{ config, lib, ... }:
let
  cfg = config.router;
  lans = lib.attrValues cfg.lans;
in
{
  config = lib.mkIf cfg.enable {
    services.unbound = {
      enable = true;
      settings = {
        server = {
          interface = [ "127.0.0.1" ] ++ map (l: l.ipv4.address) lans;
          # LAN addresses are assigned by networkd, possibly after Unbound starts.
          ip-freebind = true;
          access-control = [
            "127.0.0.0/8 allow"
          ]
          ++ map (l: "${l.ipv4.subnet} allow") lans;
        };
      }
      // lib.optionalAttrs (cfg.dns.forwarders != [ ]) {
        forward-zone = [
          {
            name = ".";
            forward-addr = cfg.dns.forwarders;
          }
        ];
      };
    };
  };
}