74 lines
1.9 KiB
Nix
74 lines
1.9 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
with lib;
|
|
let
|
|
cfg = config.nki.services.edns;
|
|
in
|
|
{
|
|
options.nki.services.edns = {
|
|
enable = mkEnableOption "Enable encrypted DNS";
|
|
ipv6 = mkEnableOption "Enable ipv6";
|
|
cloaking-rules = mkOption {
|
|
type = types.attrsOf types.str;
|
|
default = { };
|
|
description = "A set of domain -> ip mapping for cloaking_rules";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
# networking.nameservers = [ "127.0.0.1" "::1" ];
|
|
# networking.resolvconf.enable = mkOverride 1000 false;
|
|
# networking.dhcpcd.extraConfig = "nohook resolv.conf";
|
|
# networking.networkmanager.dns = "none";
|
|
|
|
services.dnscrypt-proxy2 = {
|
|
enable = true;
|
|
|
|
settings = {
|
|
server_names = [ ]; # Pick a server yourself
|
|
|
|
# Filters
|
|
ipv6_servers = cfg.ipv6;
|
|
require_dnssec = true;
|
|
require_nofilter = true;
|
|
|
|
# Sources
|
|
sources.public_resolvers = {
|
|
urls = [
|
|
"https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
|
|
"https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
|
|
];
|
|
cache_file = "/var/lib/dnscrypt-proxy/public_resolvers.md";
|
|
minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
|
|
};
|
|
|
|
# Making things go fast
|
|
block_ipv6 = !cfg.ipv6;
|
|
|
|
# Anonymized DNS
|
|
anonymized_dns.routes = [
|
|
{
|
|
server_name = "*";
|
|
via = [
|
|
"anon-plan9-dns"
|
|
"anon-v.dnscrypt.up-ipv4"
|
|
];
|
|
}
|
|
];
|
|
anonymized_dns.skip_incompatible = true;
|
|
|
|
# Cloaking rules
|
|
cloaking_rules = pkgs.writeText "cloaking_rules.txt" (
|
|
lib.strings.concatStringsSep "\n" (
|
|
lib.attrsets.mapAttrsToList (name: ip: "${name} ${ip}") cfg.cloaking-rules
|
|
)
|
|
);
|
|
};
|
|
};
|
|
};
|
|
}
|