{ config, pkgs, lib, ... }:

# mercury — Raspberry Pi 3B+ (aarch64). Network DNS + DHCP (+ adblock).
# Boots from an SD image (see flake: nixosConfigurations.mercury), so there is
# no disko / hardware-configuration here — the sd-image module provides them.
{
  imports = [
    ../../common.nix           # shared base: user / ssh / nix / firewall
    # ../../services/<dns>.nix  # add once the DNS service is chosen (below)
  ];

  networking.hostName = "mercury";

  # ---- Static networking ----
  # A DNS/DHCP server must have a fixed address. Fill in the Pi's real values
  # (from `ip -brief a` / `ip route` on the running Pi). eth0 = the Pi's NIC.
  networking.useDHCP = false;
  networking.usePredictableInterfaceNames = false;   # keep it named eth0
  networking.interfaces.eth0.ipv4.addresses = [
    { address = "10.0.0.2"; prefixLength = 24; }      # CHANGE-ME: the Pi's IP
  ];
  networking.defaultGateway = { address = "10.0.0.1"; interface = "eth0"; };  # CHANGE-ME
  # Upstream resolvers for the box itself (the adblock DNS forwards to these).
  networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];

  # ---- DNS + adblock + DHCP — pick ONE, then open its ports below ----
  #
  # Option A: pihole (native module)
  #   services.pihole-ftl = {
  #     enable = true;
  #     # dhcp, lists, upstreams, local records...
  #   };
  #
  # Option B: AdGuard Home (native module, fully declarative)
  #   services.adguardhome = {
  #     enable = true;
  #     settings = {
  #       dns.upstream_dns = [ "1.1.1.1" "9.9.9.9" ];
  #       # filters (adlists), rewrites (local DNS), dhcp static leases...
  #     };
  #   };
  #
  # Then open the ports this service needs:
  #   networking.firewall.allowedTCPPorts = [ 53 80 ];   # DNS + web UI
  #   networking.firewall.allowedUDPPorts = [ 53 67 ];   # DNS + DHCP

  # Do not modify after first flash.
  system.stateVersion = "26.05";
}