- services/adguardhome.nix: upstream unbound, .sol local domain, DHCP 50-200 - nix-owned config (mutableSettings=false); adlists + dns declared - mercury imports adguard + unbound; drop the pick-one placeholder block - TODO: bcrypt admin password, jupiter static lease via UI (needs its MAC)