{ config, pkgs, ... }:

{
  virtualisation.incus.enable = true;
  networking = {
    nftables.enable = true;
    firewall.interfaces = {
      incusbr0 = {
        allowedTCPPorts = [ 53 67 ];
        allowedUDPPorts = [ 53 67 ];
      };
    };
  };

  # Load the kernel volume for lvm thin provisioning
  boot.kernelModules = [ "dm_thin_pool" "dm_snapshot" ];
}