{ ... }:

# Pi-hole (pihole-FTL v6) — network DNS (adblock) + DHCP, with the embedded
# web UI. Forwards to the local unbound recursive resolver (services/unbound.nix).
#
# `settings` is the raw pihole.toml. Static DHCP leases ARE declarative here
# (settings.dhcp.hosts, dnsmasq "MAC,IP,hostname" format) — the reason we chose
# pihole over AdGuard.
#
# ⚠️ The pihole-ftl NixOS module + pihole.toml v6 schema are new; VALIDATE this
# at runtime (VM or the Pi) before trusting it — eval only checks the module,
# not the freeform TOML keys.
{
  services.pihole-ftl = {
    enable = true;
    openFirewallDNS = true;
    openFirewallDHCP = true;
    openFirewallWebserver = true;

    lists = [
      { url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"; type = "block"; }
    ];

    settings = {
      dns = {
        upstreams = [ "127.0.0.1#5335" ];   # local unbound (recursive)
        domain = "sol";                       # local domain -> jupiter.sol etc.
      };

      dhcp = {
        active = true;
        start = "10.0.0.50";
        end = "10.0.0.200";
        router = "10.0.0.1";
        leaseTime = "1h";
        # Static leases (declarative). Format: "MAC,IP,hostname".
        hosts = [ "00:e0:4c:3c:a3:1f,10.0.0.20,jupiter" ];
      };

      # Embedded web UI on :80. Set the admin password once after first boot:
      #   sudo pihole setpassword    (kept out of the repo)
      # (plain "80" so the module's openFirewall port parser is happy.)
      webserver.port = "80";
    };
  };
}