{
  pkgs,
  config,
  lib,
  ...
}: let
  service = "cloudflare-ddns";
  cfg = config.homelab.ddns;
  sec = config.sops.secrets;
in {
  options.homelab.ddns = {
    enable = lib.mkEnableOption "enables ddns with cloudflare";
    motd = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = service;
    };
  };

  config = lib.mkIf cfg.enable {
    services.${service} = {
      enable = true;
      credentialsFile = sec."cloudflare/api_token".path;
      domains = [
        # recoil.pro
        "recoil.pro"
        "*.recoil.pro"
        "mc.recoil.pro"
        "smp.recoil.pro"
        "superflat.recoil.pro"
        "skyblock.recoil.pro"
        "cobblemon.recoil.pro"

        # blakedheld.xyz
        #"blakedheld.xyz"
        #"*.blakedheld.xyz"
        #"git.blakedheld.xyz"
        #"up.blakedheld.xyz"

        # holocron.blue
        #"holocron.blue"
        #"*.holocron.blue"
        "git.holocron.blue"
        "pass.holocron.blue"
        "photos.holocron.blue"
        "media.holocron.blue"
        "up.holocron.blue"
        # mc servers
        "mine.holocron.blue"
        "smp.holocron.blue"
        "skyblock.holocron.blue"
        "superflat.holocron.blue"
      ];
    };

    # declare authkey secrets
    sops.secrets = {
      "cloudflare/api_token" = {
        owner = "cloudflare-ddns";
        group = "cloudflare-ddns";
      };
    };
  };
}