{
  config,
  inputs,
  lib,
  pkgs,
  this,
  ...
}:
with lib;
let
  cfg = config.nixfiles.modules.unbound;
in
{
  options.nixfiles.modules.unbound = {
    enable = mkEnableOption "Unbound";

    domain = mkOption {
      description = "Domain name sans protocol scheme.";
      type = with types; str;
      default = config.networking.domain;
    };
  };

  config =
    let
      adblock-conf = "${config.services.unbound.stateDir}/adblock.conf";
    in
    mkIf cfg.enable {
      ark.directories = [ config.services.unbound.stateDir ];

      nixfiles.modules.redis.enable = true;

      services = {
        unbound = {
          enable = true;

          package = pkgs.unbound-with-systemd.override {
            withRedis = true;
            withTFO = true;
          };

          checkconf = false;
          settings = {
            server = {
              interface = with this.wireguard; [
                "127.0.0.1"
                "::1"
                ipv4.address
                ipv6.address
              ];

              local-zone = concatLists (
                mapAttrsToList (h: _: [ "\"${h}.${cfg.domain}\" redirect" ]) my.configurations
              );
              local-data = concatLists (
                mapAttrsToList (
                  hostname:
                  let
                    domain = "${hostname}.${cfg.domain}";
                  in
                  attr:
                  (optionals (hasAttr "wireguard" attr) (
                    with attr.wireguard;
                    [
                      "\"${domain} 604800 IN A ${ipv4.address}\""
                      "\"${domain} 604800 IN AAAA ${ipv6.address}\""
                      "\"${domain}. A ${ipv4.address}\""
                      "\"${domain}. AAAA ${ipv6.address}\""
                    ]
                    ++ concatMap (domain: [
                      "\"${domain}. A ${ipv4.address}\""
                      "\"${domain}. AAAA ${ipv6.address}\""
                    ]) attr.domains
                  ))
                ) my.configurations
              );
              local-data-ptr = concatLists (
                mapAttrsToList (
                  hostname:
                  let
                    domain = "${hostname}.${cfg.domain}";
                  in
                  attr:
                  (optionals (hasAttr "wireguard" attr) (
                    with attr.wireguard;
                    [
                      "\"${ipv4.address} ${domain}\""
                      "\"${ipv6.address} ${domain}\""
                    ]
                    ++ concatMap (domain: [
                      "\"${ipv4.address} ${domain}\""
                      "\"${ipv6.address} ${domain}\""
                    ]) attr.domains
                  ))
                ) my.configurations
              );

              private-domain = map (domain: "${domain}.") [
                cfg.domain
                "local"
              ];
              private-address = with config.nixfiles.modules.wireguard; [
                ipv4.subnet
                ipv6.subnet
              ];

              access-control = with config.nixfiles.modules.wireguard; [
                "0.0.0.0/0 refuse"
                "::/0 refuse"
                "127.0.0.0/8 allow"
                "::1/128 allow"
                "${ipv4.subnet} allow"
                "${ipv6.subnet} allow"
              ];

              cache-min-ttl = 0;

              serve-expired = true;
              serve-expired-reply-ttl = 0;

              prefetch = true;
              prefetch-key = true;

              hide-identity = true;
              hide-version = true;

              extended-statistics = true;

              log-replies = false;
              log-tag-queryreply = false;
              log-local-actions = false;

              verbosity = 0;

              include = ''"${adblock-conf}"'';
            };

            forward-zone = [
              {
                name = ".";
                forward-tls-upstream = true;
                forward-addr =
                  let
                    mkDnsOverTls =
                      ips: auth:
                      map (
                        ip:
                        concatStrings [
                          ip
                          "@"
                          auth
                        ]
                      ) ips;
                  in
                  mkDnsOverTls dns.const.quad9.default "853#dns.quad9.net";
              }
            ];

            cachedb = with config.services.redis.servers.default; {
              backend = "redis";
              redis-server-host = bind;
              redis-server-port = port;
            };
          };

          enableRootTrustAnchor = true;

          localControlSocketPath = "/run/unbound/unbound.socket";
        };

        prometheus.exporters.unbound = {
          enable = true;
          listenAddress = mkDefault this.wireguard.ipv4.address;
          port = 9167;
          inherit (config.services.unbound) group user;
          unbound.host = "unix://${config.services.unbound.localControlSocketPath}";
        };
      };

      systemd = {
        services = {
          unbound.after = [ "unbound-adblock-update.service" ];

          unbound-adblock-update = {
            serviceConfig = with config.services.unbound; {
              Type = "oneshot";
              User = user;
              Group = group;
              ExecStart = getExe (
                pkgs.writeShellApplication {
                  name = "unbound-adblock-update";
                  runtimeInputs = [
                    pkgs.curl
                    package
                  ];
                  text = ''
                    curl \
                      -s \
                      -o ${adblock-conf} \
                      "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/multi.blacklist.conf"

                    if [[ -f "${localControlSocketPath}" ]]; then
                      unbound-control reload
                    fi
                  '';
                }
              );
            };
          };
        };

        timers.unbound-adblock-update = {
          requires = [ "network-online.target" ];
          after = [ "network-online.target" ];
          timerConfig = {
            OnCalendar = "daily";
            Persistent = true;
            Unit = "unbound-adblock-update.service";
          };
          wantedBy = [ "timers.target" ];
        };
      };

      boot.kernel.sysctl."net.ipv4.tcp_fastopen" = mkOverride 200 3;

      topology = with cfg; {
        nodes.${this.hostname}.services.unbound = {
          name = "Unbound";
          icon = "${inputs.homelab-svg-assets}/assets/unbound.svg";
          details.listen.text = concatMapStringsSep "\n" (i: "${i}:53") (
            filter (i: i != "127.0.0.1" && i != "::1") config.services.unbound.settings.server.interface
          );
        };
      };
    };
}