{ config, ... }: {
  config = {
    services.dnsmasq = {
      enable = true;
      servers = [ "1.1.1.1" "1.0.0.1" ];

      extraConfig = ''
        conf-file=${config.sops.secrets."dnsmasq-private.conf".path}
      '';
    };

    sops.secrets."dnsmasq-private.conf" = {
      format = "binary";
      sopsFile = ../secrets/dnsmasq-private.conf;
    };
  };
}