// @ts-check
/// <reference path="types-dnscontrol.d.ts" />

// Use of `require` confuses TypeScript, use `require_glob` instead

/// <reference path="helpers.js" />
require_glob("./helpers.js")

/**
 * @typedef {Object} SSHFPConfig
 * @property {0 | 1 | 2 | 3 | 4} algo
 * @property {0 | 1 | 2} type
 * @property {string} fingerprint
 */

/**
 * @typedef {Object} HostConfig
 * @property {string} v4 - IPv4 address for the host
 * @property {string} v6 - IPv6 address for the host
 * @property {SSHFPConfig[]} [sshfp] - SSH fingerprints (use `just get-ssh-host-key $hostname`)
 */

/**
 * @type {Record<string, HostConfig>}
 */
var hosts = {
  hasel: {
    v4: '185.55.243.110',
    v6: '2a00:1913:682b::',
    sshfp: [
      { algo: 1, type: 1, fingerprint: "4ab581a1f0d115678e6724e2d865208ab195ccd6" },
      { algo: 1, type: 2, fingerprint: "f50a2082a18b4bcf96c3f94c9554312468e67c65ef44a936c8d12933dc2416a8" },
      { algo: 4, type: 1, fingerprint: "664e7f23544b9c758ee66d5f8164db7a6d5970e8" },
      { algo: 4, type: 2, fingerprint: "27a1dbd525c0efe21f56dba96dfcd7c7bdb07756e510ca15e2626e23ef2483b6" },
    ]
  },
  ulme: {
    v4: '217.154.218.62',
    v6: '2a01:239:4a4:3500::1',
    sshfp: [
      { algo: 1, type: 1, fingerprint: "af9057771e9d2f215c9bdfe8f1d972e413fd5227" },
      { algo: 1, type: 2, fingerprint: "8a6c41463b27603a33b1b80825db768aed9e7017bfd35daf663fe0de1504b2cd" },
      { algo: 4, type: 1, fingerprint: "5c971199010522d124e39550bbd9750988d94fad" },
      { algo: 4, type: 2, fingerprint: "73d956c341b745713a07df47d478721ad64aa1102669cb33d3fd8d71cf231e06" },
    ]
  }
}

/**
 * @param {string} name
 * @param {RecordModifier[]} [modifiers]
 */
function fly(name, modifiers) {
  var ownershipValue = 'app-d8rdp9j';
  var flyApp = 'd8rdp9j.flynet-butterfly-1123.fly.dev.'

  var rec = name === '@' ? ALIAS : CNAME
  var primary = rec.bind(null, name, flyApp)

  var records = [
    primary.apply(null, modifiers),
    TXT.bind(null, prefix(name, '_fly-ownership'), ownershipValue).apply(null, modifiers),
  ]

  if (rec === ALIAS) {
    records.push(
      HTTPS.bind(null, name, 1, flyApp, https({
        alpn: ['h2'],
      })).apply(null, modifiers),
    )
  }

  return records
}

var nameservers = [
  'ns-global.kjsl.com.',
  'puck.nether.net.',
]

var ns_records = nameservers.map(function (hostname) {
  return NAMESERVER(hostname)
})

var soa = SOA('@', nameservers[0], 'hostmaster.alanpearce.eu.', 43200, 3600, 2419200, 120)

// Providers:

var RegistrarOVH = NewRegistrar('ovh')
var PowerDNS = NewDnsProvider('powerdns', {
  zone_kind: 'Master',
})

// Domains:

DEFAULTS(DefaultTTL('1d'), NAMESERVER_TTL('1d'))

D(
  'alanpearce.eu',
  RegistrarOVH,
  DnsProvider(PowerDNS),

  soa,
  ns_records,

  CAA_BUILDER({
    iodef: 'mailto:alan@alanpearce.eu',
    issue: [
      'letsencrypt.org',
      'actalis.it',
    ],
    issuewild: ['none'],
    issuemail: ['none'],
    issuevmc: ['none']
  }),

  fly('@', [TTL('1h')]),
  // ALIAS('@', 'homestead-homestead488.danubedata.run.', TTL('1h')),
  HTTPS(
    '@', 10, 'homestead-homestead488.danubedata.run.',
    https({
      alpn: ['h2'],
    }), TTL('1h')
  ),
  acmeDelegate('@', '019dbafc-1535-723a-a7f4-1767cc565d5f._acme.danubedata.run.'),

  fly('www'),
  acmeDelegate('www', 'www.alanpearce.eu.019dd44b._acme.danubedata.run.'),

