{ config, pkgs, lib, ... }:
let
  adblockLocalZones = pkgs.stdenv.mkDerivation {
    name = "unbound-zones-adblock";

    src = (pkgs.fetchFromGitHub
      {
        owner = "StevenBlack";
        repo = "hosts";
        rev = "3.12.21";
        sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s=";
      } + "/hosts");

    phases = [ "installPhase" ];

    installPhase = ''
      ${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u >  $out
    '';
  };

  mossnet = "192.168.1.240"; # The local lan-ip for box
  wg-mossnet = "10.0.69.4";  # The wireguard ip for box
  mossnet-hosts = [
    "mossnet.lan"
    "links.mossnet.lan"
    "read.mossnet.lan"
    "stats.mossnet.lan"
    "music.mossnet.lan"
    "rss.mossnet.lan"
    "tasks.mossnet.lan"
    "file.mossnet.lan"
    "books.mossnet.lan"
    "fin.mossnet.lan"
    "paper.mossnet.lan"
    "cal.mossnet.lan"
    "archive.mossnet.lan"
    "tracks.mossnet.lan"
    "grasp.mossnet.lan"
  ];
in
{
  services.unbound = {
    enable = true;
    settings = {
      server = {
        include = "${adblockLocalZones}";
        interface = [ "0.0.0.0" ];
        access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ];
        access-control-view = "10.0.69.0/24 wireguard";
        local-zone = ''"mossnet.lan." redirect'';
        local-data = ''"mossnet.lan. IN A ${mossnet}"'';
      };
      forward-zone = [{
        name = ".";
        forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
      }];
      view = {
        name = "wireguard";
        local-zone = ''"mossnet.lan." redirect'';
        local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
      };
      do-not-query-localhost = "no";
      #  Eventually we'll add DNSSEC / DoT
      #  so-reuseport: yes
      #  tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
      #  tls-upstream: yes
    };
  };

  # With unbound we're doing wildcard redirects, so we don't need that anymore
  # networking.hosts = {
  #   mossnet = mossnet-hosts;
  # };
  networking.firewall.allowedTCPPorts = [ 53 ];
  networking.firewall.allowedUDPPorts = [ 53 ];
}