdns.io" "45.90.30.77#c46fd3.dns2.nextdns.io" "2a07:a8c1::#c46fd3.dns2.nextdns.io" ];
	  }];
	  remote-control.control-enable = true;
    };
  };
}