nixos/services/bind.nix

# This Configuration is meant for local DNS setups only!
{
  options,
  config,
  lib,
  fn,
  pkgs,
  ...
}:
with builtins;
with lib;
let
  cfg = config.machine;
in
mkIf (elem "bind" cfg.services) {
  services.bind = {
    enable = true;
    listenOn = [ "127.0.0.1" ];
    forwarders = [
      # Cloudflare CDN
      "1.1.1.1"
      "1.0.0.1"
      #CCC DNS
      "204.152.184.76"
      "159.203.38.175"
      "207.148.83.241"
    ];
    # TODO: add DNSSEC
    extraOptions = ''
      dnssec-validation auto;

      recursion yes;
      allow-recursion { 127.0.0.1; };
      version none;
    '';
  };
}