helm/hosts/profiles/dns/default.nix

86 lines
2.5 KiB
Nix
Raw Normal View History

2022-09-18 15:13:50 -07:00
{ config, pkgs, lib, ... }:
2023-05-13 04:12:05 -07:00
let
adblockLocalZones = pkgs.stdenv.mkDerivation {
name = "unbound-zones-adblock";
src = (pkgs.fetchFromGitHub
{
owner = "StevenBlack";
repo = "hosts";
rev = "3.12.21";
sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s=";
} + "/hosts");
phases = [ "installPhase" ];
installPhase = ''
${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out
'';
};
mossnet = "192.168.1.240"; # The local lan-ip for box
wg-mossnet = "10.0.69.4"; # The wireguard ip for box
mossnet-hosts = [
"mossnet.lan"
2023-12-05 10:42:19 -08:00
"headphones.mossnet.lan"
2023-05-13 04:12:05 -07:00
"links.mossnet.lan"
"read.mossnet.lan"
"stats.mossnet.lan"
"music.mossnet.lan"
"tasks.mossnet.lan"
"file.mossnet.lan"
"books.mossnet.lan"
"fin.mossnet.lan"
"paper.mossnet.lan"
"cal.mossnet.lan"
"archive.mossnet.lan"
2024-01-05 23:44:08 -08:00
"headphones.mossnet.lan"
"transmission.mossnet.lan"
2023-05-13 04:12:05 -07:00
"tracks.mossnet.lan"
"grasp.mossnet.lan"
2023-05-15 07:20:57 -07:00
"photos.mossnet.lan"
2023-05-13 04:12:05 -07:00
];
2024-01-05 23:44:08 -08:00
2023-05-13 04:12:05 -07:00
in
2022-09-18 15:13:50 -07:00
{
2023-05-13 04:12:05 -07:00
services.unbound = {
enable = true;
settings = {
server = {
include = "${adblockLocalZones}";
2023-05-22 04:58:46 -07:00
prefetch = "yes";
# private-address = "10.0.69.0/8";
# private-address = "192.168.1.0/24";
cache-min-ttl = 0;
serve-expired = "yes";
2023-05-13 04:12:05 -07:00
interface = [ "0.0.0.0" ];
2023-05-22 04:58:46 -07:00
access-control = [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ];
2023-05-13 04:12:05 -07:00
access-control-view = "10.0.69.0/24 wireguard";
2023-05-22 04:58:46 -07:00
# so-reuseport = "yes";
tls-upstream = "yes";
domain-insecure = "mossnet.lan";
2023-05-13 04:12:05 -07:00
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
};
forward-zone = [{
name = ".";
2023-05-22 04:58:46 -07:00
forward-addr = [ "45.90.28.0#6939b9.dns.nextdns.io" "1.1.1.1@853#cloudflare-dns.com" ];
# non-tls
# forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"]
2023-05-13 04:12:05 -07:00
}];
view = {
name = "wireguard";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
};
};
};
2023-05-13 04:12:05 -07:00
# With unbound we're doing wildcard redirects, so we don't need that anymore
# networking.hosts = {
# mossnet = mossnet-hosts;
# };
2022-09-18 15:13:50 -07:00
networking.firewall.allowedTCPPorts = [ 53 ];
networking.firewall.allowedUDPPorts = [ 53 ];
}