diff --git a/hosts/dandelion/default.nix b/hosts/dandelion/default.nix
index 6ecda6d..98e0a49 100644
--- a/hosts/dandelion/default.nix
+++ b/hosts/dandelion/default.nix
@@ -1,4 +1,9 @@
-{ pkgs, config, ... }:
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
 {
   imports = [
     ./hardware-configuration.nix
diff --git a/hosts/lily/default.nix b/hosts/lily/default.nix
index acc1a6c..2d36d14 100644
--- a/hosts/lily/default.nix
+++ b/hosts/lily/default.nix
@@ -16,7 +16,10 @@ in
   imports = [
     ./hardware-configuration.nix
     ./variables.nix
+    ./dns.nix
+    ./wireguard.nix
     ./../../modules/core/default.router.nix
+    ./../../modules/services/lily.nix
   ];
 
   liv = {
@@ -25,7 +28,6 @@ in
   };
 
   boot = {
-    supportedFilesystems = [ "zfs" ];
     loader.grub = {
       enable = true;
       device = "/dev/sda";
@@ -51,7 +53,7 @@ in
 
   networking = {
     firewall = {
-      enable = true;
+      enable = false;
       allowPing = true;
 
       # allow ssh on *all* interfaces, even wan.
@@ -87,20 +89,7 @@ in
 
   environment.systemPackages = with pkgs; [
     kitty.terminfo
-    zfs
+    tcpdump
+    dnsutils
   ];
-
-  networking.hostId = "8ddb2a9b";
-
-  services.zfs = {
-    autoScrub.enable = true;
-    trim.enable = true;
-  };
-
-  # boot.zfs.extraPools = [ "terrabite" ];
-
-  # fileSystems."/terrabite/main" = {
-  #   device = "terrabite/main";
-  #   fsType = "zfs";
-  # };
 }
diff --git a/hosts/lily/dns.nix b/hosts/lily/dns.nix
new file mode 100644
index 0000000..b754a51
--- /dev/null
+++ b/hosts/lily/dns.nix
@@ -0,0 +1,31 @@
+{ lib, config, ... }:
+{
+  services = {
+    dnsmasq = {
+      enable = true;
+      settings = {
+        cache-size = 10000; # Specifies the size of the DNS query cache. It will store up to n cached DNS queries to improve response times for frequently accessed domains.
+        server = [
+          "9.9.9.9"
+          "149.112.112.112"
+        ];
+        domain-needed = true; # Ensures that DNS queries are only forwarded for domains that are not found in the local configuration.
+        bogus-priv = true; # Blocks DNS queries for private IP address ranges to prevent accidental exposure of private resources.
+        no-resolv = true; # Prevents dnsmasq from using /etc/resolv.conf for DNS server configuration.
+
+        # configure DHCP server; get leases by running: `cat /var/lib/dnsmasq/dnsmasq.leases`
+        dhcp-range = [ "br-lan,172.16.10.50,172.16.10.254,24h" ];
+        interface = "br-lan";
+        dhcp-host = "172.16.10.1";
+
+        # local sets the local domain name to "n". Combinded with expand-hosts = true, it will add a .local suffix to any local defined name when trying to resolve it.
+        local = "/local/";
+        domain = "local";
+        expand-hosts = true;
+
+        no-hosts = true; # Prevents the use of /etc/hosts. This ensures that the local hosts file is not used to override DNS resolution.
+        address = "/booping.local/172.16.10.1";
+      };
+    };
+  };
+}
diff --git a/hosts/lily/wireguard.nix b/hosts/lily/wireguard.nix
new file mode 100644
index 0000000..0db3279
--- /dev/null
+++ b/hosts/lily/wireguard.nix
@@ -0,0 +1,3 @@
+{
+
+}
diff --git a/modules/services/lily.nix b/modules/services/lily.nix
new file mode 100644
index 0000000..2774318
--- /dev/null
+++ b/modules/services/lily.nix
@@ -0,0 +1,10 @@
+{ ... }:
+{
+  imports =
+    [ (import ./docker.nix) ]
+    ++ [ (import ./monitoring.nix) ]
+    ++ [ (import ./smart-monitoring.nix) ]
+    ++ [ (import ./unifi.nix) ]
+    ++ [ (import ./tailscale.nix) ]
+    ++ [ (import ./grafana.nix) ];
+}
diff --git a/modules/services/tailscale.nix b/modules/services/tailscale.nix
new file mode 100644
index 0000000..d886410
--- /dev/null
+++ b/modules/services/tailscale.nix
@@ -0,0 +1,3 @@
+{
+  services.tailscale.enable = true;
+}
diff --git a/modules/services/unifi.nix b/modules/services/unifi.nix
new file mode 100644
index 0000000..c206c3d
--- /dev/null
+++ b/modules/services/unifi.nix
@@ -0,0 +1,66 @@
+{ pkgs, lib, ... }:
+
+{
+  services.unifi = {
+    enable = true;
+    unifiPackage = pkgs.unifi8;
+    mongodbPackage = pkgs.mongodb-7_0;
+  };
+  # services.nginx = {
+  #   enable = true;
+  #   recommendedProxySettings = true;
+
+  #   virtualHosts."unifi.local" = {
+  #     forceSSL = true;
+  #     useACMEHost = "unifi.local";
+  #     locations."/" = {
+  #       proxyPass = "https://127.0.0.1:8443";
+  #       proxyWebsockets = true;
+  #     };
+  #   };
+  # };
+  #   virtualisation.oci-containers.containers."unifi" = {
+  #     image = "lscr.io/linuxserver/unifi-network-application:latest";
+  #     autoStart = true;
+  #     environmentFiles = [ /run/unifi/container-vars.env ];
+  #     volumes = [
+  #       "/etc/localtime:/etc/localtime:ro"
+  #       "/run/unifi/data:/config"
+  #     ];
+  #     ports = [
+  #       "8443:8443" # web admin UI
+  #       "3478:3478/udp" # STUN
+  #       "10001:10001/udp" # AP discovery
+  #       "8080:8080" # device communication
+  #       "6789:6789/udp" # mobile throughput test (assumption: wifiman)
+  #       "5514:5514/udp" # remote syslog (optional)
+  #     ];
+  #     dependsOn = [
+  #       "unifi-mongo"
+  #     ];
+  #     log-driver = "journald";
+  #   };
+  #   virtualisation.oci-containers.containers."unifi-mongo" = {
+  #     image = "mongo:latest";
+  #     autoStart = true;
+  #     volumes = [
+  #       "/etc/localtime:/etc/localtime:ro"
+  #       "/run/unifi/mongo/db:/data/db"
+  #       "/run/unifi/mongo/init-mongo.js:/docker-entrypoint-initdb.d/init-mongo.js:ro"
+  #     ];
+  #     log-driver = "journald";
+  #   };
+
+  networking.firewall.interfaces."lan0" = {
+    allowedTCPPorts = [
+      8443 # web admin UI
+      8080 # device communication
+    ];
+    allowedUDPPorts = [
+      6789 # mobile throughput test (assumption: wifiman)
+      5514 # remote syslog (optional)
+      3478 # STUN
+      10001 # AP discovery
+    ];
+  };
+}