{ ... }:

{
  networking.hostName = "opus";
  networking.networkmanager.enable = true;
  programs.amnezia-vpn.enable = true;

  # Primary DNS via Mullvad DoT (Base mode)
  networking.nameservers = [
    "194.242.2.4#base.dns.mullvad.net"
    "194.242.2.2#dns.mullvad.net"
  ];

  # systemd-resolved: Mullvad primary, Quad9 fallback
  services.resolved = {
    enable = true;
    dnsovertls = "opportunistic";
    dnssec = "false";
    domains = [ "~." ];
    fallbackDns = [
      "9.9.9.9#dns.quad9.net"
      "149.112.112.112#dns.quad9.net"
    ];
  };

  # Avahi (Printer / Network Discovery)
  services.avahi = {
    enable = true;
    nssmdns4 = true;
    openFirewall = true;
  };
}