{pkgs, ...}: let
  zoneFile = pkgs.writeText "severijnse.eu.db" ''
    $ORIGIN severijnse.eu.
    $TTL 3600
    severijnse.eu. 3600 IN SOA ns1.severijnse.eu. abuse.severijnse.eu. 2026071003 3600 1800 1209600 86400
         IN    NS     ns1.severijnse.eu.
         IN    NS     ns2.severijnse.eu.

    @    IN    A      49.13.92.205
    www  IN    A      49.13.92.205
    ns1  IN    A      49.13.92.205
    ns2  IN    A      49.13.92.205
    mail IN    A      49.13.92.205

    @    IN    AAAA   2a01:4f8:c014:2585::1
    www  IN    AAAA   2a01:4f8:c014:2585::1
    ns1  IN    AAAA   2a01:4f8:c014:2585::1
    ns2  IN    AAAA   2a01:4f8:c014:2585::1
    mail IN    AAAA   2a01:4f8:c014:2585::1

    *.severijnse.eu.  IN A      49.13.92.205
    *.severijnse.eu.  IN AAAA   2a01:4f8:c014:2585::1

    @    IN    MX     10 mail.severijnse.eu.

    mail._domainkey.severijnse.eu. 300 IN TXT (
      "v=DKIM1; k=rsa; "
      "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAskpG7m4kninxRE4JF5KzpnBhLbOlGJL2RO/iDfzdz6sHEvxe78q9c5UnZ0OQddOSuQo4q48dJkXR/XzqY7Ak109lhoAx+Kr1neYsi8/"
      "JaoTC8OURk365+/aBSmWXUCCBphCx43QWfC9h8GMQ6PUIqawkz5CcGPT7X7hPdwHQcd5Vn3CqmABptxdwshdkBjZs"
      "oi79BOo9ZrQSTY7iiLcOP7hVVC9Ad+ydlZ4MWGfy5BxgyTGrrtuSuLcM219oqdovIvr2EtXs8AMx5fyXplKE3R/"
      "YlwF2Jcy50Gmb5y/E9pOaFjVv8HXUmKsvuhA2b8K+rt0WVHNc3dvbgZUl8bGAQIDAQAB"
    )
    _dmarc.severijnse.eu. IN TXT "v=DMARC1; p=reject; rua=mailto:abuse@severijnse.eu"
    severijnse.eu. IN TXT "v=spf1 mx ip4:49.13.92.205 -all"

    default._bimi.severijnse.eu. IN TXT "v=BIMI1; l=https://severijnse.eu/logo.svg; avp=personal;"

    severijnse.eu. IN CAA 0 issue "letsencrypt.org"
    severijnse.eu. IN CAA 0 issuewild "letsencrypt.org"
    severijnse.eu. IN CAA 0 iodef "mailto:abuse@severijnse.eu"

    _smtp._tls.severijnse.eu. IN TXT "v=TLSRPTv1; rua=mailto:abuse@severijnse.eu"
    _mta-sts.severijnse.eu. IN TXT "v=STSv1; id=2024120501"

    severijnse.eu.    300    IN    TXT    "google-site-verification=H0HHB7zNQ10uom1zH5f8CEtHcVVcWiuu41ZQv348T5U"

    ; TLSA records updated dynamically by mail-cert-sync service.
    ; The placeholders below mirror the current live certificate so the zone is
    ; correct even if the sync service has not yet run (e.g. a failed boot).
    _25._tcp.mail.severijnse.eu. 3600 IN TLSA 3 1 1 15ec4d8823874c8363af004188338f76e6e6c5878faf25cdf40556b44b26677d
    _465._tcp.mail.severijnse.eu. 3600 IN TLSA 3 1 1 15ec4d8823874c8363af004188338f76e6e6c5878faf25cdf40556b44b26677d
    _993._tcp.mail.severijnse.eu. 3600 IN TLSA 3 1 1 15ec4d8823874c8363af004188338f76e6e6c5878faf25cdf40556b44b26677d

    severijnse.eu. IN DS 20930 13 2 B0D9B13DCE5FA0D41589239EB5166D124B0C9D3060A538726DDCCBFC91E8DBD8

