# The provider account of dynamic DNS (protocol, server, username,
# passwordFile) moves to `dnsProviders`, named after the protocol, so that
# certificates can use the same account. The secret file stays where it is.
if (.router.ddns // null) == null
   or (.router.ddns.provider // null) != null
   or ((.router.ddns | keys) - ["enable", "zone", "domains", "ipv4", "ipv6", "ssl", "interval"] | length) == 0
then .
else
  (.router.ddns.protocol // "cloudflare") as $name
  | .router.dnsProviders = ((.router.dnsProviders // {}) + {
      ($name): (
        {type: $name}
        + (if .router.ddns.username != null then {username: .router.ddns.username} else {} end)
        + (if .router.ddns.server != null then {server: .router.ddns.server} else {} end)
        + (if .router.ddns.passwordFile != null then {secretFile: .router.ddns.passwordFile} else {} end)
      )})
  | .router.ddns.provider = $name
  | del(.router.ddns.protocol, .router.ddns.server, .router.ddns.username, .router.ddns.passwordFile)
end