{ pkgs, config, lib, ... }:

with lib;
let
  cfg = config.nki.services.edns;
in
{
  options.nki.services.edns = {
    enable = mkEnableOption "Enable encrypted DNS";
    ipv6 = mkEnableOption "Enable ipv6";
    cloaking-rules = mkOption {
      type = types.attrsOf types.str;
      default = { };
      description = "A set of domain -> ip mapping for cloaking_rules";
    };
  };

  config = mkIf cfg.enable {
    # networking.nameservers = [ "127.0.0.1" "::1" ];
    # networking.resolvconf.enable = mkOverride 1000 false;
    # networking.dhcpcd.extraConfig = "nohook resolv.conf";
    # networking.networkmanager.dns = "none";

    services.dnscrypt-proxy2 = {
      enable = true;

      settings = {
        server_names = [ ]; # Pick a server yourself

        # Filters
        ipv6_servers = cfg.ipv6;
        require_dnssec = true;
        require_nofilter = true;

        # Sources
        sources.public_resolvers = {
          urls = [ "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md" "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md" ];
          cache_file = "/var/lib/dnscrypt-proxy/public_resolvers.md";
          minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
        };

        # Making things go fast
        block_ipv6 = !cfg.ipv6;

        # Anonymized DNS
        anonymized_dns.routes = [
          { server_name = "*"; via = [ "anon-plan9-dns" "anon-v.dnscrypt.up-ipv4" ]; }
        ];
        anonymized_dns.skip_incompatible = true;

        # Cloaking rules
        cloaking_rules = pkgs.writeText "cloaking_rules.txt" (lib.strings.concatStringsSep
          "\n"
          (lib.attrsets.mapAttrsToList (name: ip: "${name} ${ip}") cfg.cloaking-rules));
      };
    };
  };
}