{ flakeRoot, ... }:
let
  nsdPort = 5340;
in
{
  services.nsd = {
    enable = true;
    interfaces = [ "127.0.0.1" ];
    verbosity = 5;
    port = nsdPort;
    zones."sorre.internal." = {
      data = builtins.readFile (flakeRoot + /etc/dns/sorre.internal.zone);
      provideXFR = [ "127.0.0.1 NOKEY" ];
    };
  };

  services.resolved.enable = false;
  services.unbound = {
    enable = true;
    settings = {
      server = {
        interface = [
          "127.0.0.1"
          "2301:db8:acad:a::1"
        ];
        verbosity = 5;
        do-not-query-localhost = false;
        access-control = [
          # allow wireguard
          "2301:db8:acad:a::/64 allow"

          # allow localhost
          "127.0.0.0/8 allow"

          # block all else
          "0.0.0.0/0 refuse"
          "::0/0 refuse"
        ];
      };

      auth-zone = [
        {
          name = "sorre.internal.";
          primary = "127.0.0.1@${toString nsdPort}";
          fallback-enabled = false;
          for-downstream = true;
        }
      ];
    };
  };
}