{
  config,
  secrets,
  ...
}:
{
  services.resolved = {
    enable = config.modules.networking.resolved.enable;
    dnssec = "true";
    domains = [ "~." ];
    dnsovertls = "true";
    llmnr = "false";

    extraConfig = ''
      DNS=45.90.28.0#${secrets.nextdns_id}.dns.nextdns.io
      DNS=2a07:a8c0::#${secrets.nextdns_id}.dns.nextdns.io
      DNS=45.90.30.0#${secrets.nextdns_id}.dns.nextdns.io
      DNS=2a07:a8c1::#${secrets.nextdns_id}.dns.nextdns.io
    '';
  };
}