{ config, lib, ... }:
let
  cfg = config.homelab.networking.core;
in
{
  config = {
    imports = [
      ./firewall.nix
    ];

    networking = {
      networkmanager = {
        enable = true;
        dns = "systemd-resolved";
      };

      networking.extraHosts = lib.concatMapStringsSep "\n" (
        host: "${host.ip_address} ${host.hostname}"
      ) cfg.extraHosts;

      nftables.enable = true;

      nameservers = config.core.nameservers;
    };

    services.resolved = {
      enable = true;

      settings.Resolve = {
        dnssec = "true";
        DNSOverTLS = "true";
        domains = [ "~." ];
        fallbackDns = cfg.nameservers;
      };

    };
  };
}