83 lines
3 KiB
Nix
83 lines
3 KiB
Nix
|
# SPDX-License-Identifier: Apache-2.0
|
||
|
|
{ config, pkgs, ... }:
|
||
|
|
let
|
||
|
|
# https://github.com/StevenBlack/hosts/issues/451
|
||
|
|
# https://github.com/ScriptTiger/Hosts-Conversions
|
||
|
|
# https://github.com/ScriptTiger/scripttiger.github.io
|
||
|
|
# https://scripttiger.github.io/alts/
|
||
|
|
adblockLocalZones = pkgs.stdenv.mkDerivation {
|
||
|
|
name = "adblock-rpz";
|
||
|
|
src = (pkgs.fetchFromGitHub {
|
||
|
|
owner = "ScriptTiger";
|
||
|
|
repo = "scripttiger.github.io";
|
||
|
|
# nix-prefetch-github ScriptTiger scripttiger.github.io
|
||
|
|
rev = "04402a6726f97c5f0d30436a70ac1344dccb7cf1";
|
||
|
|
sha256 = "iSTR7j7QEr5xYtImyntDlVLbnN2ipcLcTRr4sfdx078=";
|
||
|
|
} + "/alts/rpz/blacklist.txt");
|
||
|
|
phases = [ "installPhase" ];
|
||
|
|
installPhase = "install -m 444 -D $src $out";
|
||
|
|
};
|
||
|
|
domain = "sealight.xyz";
|
||
|
|
certdir = config.security.acme.certs.${domain}.directory;
|
||
|
|
in {
|
||
|
|
networking.firewall.allowedTCPPorts = [ 853 ];
|
||
|
|
networking.firewall.allowedUDPPorts = [ 853 ];
|
||
|
|
|
||
|
|
# for acme certs, TODO: make a proper group
|
||
|
|
users.users.knot-resolver.extraGroups = [ "nginx" ];
|
||
|
|
|
||
|
|
# https://github.com/NixOS/nixpkgs/issues/81109
|
||
|
|
nixpkgs.config.packageOverrides = pkgs: rec {
|
||
|
|
knot-resolver = pkgs.knot-resolver.override { extraFeatures = true; };
|
||
|
|
};
|
||
|
|
services.kresd = {
|
||
|
|
enable = true;
|
||
|
|
# Plain DNS only from localhost.
|
||
|
|
# You might want to add a LAN or VPN subnet, depending on deployment.
|
||
|
|
#listenPlain = [ "127.0.0.1:53" "[::1]:53" ];
|
||
|
|
listenTLS = [ "853" ];
|
||
|
|
#listenDoH = [ "" "[::]:443" ];
|
||
|
|
instances = 1;
|
||
|
|
# TODO: chain.pem for stapling: https://gitlab.nic.cz/knot/knot-resolver/-/issues/517
|
||
|
|
#policy.add(
|
||
|
|
# policy.rpz(
|
||
|
|
# policy.DENY_MSG('domain blocked by your resolver operator'),
|
||
|
|
# '${adblockLocalZones}',
|
||
|
|
# false))
|
||
|
|
extraConfig = ''
|
||
|
|
modules.load('predict')
|
||
|
|
modules = { 'hints > iterate' }
|
||
|
|
policy.add(
|
||
|
|
policy.all(
|
||
|
|
policy.TLS_FORWARD({
|
||
|
|
{'45.90.30.0', hostname='87b4e9.dns2.nextdns.io'},
|
||
|
|
{'45.90.28.0', hostname='87b4e9.dns1.nextdns.io'}
|
||
|
|
})))
|
||
|
|
policy.add(policy.suffix(policy.FORWARD({'10.0.69.4', '172.16.11.240'}), {todname('mossnet.lan')}))
|
||
|
|
|
||
|
|
net.tls("${certdir}/fullchain.pem", "${certdir}/key.pem")
|
||
|
|
|
||
|
|
-- refresh certs when ACME updates them
|
||
|
|
-- TODO: could probably do with systemd and a control socket?
|
||
|
|
-- TODO: may fail on first boot if ACME isn't fast, add a systemd dep
|
||
|
|
local notify = require('cqueues.notify')
|
||
|
|
local watcher = notify.opendir('${certdir}')
|
||
|
|
watcher:add('fullchain.pem')
|
||
|
|
|
||
|
|
worker.coroutine(function ()
|
||
|
|
for flags, name in watcher:changes() do
|
||
|
|
for flag in notify.flags(flags) do
|
||
|
|
print('file watcher:', name, notify[flag])
|
||
|
|
end
|
||
|
|
if name == 'fullchain.pem' then
|
||
|
|
net.tls("${certdir}/fullchain.pem", "${certdir}/key.pem")
|
||
|
|
end
|
||
|
|
end
|
||
|
|
end)
|
||
|
|
|
||
|
|
-- Below we create a tmpfs FS for the cache -- use almost all of it:
|
||
|
|
cache.size = cache.fssize() - 1*MB
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
}
|