{
  services = {
    blocky = {
      enable = true;
      settings = {
        ports = {
          dns = 53;
          http = 4000;
        };
        upstreams = {
          groups = {
            default = [ "127.0.0.1:5335" ];
            "100.64.0.0/10" = [ "127.0.0.1:5454" ];
          };
        };

        blocking = {
          blackLists = {
            ads = [
              "https://big.oisd.nl/domainswild"
              "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews/hosts"
            ];
          };

          clientGroupsBlock = {
            default = [ "ads" ];
          };
        };

        customDNS = {
          mapping = {
            "ci.datarift.nl" = "10.0.0.251";
            "home.datarift.nl" = "10.0.0.251";
            "frigate.datarift.nl" = "10.0.0.251";
            "git.datarift.nl" = "10.0.0.203";
            "loki.datarift.nl" = "10.0.0.4";
            "minio.datarift.nl" = "10.0.0.251";
            "minio-admin.datarift.nl" = "10.0.0.251";
            "mqtt.datarift.nl" = "10.0.0.254";
            "nix-cache.datarift.nl" = "10.0.0.209";
            "saga.datarift.nl" = "10.0.0.251";
            "track.datarift.nl" = "10.0.0.254";
            "vidz.datarift.nl" = "10.0.0.211";

            # Horus
            "vaultserver.horus.nu" = "192.168.4.32";
          };
        };

        prometheus = {
          enable = true;
        };

        queryLog = {
          type = "csv";
          target = "/var/lib/blocky/querylog";
          logRetentionDays = 7;
        };
      };
    };
  };
}