{
  pkgs,
  config,
  lib,
  ...
}: let
  service = "dnsmasq";
  cfg = config.homelab.${service};
  sec = config.sops.secrets;
  homelab = config.homelab;
in {
  options.homelab.${service} = {
    enable = lib.mkEnableOption "enables ${service}";
    port = lib.mkOption {
      type = lib.types.int;
      default = 53;
      description = "set port for ${service} (default: ${toString cfg.port}";
    };
  };

  config = lib.mkIf cfg.enable {
    # enable the ${service} service
    services.${service} = {
      enable = true;
      alwaysKeepRunning = true;
      settings = {
        no-resolv = true;
        listen-address = "10.10.0.11"; # your LAN IP
        #interface = "enp89s0";
        bind-interfaces = true;
        #        address = [
        #          "/snowbelle.blakedheld.xyz/10.10.0.10"
        #          "/lumiose.blakedheld.xyz/10.10.0.10"
        #          "/bebe.blakedheld.xyz/10.10.0.1"
        #        ];
        server = [
          # upstream dns
          "10.10.0.1"
        ];
      };
    };

    systemd.services.dnsmasq.serviceConfig = {
      RestartSec = "5s";
      StartLimitBurst = 10;
    };

    # open firewall
    networking.firewall.allowedTCPPorts = [cfg.port];
    networking.firewall.allowedUDPPorts = [cfg.port];
  };
}