{ config, lib, pkgs, ... }:
{
  config = lib.mkIf config.virtualisation.incus.enable {
    networking.firewall.interfaces.incusbr0 = let
      ports = [
        53
        67
      ];
    in {
      allowedTCPPorts = ports;
      allowedUDPPorts = ports;
    };

    environment.persistence."/persist".directories = [ "/var/lib/incus" ];
  };
}