{
  name,
  hostInfo,
  dsl,
  ...
}:
let
  inherit (dsl) mkContainer;
  inherit (hostInfo.paths) data;
in
mkContainer {
  inherit name;
  net.access = [ { to = "@internet"; } ];
  svc.autoStart = false;
  net.expose.tcp = [ 53 ];
  # TODO: figure out how to have this be the external dns resolver only
  resources.fs."/var/lib/pihole" = {
    hostPath = "${data}/misc/pihole";
    isReadOnly = false;
  };
  containerConfig = _: {
    services.pihole-ftl = {
      enable = true;
      stateDirectory = "/var/lib/pihole";
      openFirewallDNS = true;
      settings.dns.upstreams = [
        "1.1.1.1"
        "8.8.8.8"
      ];
      lists = [
        {
          url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts";
          type = "block";
          description = "StevenBlack unified hosts";
          enabled = true;
        }
        {
          url = "https://big.oisd.nl/domainswild";
          type = "block";
          description = "OISD Big";
          enabled = true;
        }
        {
          url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/pro.txt";
          type = "block";
          description = "HaGeZi Multi Pro";
          enabled = true;
        }
        {
          url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/tif.txt";
          type = "block";
          description = "HaGeZi Threat Intelligence Feeds";
          enabled = true;
        }
      ];
    };
    services.pihole-web = {
      enable = true;
      ports = [ "443s" ];
    };
    systemd.services.pihole-ftl.serviceConfig.FailureAction = "exit-force";
  };
  resources.mem = "512M";
}