{ ... }: {
  age.secrets.ddns-updater = {
    file = ../../../secrets/ddns-updater.age;
    owner = "root";
    group = "root";
    mode = "600";
  };

  # https://github.com/NixOS/nixpkgs/blob/e028379cfb9d92e49120e46045042998dfed87d0/nixos/modules/services/networking/ddns-updater.nix#
  services.ddns-updater = {
    enable = true;
    environment = {
      RESOLVER_ADDRESS = "8.8.8.8:53";
      CONFIG_FILEPATH = "%d/config.json";
    };
  };

  # https://systemd.io/CREDENTIALS/
  systemd.services.ddns-updater.serviceConfig.LoadCredential =
    "config.json:/run/agenix/ddns-updater";
}