# SPDX-License-Identifier: Apache-2.0
{ config, pkgs, ... }:
let
  # https://github.com/StevenBlack/hosts/issues/451
  # https://github.com/ScriptTiger/Hosts-Conversions
  # https://github.com/ScriptTiger/scripttiger.github.io
  # https://scripttiger.github.io/alts/
  adblockLocalZones = pkgs.stdenv.mkDerivation {
    name = "adblock-rpz";
    src = (pkgs.fetchFromGitHub {
        owner = "ScriptTiger";
        repo = "scripttiger.github.io";
        # nix-prefetch-github ScriptTiger scripttiger.github.io
        rev = "04402a6726f97c5f0d30436a70ac1344dccb7cf1";
        sha256 = "iSTR7j7QEr5xYtImyntDlVLbnN2ipcLcTRr4sfdx078=";
      } + "/alts/rpz/blacklist.txt");
    phases = [ "installPhase" ];
    installPhase = "install -m 444 -D $src $out";
  };
  domain = "sealight.xyz";
  certdir = config.security.acme.certs.${domain}.directory;
in {
  networking.firewall.allowedTCPPorts = [ 853 ];
  networking.firewall.allowedUDPPorts = [ 853 ];

  # for acme certs, TODO: make a proper group
  users.users.knot-resolver.extraGroups = [ "nginx" ];

  # https://github.com/NixOS/nixpkgs/issues/81109
  nixpkgs.config.packageOverrides = pkgs: rec {
    knot-resolver = pkgs.knot-resolver.override { extraFeatures = true; };
  };
  services.kresd = {
    enable = true;
    # Plain DNS only from localhost.
    # You might want to add a LAN or VPN subnet, depending on deployment.
    #listenPlain = [ "127.0.0.1:53" "[::1]:53" ];
    listenTLS = [ "853" ];
    #listenDoH = [ "" "[::]:443" ];
    instances = 1;
    # TODO: chain.pem for stapling: https://gitlab.nic.cz/knot/knot-resolver/-/issues/517
      #policy.add(
      #    policy.rpz(
      #        policy.DENY_MSG('domain blocked by your resolver operator'),
      #        '${adblockLocalZones}',
      #        false))
    extraConfig = ''
      modules.load('predict')
      modules = { 'hints > iterate' }
      policy.add(
          policy.all(
              policy.TLS_FORWARD({
                  {'45.90.30.0', hostname='87b4e9.dns2.nextdns.io'},
		  {'45.90.28.0', hostname='87b4e9.dns1.nextdns.io'}
                  })))
      policy.add(policy.suffix(policy.FORWARD({'10.0.69.4', '172.16.11.240'}), {todname('mossnet.lan')}))

      net.tls("${certdir}/fullchain.pem", "${certdir}/key.pem")

      -- refresh certs when ACME updates them
      -- TODO: could probably do with systemd and a control socket?
      -- TODO: may fail on first boot if ACME isn't fast, add a systemd dep
      local notify = require('cqueues.notify')
      local watcher = notify.opendir('${certdir}')
      watcher:add('fullchain.pem')

      worker.coroutine(function ()
        for flags, name in watcher:changes() do
          for flag in notify.flags(flags) do
            print('file watcher:', name, notify[flag])
          end
          if name == 'fullchain.pem' then
            net.tls("${certdir}/fullchain.pem", "${certdir}/key.pem")
          end
        end
      end)

      -- Below we create a tmpfs FS for the cache -- use almost all of it:
      cache.size = cache.fssize() - 1*MB
    '';
  };
}