{...}: {
  imports = [./traefik.nix];
  services.adguardhome = {
    enable = true;
    mutableSettings = true;
    settings.bind_port = 3001;
    openFirewall = true;
  };
  networking.firewall = {
    allowedTCPPorts = [53];
    allowedUDPPorts = [53];
  };
  services.traefik.dynamicConfigOptions.http = {
    routers.adguard = {
      rule = "Host(`guard.xenia.me.uk`)";
      service = "adguard-webinterface";
      tls = {certResolver = "default";};
    };
    services.adguard-webinterface.loadBalancer.servers = [{url = "http://localhost:3001";}];
  };
}