{ lib, ... }:

{
  networking.firewall.trustedInterfaces = lib.mkAfter [ "virbr0" ];

  virtualisation = {
    containers.enable = true;
    podman = {
      enable = true;
      dockerCompat = false;
      defaultNetwork.settings.dns_enabled = true;
    };
    libvirtd.enable = true;
  };

  programs.virt-manager.enable = true;

  systemd.sockets.podman.enable = false;
  systemd.services.podman.enable = false;

}