nixos/services/bind.nix

# This Configuration is meant for local DNS setups only!
{
  options,
  config,
  lib,
  fn,
  pkgs,
  ...
}:
with builtins;
with lib; let
  cfg = config.machine;
in
  mkIf (elem "bind" cfg.services) {
    services.bind = {
      enable = true;
      listenOn = ["127.0.0.1"];
      forwarders = [
        # Cloudflare CDN
        "1.1.1.1"
        "1.0.0.1"
        #CCC DNS
        "204.152.184.76"
        "159.203.38.175"
        "207.148.83.241"
      ];
      # TODO: add DNSSEC
      extraOptions = ''
        dnssec-validation auto;

        recursion yes;
        allow-recursion { 127.0.0.1; };
        version none;
      '';
    };
  }