{config, ...}:
{
  services.adguardhome = {
    enable = true;
    # Keep DNS behavior reproducible and prevent stale UI settings from
    # overriding the declared upstream resolvers.
    mutableSettings = false;
    port = 3007;
    settings = {

      http.address = "127.0.0.1";
      http.port = 3007;
      dns = {
        bind_hosts = [ "0.0.0.0" ];
        port = 53;

        # Query independent providers in parallel so one unavailable upstream
        # cannot break DNS for the complete Headscale network.
        upstream_dns = [
          "1.1.1.1"
          "8.8.8.8"
        ];
        upstream_mode = "parallel";
        fallback_dns = [
          "9.9.9.9"
        ];

        # Bootstrap resolvers are IP addresses to avoid a DNS dependency loop.
        bootstrap_dns = [
          "1.1.1.1"
          "8.8.8.8"
        ];
      };
      filtering = {
        rewrites = [
          { domain = "desk.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          { domain = "webhook.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          { domain = "files.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          #{ domain = "git.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          { domain = "dash.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          { domain = "calendar.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          #fastpi
          { domain = "radio.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          { domain = "navidrome.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          { domain = "quantum.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          { domain = "metadata.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          { domain = "couchdb.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          { domain = "jellyfin.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
          { domain = "obsidian.${config.domain}"; answer = config.tailnetIPs.blunix; enabled = true; }
        ];
        filtering_enabled = true;
	protection_enabled = true;
	safe_search.enabled = true;
	};
      statistics.enabled = true;
    };
  };	
}