{ myLib, ... }: {
  kubernetes.resources = {
    configMaps.dnsmasq-config.data.config = ''
      address=/kms.kun.is/${myLib.globals.kmsIPv4}
      address=/ssh.git.kun.is/${myLib.globals.gitIPv4}
      alias=${myLib.globals.routerPublicIPv4},${myLib.globals.traefikIPv4}
      expand-hosts
      host-record=hermes.dmz,${myLib.globals.dnsmasqIPv4}
      local=/dmz/
      log-queries
      no-hosts
      no-resolv
      port=53
      server=192.168.30.1
      server=/kun.is/${myLib.globals.bind9IPv4}
    '';

    deployments.dnsmasq.spec = {
      selector.matchLabels.app = "dnsmasq";

      template = {
        metadata.labels.app = "dnsmasq";

        spec = {
          containers.dnsmasq = {
            image = myLib.globals.images.dnsmasq;

            ports.dns = {
              containerPort = 53;
              protocol = "UDP";
            };

            volumeMounts = [{
              name = "config";
              mountPath = "/etc/dnsmasq.conf";
              subPath = "config";
            }];
          };

          volumes.config.configMap.name = "dnsmasq-config";
        };
      };
    };

    services.dnsmasq.spec = {
      type = "LoadBalancer";
      loadBalancerIP = myLib.globals.dnsmasqIPv4;
      selector.app = "dnsmasq";

      ports.dns = {
        port = 53;
        targetPort = "dns";
        protocol = "UDP";
      };
    };
  };
}