_:
{
  services.unbound = {
    enable = true;
    enableRootTrustAnchor = true;
    settings = {
      server = {
        interface = [ "127.0.0.1" "10.11.0.10" ];

        access-control = [
          "127.0.0.0/8 allow"
          "10.11.0.0/24 allow"
        ];
        
        prefetch = true;
        prefetch-key = true;
        qname-minimisation = true;

        hide-identity = true;
        hide-version = true;

        harden-glue = true;
        harden-below-nxdomain = true;
        harden-dnssec-stripped = true;
      };
    };
  };
}