{ config, dns, ... }:
with dns.lib.combinators;
let
  cfg = config.lab.networking;
in
{
  CAA = letsEncrypt "caa@kun.is";

  SOA = {
    nameServer = "ns1";
    adminEmail = "webmaster@kun.is";
    serial = 2024011401;
  };

  NS = [
    "ns1.kun.is."
    "ns2.kun.is."
  ];

  MX = [
    (mx.mx 10 "mail.kun.is.")
  ];

  subdomains = {
    "*" = {
      A = [ cfg.public.ipv4.router ];
      AAAA = [ cfg.dmz.ipv6.dockerSwarm ];
    };

    ns = {
      A = [ cfg.public.ipv4.router ];
      AAAA = [ cfg.dmz.ipv6.services ];
    };

    ns1 = {
      A = [ cfg.public.ipv4.router ];
      AAAA = [ cfg.dmz.ipv6.services ];
    };

    ns2 = {
      A = [ cfg.public.ipv4.router ];
      AAAA = [ cfg.dmz.ipv6.services ];
    };

    # Override because we don't support IPv6 for Git SSH.
    git = {
      A = [ cfg.public.ipv4.router ];
      AAAA = [ ];
    };

    # Override because we don't support IPv6 for KMS.
    kms = {
      A = [ cfg.public.ipv4.router ];
      AAAA = [ ];
    };

    # Override because wg is on opnsense so ipv6 differs from "cfg.dmz.ipv6.services"
    wg = {
      A = [ cfg.public.ipv4.router ];
      AAAA = [ cfg.dmz.ipv6.router ];
    };

  };
}