@@ -0,0 +1,68 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib.lists) flatten;
+  inherit (lib.strings) concatStringsSep;
+  he = {
+    notify = "216.218.130.2";
+    axfr = [
+      "216.218.133.2"
+      "2001:470:600::2"
+    ];
+  };
+  iplist = ips: concatStringsSep "," (flatten ips);
+
+  domain = config.networking.domain;
+in
+{
+  age.secrets.powerdns.file = ../../secrets/powerdns.age;
+
+  services.powerdns = {
+    enable = true;
+    secretFile = config.age.secrets.powerdns.path;
+    extraConfig = ''
+      launch=gsqlite3
+      dnsupdate=yes
+      allow-dnsupdate-from=0.0.0.0/0,::/0
+      only-notify=
+      also-notify=${iplist [ he.notify ]}
+      allow-axfr-ips=${iplist [ he.axfr ]}
+      expand-alias=yes
+      outgoing-axfr-expand-alias=yes
+      resolver=1.1.1.1
+      log-dns-details=no
+      log-dns-queries=no
+      loglevel=5
+      primary=yes
+      send-signed-notify=no
+
+      default-api-rectify=yes
+      default-soa-edit=inception-increment
+
+      api=yes
+      # replaced by secretFile/envsubst
+      api-key=$API_KEY
+
+      gsqlite3-database=/var/db/pdns/zones.db
+      gsqlite3-pragma-foreign-keys=yes
+      gsqlite3-dnssec=yes
+    '';
+  };
+
+  environment.systemPackages = [ pkgs.pdns ];
+
+  services.caddy.virtualHosts = {
+    "pdns.${domain}" = {
+      extraConfig = ''
+        log {
+          output discard
+        }
+        reverse_proxy 127.0.0.1:8081
+      '';
+    };
+  };
+}