{ config, lib, ... }:

{
  services.dnsmasq = {
    enable = true;

    extraConfig = ''
      bogus-priv # do not forward revese lookups of internal addresses
      domain-needed # do not forward names without domain
      local-service # only respond to queries from local network
      no-hosts # do not resolve hosts from /etc/hosts
      no-resolv # only use explicitly configured resolvers

      server=/fritz.box/192.168.100.1

      domain=home.sbruder.de

      dhcp-range=192.168.100.20,192.168.100.150,12h
      dhcp-option=option:router,192.168.100.1
    '';
    servers = [
      "127.0.0.1#5353"
      "::1#5353"
    ];
  };

  services.prometheus.exporters.dnsmasq = {
    enable = true;
    listenAddress = "127.0.0.1";
    leasesPath = "/var/lib/dnsmasq/dnsmasq.leases";
  };

  services.stubby = {
    enable = true;
    listenAddresses = [
      "127.0.0.1@5353"
      "0::1@5353"
    ];
    upstreamServers = (lib.concatMapStrings
      (server: with server; "  - { address_data: ${addr}, tls_auth_name: \"${authName}\" }\n")
      (lib.flatten
        (lib.mapAttrsToList
          (authName: addrs: map (addr: { inherit addr authName; }) addrs)
          {
            "dns.digitale-gesellschaft.ch" = [
              "185.95.218.42"
              "185.95.218.43"
              "2a05:fc84::42"
              "2a05:fc84::43"
            ];
            "dns3.digitalcourage.de" = [
              "5.9.164.112"
            ];
            "dnsovertls.sinodun.com" = [
              "145.100.185.15"
              "2001:610:1:40ba:145:100:185:15"
            ];
            "dnsovertls1.sinodun.com" = [
              "145.100.185.16"
              "2001:610:1:40ba:145:100:185:16"
            ];
          })));
  };

  networking.firewall.allowedUDPPorts = [ 53 67 ];
  networking.firewall.allowedTCPPorts = [ 53 ];
}