{ config, ... }: {
  services.unbound = {
    enable = true;
    settings = {
      server = {
        interface = [ "0.0.0.0" "::0" ];
        access-control = [
          "127.0.0.0/8 allow"
          "10.42.96.0/24 allow"
          "10.42.97.0/24 allow"
          "10.42.98.0/24 allow"
          "10.42.99.0/24 allow"
          "10.42.101.0/24 allow"
          "10.42.254.0/24 allow"
        ];
        tls-cert-bundle = "/var/lib/acme/fw.cloonar.com/fullchain.pem";
        local-zone = "\"cloonar.com\" transparent";
        local-data = [
          "\"localhost A 127.0.0.1\""
          "\"localhost.cloonar.com A 127.0.0.1\""
          "\"localhost AAAA ::1\""
          "\"localhost.cloonar.com AAAA ::1\""
          "\"fw.cloonar.com A 10.42.97.1\""
          "\"fw A 10.42.97.1\""

          "\"switch.cloonar.com IN A 10.42.97.10\""
          "\"drone.cloonar.com IN A 10.42.97.118\""
          "\"hv-02.cloonar.com IN A 10.42.97.3\""
          "\"home-assistant.cloonar.com IN A 10.42.97.20\""
          "\"deconz.cloonar.com IN A 10.42.97.20\""
          "\"mopidy.cloonar.com IN A 10.42.97.20\""
          "\"snapcast.cloonar.com IN A 10.42.97.20\""
          "\"cl-storage-01.cloonar.com IN A 10.42.97.9\""
          "\"git.cloonar.com IN A 10.44.97.118\""

          "\"stage.wsw.at IN A 10.254.235.22\""
          "\"prod.wsw.at IN A 10.254.217.23\""
          "\"piwik.wohnservice-wien.at IN A 10.254.240.109\""
          "\"wohnservice-wien.at IN A 10.254.240.109\""
          "\"mieterhilfe.at IN A 10.254.240.109\""
          "\"wohnpartner-wien.at IN A 10.254.240.109\""
          "\"wohnberatung-wien.at IN A 10.254.240.109\""
          "\"wienbautvor.at IN A 10.254.240.109\""
          "\"a.wohnservice-wien.at IN A 10.254.240.109\""
          "\"a.wohnpartner-wien.at IN A 10.254.240.109\""
          "\"a.stage.wohnservice-wien.at IN A 10.254.240.110\""
          "\"a.stage.mieterhilfe.at IN A 10.254.240.110\""
          "\"a.stage.wohnpartner-wien.at IN A 10.254.240.110\""
          "\"a.stage.wohnberatung-wien.at IN A 10.254.240.110\""
          "\"a.stage.wienbautvor.at IN A 10.254.240.110\""
          "\"a.stage.wienwohntbesser.at IN A 10.254.240.110\""
          "\"upgrade-staging.wohnservice-wien.at IN A 10.254.240.110\""
          "\"upgrade-staging.mieterhilfe.at IN A 10.254.240.110\""
          "\"upgrade-staging.wohnpartner-wien.at IN A 10.254.240.110\""
          "\"upgrade-staging.wohnberatung-wien.at IN A 10.254.240.110\""
          "\"upgrade-staging.wienbautvor.at IN A 10.254.240.110\""
          "\"upgrade-staging.wienwohntbesser.at IN A 10.254.240.110\""

          "\"testing.ebs.amz.at IN A 80.120.142.235\""
          "\"api.testing-ebs.amz.at IN A 80.120.142.235\""

          "\"metz.cloonar.com IN A 10.42.96.167\""
          "\"firetv-living.cloonar.com IN A 10.42.96.175\""
          "\"ps5-living.cloonar.com IN A 10.42.96.176\""

          "\"ddl-warez.to IN A 172.67.184.30\""
        ];
        local-data-ptr = [
          "\"127.0.0.1 localhost\""
          "\"::1 localhost\""
          "\"10.42.97.10 switch.cloonar.com\""
          "\"10.42.97.1 fw.cloonar.com\""
          "\"10.42.97.118 drone.cloonar.com\""
          "\"10.42.97.3 hv-02.cloonar.com\""
          "\"10.42.97.20 home-assistant.cloonar.com\""
          "\"10.42.97.9 cl-storage-01.cloonar.com\""
          "\"10.42.97.118 git.cloonar.com\""

          "\"10.254.235.22 stage.wsw.at\""
          "\"10.254.217.23 prod.wsw.at\""
          "\"10.254.240.109 wohnservice-wien.at\""
          "\"10.254.240.110 a.stage.wohnservice-wien.at\""

          "\"80.120.142.235 testing.ebs.amz.at\""

          "\"172.67.184.30 ddl-warez.to\""
        ];
      };
      forward-zone = [
        {
          name = ".";
          forward-addr = [ 
            "10.44.96.1"
            # "9.9.9.9#dns11.quad9.net"
            # "149.112.112.112#dns11.quad9.net"
          ];
        }
        {
          name = "ghetto.at.local.";
          forward-addr = [
            "10.43.97.1"
          ];
        }
        {
          name = "epicenter.works.";
          forward-addr = [
            "10.50.60.1"
          ];
        }
        {
          name = "akvorrat.at.";
          forward-addr = [
            "10.50.60.1"
          ];
        }
        {
          name = "epicenter.intra.";
          forward-addr = [
            "10.14.1.1"
          ];
        }
        {
          name = "intra.epicenter.works.";
          forward-addr = [
            "10.14.1.1"
          ];
        }
      ];
    };
  };

  security.acme.certs."fw.cloonar.com" = {
    domain = "fw.cloonar.com";
    group = config.services.unbound.group;
  };
}