{
  pkgs,
  config,
  inputs,
  ...
}: {
  systemd = {
    services.radicle-bootstrap = {
      serviceConfig.Type = "oneshot";
      script = ''
        nu ${./zone.nu} \
          --db "/var/lib/radicle/node/node.db" \
          --query ${./addresses.sql} \
          --zone "/etc/knot/dns-sd.zone"

        knotc -b zone-reload "bootstrap.radicle.network"
      '';
      after = ["systemd-resolved.service"];
      wants = ["knot.service"];
      requires = [
        "knot.service"
        "systemd-resolved.service"
      ];
      path = with pkgs; [
        knot-dns
        nushell
        config.systemd.package
      ];
    };
    timers.radicle-bootstrap = {
      timerConfig = {
        OnCalendar = "*:0/5";
        RandomizedDelaySec = "1min";
        Unit = "radicle-bootstrap.service";
      };
      wantedBy = ["timers.target"];
    };
  };
  services.nginx.virtualHosts."bootstrap.radicle.network" = {
    enableACME = true;
    forceSSL = true;
    serverName = "bootstrap.radicle.network";
    root = "/var/www/bootstrap.radicle.network";
    locations."/".extraConfig = ''
      add_header 'Access-Control-Allow-Origin' '*';
      autoindex on;
    '';
  };
}