{ ... }:

{
  networking.hostName = "opus";
   networking.networkmanager.enable = true;

  # Primary DNS via Mullvad DoT (Base mode).
  # When systemd-resolved is enabled, these servers are fed into its
  # `Resolve.DNS` list. The `#server` suffix is systemd-resolved's
  # DoT (DNS-over-TLS) syntax and is ignored by non-resolved consumers.
  networking.nameservers = [
    "194.242.2.4#base.dns.mullvad.net"
    "194.242.2.2#dns.mullvad.net"
  ];

  # systemd-resolved: Mullvad primary, Quad9 fallback.
  # Options live under `settings.Resolve` (the flat `services.resolved.*`
  # aliases were removed upstream — they now emit deprecation warnings).
  services.resolved = {
    enable = true;
    settings.Resolve = {
      DNSOverTLS = "opportunistic";
      DNSSEC = "false";
      Domains = [ "~." ];
      FallbackDNS = [
        "9.9.9.9#dns.quad9.net"
        "149.112.112.112#dns.quad9.net"
      ];
    };
  };

  # Avahi (Printer / Network Discovery)
  services.avahi = {
    enable = true;
    nssmdns4 = true;
    openFirewall = true;
  };
}