{
  config,
  lib,
  masterDomain,
  securityTemplates,
  ...
}:
let
  cfg = config.os.srv.dns;
  unboundPort = 5335;
in
{
  options.os.srv.dns = {
    enable = lib.mkEnableOption "enables dns scanning";
    adguardProxyConfig = lib.mkOption {
      type = lib.types.attrs;
      default = { };
    };
  };
  config = lib.mkIf cfg.enable {
    services.unbound = {
      enable = true;
      settings = {
        server = {
          interface = [ "127.0.0.1" ];
          port = unboundPort;

          do-ip4 = true;
          do-ip6 = false;
          do-udp = true;
          do-tcp = true;

          num-threads = 4;
          msg-cache-slabs = 4;
          rrset-cache-slabs = 4;
          infra-cache-slabs = 4;
          key-cache-slabs = 4;

          msg-cache-size = "256m";
          rrset-cache-size = "512m";
          infra-cache-numhosts = 20000;

          so-rcvbuf = "8m";
          so-sndbuf = "8m";
          so-reuseport = true;

          qname-minimisation = true;
          prefetch = true;
          prefetch-key = true;
          harden-glue = true;
          harden-dnssec-stripped = true;
          hide-identity = true;
          hide-version = true;
          use-caps-for-id = false; # might try this later
          edns-buffer-size = 1232;

          access-control = [
            "127.0.0.0/8 allow"
            "0.0.0.0/0 deny"
          ];
        };
      };
    };

    services.adguardhome = {
      enable = true;
      mutableSettings = true;

      settings = {
        http.address = "0.0.0.0:3000";
        dns = {
          bind_hosts = [
            "127.0.0.1"
            config.os.core.network.lan.ip
            config.os.core.network.wg.ip
            config.os.core.network.hs.ip
          ];
          rewrites = [
            {
              domain = "router.local";
              answer = config.os.core.network.ips.vm1-opnsense;
            }
          ];
          port = 53;
          upstream_dns = [ "127.0.0.1:${toString unboundPort}" ];
          bootstrap_dns = [ "9.9.9.9" ];
          cache_size = 536870912;
          anonymize_client_ip = true;
        };

        filtering = {
          filtering_enabled = true;
          interval = 24;
        };
        filters = [
          {
            enabled = true;
            name = "Black Mirror Blocklist";
            url = "https://raw.githubusercontent.com/T145/black-mirror/refs/heads/master/dist/ADGUARD_SOURCES.txt";
          }
          {
            enabled = true;
            name = "Scam Blocklist by DurableNapkin";
            url = "https://raw.githubusercontent.com/durablenapkin/scamblocklist/master/adguard.txt";
          }
          {
            enabled = true;
            name = "Neo Dev Host Blocklist";
            url = "https://raw.githubusercontent.com/neodevpro/neodevhost/master/adblocker";
          }
          {
            enabled = true;
            name = "hBlock Blocklist";
            url = "https://hblock.molinero.dev/hosts_adblock.txt";
          }
          {
            enabled = true;
            name = "OISD Big Blocklist";
            url = "https://big.oisd.nl";
          }
          {
            enabled = true;
            name = "StevenBlack Unified";
            url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts";
          }
          {
            enabled = true;
            name = "StevenBlack Fakenews";
            url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts";
          }
          {
            enabled = true;
            name = "StevenBlack Gambling";
            url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/gambling-only/hosts";
          }

          #-----------------------------------------------------------------------------

          # HaGeZi's Blocklists

          {
            enabled = true;
            name = "HaGeZi's Ultimate Blocklist";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/ultimate.txt";
          }
          {
            enabled = false; # Added but disabled Pro++ as a fallback if Ultimate proves to be too aggressive
            name = "HaGeZi's Pro++ DNS Blocklist";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.plus.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's Fake DNS Blocklist";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/fake.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's Threat Intelligence Feeds DNS Blocklist";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's Dynamic DNS Blocklsit";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dyndns.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's Badware Hoster Blocklist";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/hoster.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's URL Shortener Blocklist";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/urlshortener.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's DNS Rebind Protection";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adguard/dns-rebind-protection.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's Gambling DNS Blocklist";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/gambling.txt";
          }

          #-----------------------------------------------------------------------------

          # NEWLY REGISTERED DOMAINS / ENTROPY DGAs

          {
            enabled = true;
            name = "HaGeZi's Newly Registered Domains 7 days ago to yesterday";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd7.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's Newly Registered Domains 14 days ago to 8 days ago";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd14-8.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's Newly Registered Domains 21 days ago to 15 days ago";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd21-15.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's Newly Registered Domains 28 days ago to 12 days ago";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd28-22.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's Newly Registered Domains 35 days ago to 29 days ago";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd35-29.txt";
          }
          {
            enabled = true;
            name = "HaGeZi's Newly Registered High Entropy Domains";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dga30.txt";
          }

          #-----------------------------------------------------------------------------

          # DNS BYPASS BLOCKLISTS

          {
            enabled = true;
            name = "HaGeZi's DNS Bypass Blocklist";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/doh-vpn-proxy-bypass.txt";
          }
          {
            enabled = true;
            name = "DNS HTTPS Blocklist";
            url = "https://raw.githubusercontent.com/Bryantdl7/pihole-blocklists/main/dns-https-block.txt";
          }

          #-----------------------------------------------------------------------------

          # NSFW DNS BLOCKLISTS

          {
            enabled = true;
            name = "HaGeZi's NSFW DNS Blocklist";
            url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nsfw.txt";
          }
          {
            enabled = true;
            name = "oisd NSFW";
            url = "https://nsfw.oisd.nl";
          }
          {
            enabled = true;
            name = "StevenBlack NSFW Blocklist";
            url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts";
          }
        ];
      };
    };

    os.srv.dns.adguardProxyConfig = {
      "adguard.${masterDomain}" = {
        enableACME = true;
        forceSSL = true;

        locations."/" = {
          proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
          extraConfig = securityTemplates.restrictToInternal;
        };
      };
    };

    networking.firewall = {
      allowedUDPPorts = [ 53 ];
      allowedTCPPorts = [ 53 ];
    };
  };
}