{ config, pkgs, lib, ... }:

{
  architect.firewall.openUDPVPN = [ 53 ];

  services = {
    dnsmasq = {
      enable = true;
      settings = {
        server = [
          "45.90.28.77"
          "45.90.30.77"
          "2a07:a8c0::d6:5174"
          "2a07:a8c1::d6:5174"
        ];
        localise-queries = true;
        min-cache-ttl = 120;
        max-cache-ttl = 2400;
        domain = [
          "runas.rocks"
          "giugl.io"
          "devs.runas.rocks"
          "devs.giugl.io"
        ];
      };
    };
  };
}