{
  lib,
  ...
}:
let
  nat64 = true;
  v6only = false;

  # TODO: change to 30
  v6OnlyPreferredLifetime = 15 * 60;

  dns64prefix = "64:ff9b::/96";
in
{
  services.adguardhome.settings.dns = {
    use_dns64 = nat64;
    dns64_prefixes = [
      dns64prefix
    ];
  };

  services.dnsmasq.settings.dhcp-option = lib.optionals v6only [
    "option:ipv6-only,${toString v6OnlyPreferredLifetime}"
  ];

  networking.jool = {
    enable = nat64;
    nat64 = {
      default = {
        global.pool6 = dns64prefix;
      };
    };
  };

  systemd.network.networks = lib.mkIf nat64 {
    "60-bridge-pref64" = {
      matchConfig.Kind = "bridge";

      ipv6PREF64Prefixes = [
        {
          Prefix = dns64prefix;
        }
      ];
    };
  };
}