diff --git a/hosts/genesis/net/hosts b/hosts/genesis/net/hosts
index 3a9fe1b..15e9913 100644
--- a/hosts/genesis/net/hosts
+++ b/hosts/genesis/net/hosts
@@ -8,10 +8,11 @@
 10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan
 10.42.1.3 printer.thehellings.lan
 10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan s3.thehellings.lan
-10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan 
+10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan
 10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan
 10.42.1.7 hosea hosea.thehellings.lan
 10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan
+10.42.1.9 ivr ivr.thehellings.lan
 10.42.1.12 tv
 
 10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan
diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix
index 1913ec1..34ed93d 100644
--- a/hosts/genesis/networking.nix
+++ b/hosts/genesis/networking.nix
@@ -111,6 +111,18 @@ in
       denyPrivate = false;
     };
 
+    kea.dhcp4 = (
+      import ./networking/dhcp.nix {
+        inherit
+          iot
+          iotIP
+          lan
+          lanIP
+          routerIP
+          ;
+      }
+    );
+
     #########
     # dnsmasq config
     ########
@@ -118,59 +130,7 @@ in
       enable = true;
       settings = {
         domain = "thehellings.lan";
-        dhcp-range = [
-          "${lan},10.42.2.1,10.42.2.255,255.255.0.0,12h"
-          "${iot},192.168.66.3,192.168.66.150,255.255.255.0,12h"
-          "vlan67@${lan},192.168.67.3,192.168.67.150,12h"
-        ];
-        dhcp-option = [
-          "${lan},option:router,${routerIP}"
-          "${lan},option:dns-server,${lanIP},1.1.1.1"
-          "${lan},option:domain-search,thehellings.lan"
-
-          "${iot},option:router,192.168.66.1"
-          "${iot},option:dns-server,${iotIP}"
-
-          "vlan67@${lan},option:router,192.168.67.1"
-          "vlan67@${lan},option:dns-server,192.168.67.1"
-        ];
-        dhcp-host = [
-          # Static IPs for personal work
-          "2a:5d:23:10:4e:22,10.42.0.5" # SAN Switch
-          "00:00:de:ad:be:ef,10.42.2.254"
-          "01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah
-
-          # Static IPs for things in the IOT range
-          "b4:b0:24:9a:02:4a,192.168.66.5" # LD125
-          "98:da:c4:20:f3:64,192.168.66.6" # Dining room light
-          "54:af:97:c1:dc:b9,192.168.66.25" # Master bedroom Kasa switch
-          "f0:03:8c:b3:b0:f6,192.168.66.55" # Roomba
-          "4c:a1:61:05:cd:52,192.168.66.61" # Rainbird
-          "48:d6:d5:5d:81:21,192.168.66.65" # Google Home
-          "6c:29:90:3e:e2:02,192.168.66.66" # wiz
-          "28:87:ba:0e:ca:da,192.168.66.74"
-          "28:87:ba:0e:c9:fd,192.168.66.75" # Master closet
-          "54:af:97:c2:0f:a1,192.168.66.76" # Master toilet
-          "54:af:97:83:ed:33,192.168.66.80"
-          "98:da:c4:77:80:18,192.168.66.84" # Kitchen lights
-          "98:da:c4:21:1b:2e,192.168.66.85" # Living Room lights
-          "0c:80:63:41:6e:0f,192.168.66.90" # Front porch
-          "0c:80:63:41:6c:5d,192.168.66.98" # House number
-          "ac:84:c6:5e:4b:28,192.168.66.100"
-          "98:da:c4:77:7f:4d,192.168.66.102" # Office lights
-          "8c:85:80:1c:f9:d1,192.168.66.104"
-          "98:da:c4:77:82:7b,192.168.66.105" # Parlor lamp
-          "0c:80:63:41:74:73,192.168.66.106" # Front hall light switch
-          "98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch
-          "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome
-          "92:3e:11:c7:c5:be,192.168.66.109"
-          "d8:0d:17:19:60:62,192.168.66.112"
-          "b4:b0:24:9a:12:53,192.168.66.130" # KL125
-          "b4:b0:24:9a:14:0e,192.168.66.131"
-          "e4:f0:42:61:fa:b5,192.168.66.149" # Google Home-mini
-        ];
         expand-hosts = true;
-        log-dhcp = true;
         log-queries = true;
         no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
         addn-hosts = "/etc/adblock_hosts";
diff --git a/hosts/genesis/networking/dhcp.nix b/hosts/genesis/networking/dhcp.nix
new file mode 100644
index 0000000..ca8d265
--- /dev/null
+++ b/hosts/genesis/networking/dhcp.nix
@@ -0,0 +1,183 @@
+{
+  lan,
+  iot,
+  lanIP,
+  iotIP,
+  routerIP,
+}:
+{
+  enable = true;
+  settings = {
+    valid-lifetime = 43200; # 12 hours, in seconds
+    renew-timer = 1000;
+    rebind-timer = 2000;
+    interfaces-config.interfaces = [
+      lan
+      iot
+    ];
+    lease-database = {
+      type = "memfile";
+      persist = true;
+      name = "/var/lib/kea/dhcp4.leases";
+    };
+    subnet4 = [
+      {
