{
  pkgs,
  config,
  lib,
  ...
}: let
  cfg = config.homelab.ddns;
  sec = config.sops.secrets;
in {
  options.homelab.ddns = {
    enable = lib.mkEnableOption "enables ddns with cloudflare";
  };

  config = lib.mkIf cfg.enable {
    services.cloudflare-ddns = {
      enable = true;
      credentialsFile = sec."cloudflare/api_token".path;
      domains = [
        # recoil.pro
        "recoil.pro"
        "*.recoil.pro"
        "mc.recoil.pro"
        "smp.recoil.pro"
        "superflat.recoil.pro"
        "skyblock.recoil.pro"
        "cobblemon.recoil.pro"

        # blakedheld.xyz
        "blakedheld.xyz"
        "*.blakedheld.xyz"
        "git.blakedheld.xyz"
        "up.blakedheld.xyz"
      ];
    };

    # declare authkey secrets
    sops.secrets = {
      "cloudflare/api_token" = {
        owner = "cloudflare-ddns";
        group = "cloudflare-ddns";
      };
    };
  };
}