nki/nix-home
1
0
Fork 0
Code Issues Pull requests 2 Packages Projects Releases Wiki Activity

Add encrypted DNS

Browse source
This commit is contained in:
Natsu Kagami 2022-05-02 14:09:17 -04:00
parent f6b1053ded
commit a87eff9af7
Signed by: nki
GPG key ID: 7306B3D3C3AD6E51
2 changed files with 53 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
modules/services/edns/default.nix Normal file
View file

@ -0,0 +1,48 @@
{ pkgs, config, lib, ... }:
with lib;
let
cfg = config.nki.services.edns;
in
{
options.nki.services.edns = {
enable = mkEnableOption "Enable encrypted DNS";
ipv6 = mkEnableOption "Enable ipv6";
};
config = mkIf cfg.enable {
networking.nameservers = [ "127.0.0.1" "::1" ];
networking.resolvconf.enable = mkOverride 1000 false;
networking.dhcpcd.extraConfig = "nohook resolv.conf";
networking.networkmanager.dns = "none";
services.dnscrypt-proxy2 = {
enable = true;
settings = {
server_names = [ ]; # Pick a server yourself
# Filters
ipv6_servers = cfg.ipv6;
require_dnssec = true;
require_nofilter = true;
skip_incompatible = true;
# Sources
sources.public_resolvers = {
urls = [ "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md" "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md" ];
cache_file = "/var/lib/dnscrypt-proxy/public_resolvers.md";
minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
};
# Making things go fast
block_ipv6 = !cfg.ipv6;
# Anonymized DNS
anonymized_dns.routes = [
{ server_name = "*"; via = [ "anon-plan9-dns" "anon-v.dnscrypt.up-ipv4" ]; }
];
};
};
};
}

6
nki-home/configuration.nix
View file

@ -13,6 +13,8 @@
./secrets
# Fonts
../modules/personal/fonts
# Encrypted DNS
../modules/services/edns
];
# Set kernel version to latest
@ -57,7 +59,7 @@
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
nix = {
package = pkgs.nixUnstable;
package = pkgs.nixFlakes;
extraOptions = ''
experimental-features = nix-command flakes
'';
@ -166,6 +168,8 @@
# List services that you want to enable:
services.gnome.gnome-keyring.enable = true;
nki.services.edns.enable = true;
nki.services.edns.ipv6 = true;
# Enable the OpenSSH daemon.
services.openssh.enable = true;