{ lib, config, ... }:
let
  inherit (lib) mkEnableOption mkIf tf;
  cfg = config.bagel.gandi;
in
{
  options.bagel.gandi = {
    enable = mkEnableOption "the Gandi DNS configuration";
  };

  config = mkIf cfg.enable {
    terraform.required_providers.gandi = {
      version = "~> 2.3.0";
      source = "go-gandi/gandi";
    };

    resource.secret_resource.gandi_pat.lifecycle.prevent_destroy = true;

    provider.gandi = {
      personal_access_token = tf.ref "resource.secret_resource.gandi_pat.value";
    };

    resource.gandi_livedns_domain.forkos_org = {
      name = "forkos.org";
    };

    resource.gandi_livedns_record = let
      record = name: ttl: type: values: {
        inherit name ttl type values;
      };

      # TODO: make less fragile and have actual unique and stable names
      canonicalName = record: let
        name = builtins.replaceStrings ["."] ["_"] record.name;
      in
        "forkos_org_${record.type}_${name}";

      forkosRecords = records:
        builtins.listToAttrs (map (record: {
          name = canonicalName record;
          value = record // {
            zone = tf.ref "resource.gandi_livedns_domain.forkos_org.id";
          };
        }) records);

    in forkosRecords [
      (record "cl" 3600 "A" ["163.172.69.160"])
      (record "cl" 3600 "AAAA" ["2001:bc8:38ee:100:1000::10"])

      (record "fodwatch" 3600 "A" ["163.172.69.160"])
      (record "fodwatch" 3600 "AAAA" ["2001:bc8:38ee:100:1000::30"])

      (record "netbox" 3600 "A" ["163.172.69.160"])
      (record "netbox" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])

      (record "bagel-box.infra" 3600 "AAAA" ["2001:bc8:38ee:100:100::1"])
      (record "gerrit01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::10"])
      (record "fodwatch.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::30"])
      (record "meta01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])

      (record "grafana" 3600 "CNAME" ["netbox"])
      (record "hydra" 3600 "CNAME" ["bagel-box.infra"])
      (record "loki" 3600 "CNAME" ["meta01.infra"])
      (record "mimir" 3600 "CNAME" ["grafana"])
    ];
  };
}