{
  networking = {
    firewall = {
      allowedTCPPorts = [
        53 # domain
      ];
      allowedUDPPorts = [
        53 # domain
      ];
      interfaces.enp116s0 = {
        allowedTCPPorts = [
          80 # http
        ];
        allowedUDPPorts = [
          69 # xinetd/tftpd
          123 # ntp
        ];
      };
    };
  };

  services.chrony = {
    extraConfig = ''
      local stratum 3
      binddevice enp116s0
      allow 192.168.1/24
    '';
  };

  services.unbound = {
    enable = true;
    settings = {
      server = {
        access-control = [
          "0.0.0.0/0 refuse"
          "127.0.0.0/8 allow"
          "::0/0 refuse"
          "::1 allow"
          "192.168.1.0/24 allow"
        ];
        hide-identity = true;
        hide-version = true;
        interface = [
          "lo"
          "enp116s0"
        ];
        local-data = [
          "\"darkstar.bitgnome.net. IN A 192.168.1.1\""
          #"\"hackerswithstyle.se. IN A 192.168.1.1\""
          "\"arrakis.bitgnome.net. IN A 192.168.1.2\""
          "\"caladan.bitgnome.net. IN A 192.168.1.4\""
          "\"mister.bitgnome.net. IN A 192.168.1.10\""
          "\"jupiter.bitgnome.net. IN A 192.168.1.11\""
          "\"saturn.bitgnome.net. IN A 192.168.1.12\""
          "\"uranus.bitgnome.net. IN A 192.168.1.13\""
          "\"neptune.bitgnome.net. IN A 192.168.1.14\""
          "\"deck.bitgnome.net. IN A 192.168.1.16\""
          "\"ginaz.bitgnome.net. IN A 192.168.1.17\""
          "\"loadstar.bitgnome.net. IN A 192.168.1.18\""
          "\"onkyo.bitgnome.net. IN A 192.168.1.19\""
          "\"brother.bitgnome.net. IN A 192.168.1.20\""
          "\"mister-lan.bitgnome.net. IN A 192.168.1.21\""
        ];
        local-data-ptr = [
          "\"192.168.1.1 darkstar.bitgnome.net\""
          "\"192.168.1.2 arrakis.bitgnome.net\""
          "\"192.168.1.4 caladan.bitgnome.net\""
          "\"192.168.1.10 mister.bitgnome.net\""
          "\"192.168.1.11 jupiter.bitgnome.net\""
          "\"192.168.1.12 saturn.bitgnome.net\""
          "\"192.168.1.13 uranus.bitgnome.net\""
          "\"192.168.1.14 neptune.bitgnome.net\""
          "\"192.168.1.16 deck.bitgnome.net\""
          "\"192.168.1.17 ginaz.bitgnome.net\""
          "\"192.168.1.18 loadstar.bitgnome.net\""
          "\"192.168.1.19 onkyo.bitgnome.net\""
          "\"192.168.1.20 brother.bitgnome.net\""
          "\"192.168.1.21 mister-lan.bitgnome.net\""
        ];
        local-zone = [
          "\"bitgnome.net.\" transparent"
          #"\"hackerswithstyle.se.\" transparent"
          "\"1.168.192.in-addr.arpa.\" static"
        ];
        verbosity = 2;
      };
    };
  };
}
