1{lib, ...}: {
 2  den.aspects.services.podman = {
 3    nixos = {config, ...}: {
 4      virtualisation.podman = {
 5        enable = true;
 6        dockerCompat = true;
 7        dockerSocket.enable = true;
 8        autoPrune.enable = true;
 9      };
10
11      # Enable container name DNS for all Podman networks.
12      networking.firewall.interfaces = let
13        matchAll =
14          if !config.networking.nftables.enable
15          then "podman+"
16          else "podman*";
17      in {
18        "${matchAll}".allowedUDPPorts = [53];
19      };
20
21      virtualisation.oci-containers.backend = "podman";
22    };
23
24    user = {user, ...}: {
25      extraGroups = lib.optional (lib.elem "admins" user.groups) "podman";
26    };
27  };
28}