{ pkgs, self, ... }:
rec {
  octodns-zones =
    let
      nixosConfigModules = pkgs.lib.mapAttrsToList (
        key: current:
        # The iso image doesn't do any dns stuff
        if key == "iso" then
          { }
        else
          # Copy over all dns records
          { satellite.dns = current.config.satellite.dns; }
      ) self.nixosConfigurations;

      evaluated = pkgs.lib.evalModules {
        specialArgs = {
          inherit pkgs;
        };
        modules = [
          ../modules/nixos/dns.nix
          ../modules/common/octodns.nix
          ./common.nix
        ] ++ nixosConfigModules;
      };
    in
    evaluated.config.satellite.dns.octodns;

  octodns-sync = pkgs.symlinkJoin {
    name = "octodns-sync";
    paths = [ self.packages.${pkgs.system}.octodns ];
    buildInputs = [
      pkgs.makeWrapper
      pkgs.yq
    ];

    postBuild = ''
      cat ${./octodns.yaml} | yq '.providers.zones.directory="${octodns-zones}"' > $out/config.yaml
      wrapProgram $out/bin/octodns-sync \
        --run 'export CLOUDFLARE_TOKEN=$( \
            sops \
              --decrypt \
              --extract "[\"cloudflare_dns_api_token\"]" \
              ./hosts/nixos/common/secrets.yaml \
          )' \
        --add-flags "--config-file $out/config.yaml"
    '';
  };
}