{ myLib, ... }: {
  kubernetes.resources = {
    # TODO: generate this with nix?
    configMaps.dnsmasq-config.data.config = ''
      address=/kms.kun.is/${myLib.globals.kmsIPv4}
      address=/ssh.git.kun.is/${myLib.globals.gitIPv4}
      alias=${myLib.globals.routerPublicIPv4},${myLib.globals.traefikIPv4}
      expand-hosts
      host-record=hermes.dmz,${myLib.globals.dnsmasqIPv4}
      local=/dmz/
      log-queries
      no-hosts
      no-resolv
      port=53
      server=192.168.30.1
      server=/kun.is/${myLib.globals.bind9IPv4}
    '';

    deployments.dnsmasq = {
      metadata.labels.app = "dnsmasq";

      spec = {
        selector.matchLabels.app = "dnsmasq";

        template = {
          metadata.labels.app = "dnsmasq";

          spec = {
            containers.dnsmasq = {
              image = "dockurr/dnsmasq:2.90";

              ports.dns = {
                containerPort = 53;
                protocol = "UDP";
              };

              volumeMounts = [{
                name = "config";
                mountPath = "/etc/dnsmasq.conf";
                subPath = "config";
              }];
            };

            volumes.config.configMap.name = "dnsmasq-config";
          };
        };
      };
    };

    services.dnsmasq.spec = {
      type = "LoadBalancer";
      loadBalancerIP = myLib.globals.dnsmasqIPv4;
      selector.app = "dnsmasq";

      ports.dns = {
        port = 53;
        targetPort = "dns";
        protocol = "UDP";
      };
    };
  };
}