  // prettier-ignore
  bulkCNAME([
    'go',
    'git',
    'searchix',
  ], 'hasel.hosts.alin.ovh.'),

  TXT('subdomain-owner-verification', '2da94817a704cfce6a6358d2062f52c9'),

  IGNORE('home', 'A,AAAA'),
  IGNORE('_acme-challenge', 'TXT'),
  IGNORE('_acme-challenge.**', 'TXT'),

  [
    migaduMX,
    migaduDKIM('alanpearce.eu'),
    TXT('@', 'hosted-email-verify=zy5gdvdu'),
  ],

  SPF_BUILDER({
    parts: ['v=spf1', 'include:spf.migadu.com', 'a:hasel.hosts.alin.ovh', '-all']
  }),

  DMARC_BUILDER({
    policy: 'reject',
    percent: 100,
    subdomainPolicy: 'reject',
    alignmentSPF: 'r',
  })
)

D(
  'alin.ovh',
  RegistrarOVH,
  DnsProvider(PowerDNS),

  soa,
  ns_records,

  CAA_BUILDER({
    iodef: 'mailto:alin@alin.ovh',
    issue: [
      'letsencrypt.org',
      'actalis.it',
    ],
    issuewild: ['none'],
    issuemail: ['none'],
    issuevmc: ['none']
  }),

  fly('@', [TTL('1h')]),
  HTTPS(
    '@', 10, 'homestead-homestead488.danubedata.run.',
    https({
      alpn: ['h2'],
    }), TTL('1h')
  ),
  acmeDelegate('@', 'alin.ovh.019dd3dc._acme.danubedata.run.'),

  fly('www'),
  acmeDelegate('www', 'www.alin.ovh.019dd449._acme.danubedata.run.'),

  fly('status'),
  fly('uptime'),

  bulkCNAME([
    'net',
    'turn.net',
    'dash.net',
  ], 'ulme.hosts.alin.ovh.'),

  bulkCNAME([
    'binarycache',
    'cal',
    'ci',
    'files',
    'git',
    'go',
    'iam',
    'id',
    'notify',
    'pdns',
    'redis',
    'searchix',
    'stats',
    '*.stats',
  ], 'hasel.hosts.alin.ovh.'),

  IGNORE('home', 'A,AAAA'),
  IGNORE('_acme-challenge', 'TXT'),
  IGNORE('_acme-challenge.**', 'TXT'),

  [
    migaduMX,
    migaduDKIM('alin.ovh'),
    TXT('@', 'hosted-email-verify=glmqwcun'),
  ],

  SPF_BUILDER({
    parts: ['v=spf1', 'include:spf.migadu.com', 'a:hasel.hosts.alin.ovh', '-all']
  }),

  DMARC_BUILDER({
    policy: 'reject',
    percent: 100,
    subdomainPolicy: 'reject',
    rua: ['mailto:re+wloi96boexp@dmarc.postmarkapp.com'],
    alignmentSPF: 'r',
  })
)

for (var hostname in hosts) {
  D_EXTEND("hosts.alin.ovh", mkHostRecords(hostname, hosts[hostname]))
}

D(
  'searchix.ovh',
  RegistrarOVH,
  DnsProvider(PowerDNS),
  DefaultTTL(86400),
  NAMESERVER_TTL(86400),

  CAA_BUILDER({
    iodef: 'mailto:tls@alin.ovh',
    issue: [
      'actalis.it',
    ],
    issuewild: ['none'],
    issuemail: ['none'],
    issuevmc: ['none']
  }),
  IGNORE('_acme-challenge', 'TXT'),
  IGNORE('_acme-challenge.**', 'TXT'),

  SPF_BUILDER({
    parts: ['v=spf1', '-all'],
  }),

  soa,
  ns_records,

  ALIAS('@', 'hasel.hosts.alin.ovh.'),
  HTTPS('@', 1, 'hasel.hosts.alin.ovh.', 'alpn=h3,h2'),

  CNAME('stats', 'hasel.hosts.alin.ovh.'),
  CNAME('stable', 'hasel.hosts.alin.ovh.'),
  CNAME('stats.stable', 'hasel.hosts.alin.ovh.'),
  fly('status')
)