{ ... }:
{
  services.dnsmasq = {
    enable = true;

    settings = {
      bind-interfaces = true;
      listen-address = [ "127.0.0.1" ];

      server = [
        "1.1.1.1"
        "1.0.0.1"
      ];

      conf-dir = "/etc/dnsmasq.d,*.conf";
    };
  };

  systemd.tmpfiles.rules = [ "d /etc/dnsmasq.d 0755 root resolvconf" ];

  networking.networkmanager.dns = "dnsmasq";
}