{ pkgs, config, ... }: {
  services.adguardhome = {
    enable = true;
    openFirewall = true;
    settings = {
      upstream_dns = [
        "194.242.2.2"
        "9.9.9.9"
        "1.1.1.1"
      ];
    };
    # todo add blocklist
    # https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.plus.txt
  };

}