{
  config,
  lib,
  ...
}:
let
  cfg = config.guests.adguard;
in
{
  options.guests.adguard.adminPasswordHash = lib.mkOption {
    type = lib.types.str;
    description = "Bcrypt verifier for the AdGuard Home administrator password.";
  };

  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = cfg.address != null;
        message = "guests.adguard.address must identify the AdGuard Home guest.";
      }
    ];

    registry.homepage.${config.networking.hostName}.adguard = {
      tab = "System";
      section = "Network";
      name = "AdGuard Home";
      description = "Internal DNS";
      icon = "adguard-home.svg";
      href = "http://${cfg.address}";
    };

    guests.adguard = {
      interior = {
        modules.services.adguardhome = {
          enable = true;
          inherit (cfg) adminPasswordHash;
        };

        services.resolved.settings.Resolve.DNSStubListener = false;
      };

      limits = {
        memory = lib.mkDefault "256M";
        cpu = lib.mkDefault "100%";
        tasksMax = lib.mkDefault 128;
      };
    };
  };
}