{ config, lib, ... }:

let
  cfg = config.local.services.dnscrypt-proxy2;
in
{
  options.local.services.dnscrypt-proxy2 = with lib; {
    enable = mkEnableOption "dnscrypt-proxy2";
  };

  config = lib.mkIf cfg.enable {
    networking = {
      nameservers = [ "127.0.0.1" "::1" ];
      networkmanager.dns = "none";
    };

    services.dnscrypt-proxy2 = {
      enable = true;
      # See: https://github.com/DNSCrypt/dnscrypt-proxy/blob/2.1.5/dnscrypt-proxy/example-dnscrypt-proxy.toml
      settings = {
        require_dnssec = true;
        require_nolog = true;
        require_nofilter = true;

        sources.public-resolvers = {
          urls = [
            "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
            "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
          ];
          cache_file = "/var/lib/dnscrypt-proxy2/public-resolvers.md";
          minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
        };

        # You can choose a specific set of servers from https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md
        server_names = [
          "ams-ads-doh-nl"
          "ams-dnscrypt-nl"
          "ams-doh-nl"
          "brahma-world"
        ];
      };
    };
  };

}