{ ... }:
let
  domains = import ../../modules/dns/domains.nix;
in
{
  imports = [
    ../../modules/dns/authoritative.nix
  ];

  # ns1 = primary (master): holds each master zone file, notifies ns2 and
  # allows it to pull the zone via AXFR/IXFR.
  services.knot.settings.zone = map (d: {
    domain = d;
    file = ../../modules/dns/zones + "/${d}.zone";
    "zonefile-load" = "whole";
    "zonefile-sync" = "-1";
    notify = [ "ns2" ];
    acl = [ "acl_ns2" ];
  }) domains;
}