    @       IN DNSKEY 257 3 13 kOc88RGHKdWa7YLjNs7mljux7cT9/9wVNgcp+8jaVe6zle4cHAk6+Sub9wKEVa7Q4FlQYzS1KFL2HOW05Azq1A==
    @       IN DNSKEY 256 3 13 QTFplRlXes5NExKLvuCJmX0l8FhulFNS+sJw+pvcAq4+0T3cCzT6hmcJPjd4BVl6KvvyS78Vij2f7HjrcjyHfw==
    @       IN CDS  20930 13 2 B0D9B13DCE5FA0D41589239EB5166D124B0C9D3060A538726DDCCBFC91E8DBD8
    @       IN CDNSKEY 257 3 13 kOc88RGHKdWa7YLjNs7mljux7cT9/9wVNgcp+8jaVe6zle4cHAk6+Sub9wKEVa7Q4FlQYzS1KFL2HOW05Azq1A==

    severijnse.eu IN SSHFP 1 1 7f5235b2997e0c621fe773acaaae45b9551049ce
    severijnse.eu IN SSHFP 1 2 2ec1d37df094915253c0b059762052ae19e66cd97e82d7a58ac1a0d1bd5d5e52
    severijnse.eu IN SSHFP 3 1 240418eb7cc2a3969257c30363d16103dbfd5822
    severijnse.eu IN SSHFP 3 2 43dbfdd8b131efda4c98844e1434e4f35e773f472bdb355ede94f8a9f7001c35
    severijnse.eu IN SSHFP 4 1 efbd7836208684d110f3a72543eba74ad8e54b44
    severijnse.eu IN SSHFP 4 2 c02f4b13aef78579f3466851fcc741c0169eaa63237463ceacc9bb72a2be0519
  '';
in {
  systemd = {
    services = {
      decrypt-coredns-keys = {
        description = "Decrypt CoreDNS DNSSEC signing keys";
        before = ["coredns.service"];
        wantedBy = ["coredns.service"];
        serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = true;
          Environment = "SOPS_AGE_KEY_FILE=/etc/age/keys.txt";
        };
        script = ''
          SOPS_FILE=${../../secrets/coredns-keys.yaml}
          KEYS_DIR=/var/lib/coredns/keys
          mkdir -p "$KEYS_DIR"

          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.key"
          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.private"
          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.key"
          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.private"

          chmod 644 "$KEYS_DIR/"*
        '';
      };
      coredns = {
        after = ["decrypt-coredns-keys.service"];
        requires = ["decrypt-coredns-keys.service"];

        # Copy zone file from Nix store to writable location on service start
        # TLSA updater will modify the writable copy at runtime
        preStart = ''
          cp -f ${zoneFile} /var/lib/coredns/zones/severijnse.eu.db
          chown coredns:coredns /var/lib/coredns/zones/severijnse.eu.db
        '';
      };
    };
    tmpfiles.rules = [
      "d /var/lib/coredns 0750 coredns coredns -"
      "d /var/lib/coredns/zones 0750 coredns coredns -"
      "d /var/lib/coredns/keys 0750 coredns coredns -"
    ];
  };
  services.coredns = {
    enable = true;
    config = ''
      severijnse.eu {
          bind 127.0.0.1 49.13.92.205 2a01:4f8:c014:2585::1
          file /var/lib/coredns/zones/severijnse.eu.db {
              reload 300s
          }
          dnssec {
              key file /var/lib/coredns/keys/Kseverijnse.eu.+013+38678
              key file /var/lib/coredns/keys/Kseverijnse.eu.+013+20930
          }
          log
          errors
      }

      . {
          bind 127.0.0.1
          forward . 1.1.1.1 8.8.8.8
          log
          errors
      }
    '';
  };
}