+        subnet = "10.42.0.0/16";
+        pools = [ { pool = "10.42.2.0 - 10.42.3.255"; } ];
+        interface = lan;
+        # https://kea.readthedocs.io/en/kea-2.6.1/arm/dhcp4-srv.html#dhcp4-std-options-list
+        option-data = [
+          {
+            name = "domain-name-servers";
+            data = "${lanIP},1.1.1.1";
+          }
+          {
+            name = "routers";
+            data = routerIP;
+          }
+          {
+            name = "domain-search";
+            data = "home,thehellings.lan";
+          }
+          {
+            name = "lpr-servers";
+            data = "10.42.1.3";
+          }
+          {
+            name = "domain-name";
+            data = "thehellings.lan";
+          }
+        ];
+      }
+      {
+        subnet = "192.168.66.0/24";
+        pools = [ { pool = "192.168.66.2 - 192.168.66.254"; } ];
+        interface = iot;
+        option-data = [
+          {
+            name = "domain-name-servers";
+            data = iotIP;
+          }
+          {
+            name = "routers";
+            data = "192.168.67.1";
+          }
+        ];
+      }
+    ];
+
+    reservations = [
+      # Static IPs for personal work
+      {
+        hw-address = "00:23:24:72:64:32"; # Joel
+        ip-address = "10.42.0.4";
+      }
+      {
+        hw-address = "2a:5d:23:10:4e:22"; # SAN Switch
+        ip-address = "10.42.0.5";
+      }
+      {
+        hw-address = "00:00:de:ad:be:ef"; # deadbeef
+        ip-address = "10.42.2.254";
+      }
+      {
+        hw-address = "01:a8:a1:59:c7:8a:12"; # BMC management interface for isaiah
+        ip-address = "10.42.2.253";
+      }
+      {
+        hw-address = "7c:83:34:b9:ee:ec"; # PVE1
+        ip-address = "10.42.1.1";
+      }
+      {
+        hw-address = "74:ee:2a:66:b3:51"; # printer
+        ip-address = "10.42.1.3";
+      }
+      {
+        hw-address = "00:11:32:c6:7c:81"; # chronicles
+        ip-address = "10.42.1.4";
+      }
+      {
+        hw-address = "6a:86:56:45:0b:b1"; # Genesis
+        ip-address = "10.42.1.5";
+      }
+      {
+        hw-address = "a8:a1:59:c7:20:44"; # isaiah
+        ip-address = "10.42.1.6";
+      }
+      #{
+      #  hw-address = ""; # hosea
+      #  ip-address = "10.42.1.7";
+      #}
+      #{
+      #  hw-address = ""; # jeremiah
+      #  ip-address = "10.42.1.8";
+      #}
+      {
+        hw-address = "c8:5e:a9:54:9e:c6"; # IVR laptop Wi-Fi
+        ip-address = "10.42.1.9";
+      }
+
+      ########################################
+      #             IOT devices              #
+      ########################################
+
+      # Static IPs for things in the IOT range
+      {
+        hw-address = "b4:b0:24:9a:02:4a";
+        ip-address = "192.168.66.5";
+      } # LD125
+      {
+        hw-address = "f0:03:8c:b3:b0:f6";
+        ip-address = "192.168.66.55";
+      } # Roomba
+      {
+        hw-address = "4c:a1:61:05:cd:52";
+        ip-address = "192.168.66.61";
+      } # Rainbird
+      {
+        hw-address = "48:d6:d5:5d:81:21";
+        ip-address = "192.168.66.65";
+      } # Google Home
+      {
+        hw-address = "28:87:ba:0e:ca:da";
+        ip-address = "192.168.66.74";
+      }
+      {
+        hw-address = "54:af:97:83:ed:33";
+        ip-address = "192.168.66.80";
+      }
+      {
+        hw-address = "ac:84:c6:5e:4b:28";
+        ip-address = "192.168.66.100";
+      }
+      {
+        hw-address = "8c:85:80:1c:f9:d1";
+        ip-address = "192.168.66.104";
+      }
+      {
+        hw-address = "8c:49:62:aa:58:60";
+        ip-address = "192.168.66.108";
+      } # Roku, HiHandsome
+      {
+        hw-address = "92:3e:11:c7:c5:be";
+        ip-address = "192.168.66.109";
+      }
+      {
+        hw-address = "d8:0d:17:19:60:62";
+        ip-address = "192.168.66.112";
+      }
+      {
+        hw-address = "b4:b0:24:9a:12:53";
+        ip-address = "192.168.66.130";
+      } # KL125
+      {
+        hw-address = "b4:b0:24:9a:14:0e";
+        ip-address = "192.168.66.131";
+      }
+      {
+        hw-address = "e4:f0:42:61:fa:b5";
+        ip-address = "192.168.66.149";
+      } # Google Home-mini
+    ];
+  };
+}
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 1447610..82e9157 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -98,6 +98,18 @@ in
     );
   };
 
+  security.sudo.extraRules = [
+    {
+      users = [ "greg" ];
+      commands = [
+        {
+          command = "ALL";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
   i18n.defaultLocale = "en_US.UTF-8";
 
   console = {