{
  pkgs ? (
    let
      sources = import ./lon.nix;
      pkgs = import sources.nixpkgs { };
    in
    pkgs
  ),
  lib ? pkgs.lib,
}:
let
  dnscontrol = pkgs.dnscontrol;

  types = pkgs.runCommand "dnscontrol-types" {
    runtimeInputs = [ dnscontrol ];
  } "${lib.getExe dnscontrol} write-types -o $out";
  update-types = ''
    f="types-dnscontrol.d.ts"
    if [[ -e "$f" && ! -L "$f" ]]
    then
      echo "warn: file $f already exists, not updating. Remove to enable automatic updates." >&2
    elif [[ ! ( -L "$f" && "$(readlink -f "$f")" == "${types}" ) ]]
    then
      ln -sf "${types}" "$f"
    fi
  '';
in
pkgs.mkShellNoCC {
  packages = with pkgs; [
    lon
    just
    dnscontrol
    prettier

    # fallback for using lorri (shellHook doesn't work as expected)
    (writeShellScriptBin "update-types" update-types)
    (writeScriptBin "get-consumer-key" ''
      #!/${pkgs.fishMinimal}
      # adapted from <https://docs.dnscontrol.org/provider/ovh#activation>

      if set --query OVH_CONSUMER_KEY
          echo >&2 "Nothing to do. OVH_CONSUMER_KEY is set."
          exit 0
      end

      if ! set --query OVH_APP_KEY
          echo >&2 'Need $OVH_APP_KEY! Go to https://eu.api.ovh.com/createApp/'
          exit 1
      end

      set accessRules '[
          {
              "method": "DELETE",
              "path": "/domain/zone/*"
          },
          {
              "method": "GET",
              "path": "/domain/zone/*"
          },
          {
              "method": "POST",
              "path": "/domain/zone/*"
          },
          {
              "method": "PUT",
              "path": "/domain/zone/*"
          },
          {
              "method": "GET",
              "path": "/domain/*"
          },
          {
              "method": "PUT",
              "path": "/domain/*"
          },
          {
              "method": "POST",
              "path": "/domain/*/nameServers/update"
          }
      ]'

      xh --body \
          POST https://eu.api.ovh.com/1.0/auth/credential \
          X-Ovh-Application:"$OVH_APP_KEY" \
          accessRules:="$accessRules"

    '')
  ];
  shellHook = update-types;
}