{config, ...}: let
  domain = config.customOps.domain.fqdn;
in {
  networking.firewall = {
    allowedTCPPorts = [53 853];
    allowedUDPPorts = [53];
  };
  services = {
    kresd = {
      enable = true;
      listenPlain = [
        "[::]:53"
        "0.0.0.0:53"
      ];
      listenTLS = [
        "[::]:853"
        "0.0.0.0:853"
      ];
    };
    doh-server = {
      enable = true;
      settings = {
        path = "/";
        upstream = ["udp:127.0.0.1:53"];
      };
    };
    nginx.virtualHosts."dns.${domain}" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://127.0.0.1:8053";
        extraConfig = ''
          proxy_http_version 1.1;
        '';
      };
    };
  };
}