{ pkgs, lib, config, dns, ... }@inputs:
let
  cfg = config.lab.networking.dmzServices;
  kunisZoneFile = pkgs.writeTextFile {
    name = "kunis-zone-file";
    text = (dns.lib.toString "kun.is" (import ./zones/kun.is.nix inputs));
  };

  geokunis2nlZoneFile = pkgs.writeTextFile {
    name = "geokunis2nl-zone-file";
    text = (dns.lib.toString "geokunis2.nl" (import ./zones/geokunis2.nl.nix inputs));
  };
in
{
  options.lab.networking.dmzServices.enable = lib.mkOption {
    default = false;
    type = lib.types.bool;
    description = ''
      Whether to enable an authoritative DNS server and DNSmasq for DMZ network.
    '';
  };

  config = lib.mkIf cfg.enable {
    lab.networking.allowDMZConnectivity = true;

    networking.firewall.interfaces.${config.lab.networking.dmzBridgeName} = {
      allowedTCPPorts = [ 53 5353 ];
      allowedUDPPorts = [ 53 67 5353 ];
    };

    services = {
      bind = {
        enable = true;
        forwarders = [ ];

        extraOptions = ''
          allow-transfer { none; };
          allow-recursion { none; };
          version none;
          notify no;
        '';

        zones = {
          "kun.is" = {
            master = true;
            file = kunisZoneFile;
            allowQuery = [ "any" ];
          };

          "geokunis2.nl" = {
            master = true;
            file = geokunis2nlZoneFile;
            allowQuery = [ "any" ];
            slaves = [
              "87.253.155.96/27"
              "157.97.168.160/27"
            ];
          };
        };
      };

      dnsmasq = {
        enable = true;
        settings = import ./dnsmasq.nix inputs;
      };
    };
  };
}