{
  config,
  pkgs,
  inputs,
  ...
}: let
  domain = config.customOps.domain.fqdn;
  hagezi_pro = pkgs.writeText "hagezi_pro.rpz" builtins.readFile inputs.hagezi_pro_rpz;
  hagezi_tif_part1 = pkgs.writeText "hagezi_tif_part1.rpz" builtins.readFile inputs.hagezi_tif_part1_rpz;
  hagezi_tif_part2 = pkgs.writeText "hagezi_tif_part2.rpz" builtins.readFile inputs.hagezi_tif_part2_rpz;
in {
  networking.firewall = {
    allowedTCPPorts = [53 853];
    allowedUDPPorts = [53];
  };
  services = {
    kresd = {
      enable = true;
      listenPlain = [
        "[::]:53"
        "0.0.0.0:53"
      ];
      listenTLS = [
        "[::]:853"
        "0.0.0.0:853"
      ];
      extraConfig = ''
        modules.load('policy')
        policy.add(
          policy.rpz(
            policy.DENY_MSG('blocked by "hagezi pro" list'),
            '${hagezi_pro}',
            false
          )
        )
        policy.add(
          policy.rpz(
            policy.DENY_MSG('blocked by "hagezi TIF" list'),
            '${hagezi_tif_part1}',
            false
          )
        )
        policy.add(
          policy.rpz(
            policy.DENY_MSG('blocked by "hagezi TIF" list'),
            '${hagezi_tif_part2}',
            false
          )
        )
      '';
    };
    doh-server = {
      enable = true;
      settings = {
        path = "/";
        upstream = ["udp:127.0.0.1:53"];
      };
    };
    nginx.virtualHosts."dns.${domain}" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://127.0.0.1:8053";
        extraConfig = ''
          proxy_http_version 1.1;
        '';
      };
    };
  };
}