diff --git a/hosts/profiles/dns/default.nix b/hosts/profiles/dns/default.nix index db8b7c19..e43f3bdb 100644 --- a/hosts/profiles/dns/default.nix +++ b/hosts/profiles/dns/default.nix @@ -44,26 +44,31 @@ in settings = { server = { include = "${adblockLocalZones}"; + prefetch = "yes"; + # private-address = "10.0.69.0/8"; + # private-address = "192.168.1.0/24"; + cache-min-ttl = 0; + serve-expired = "yes"; interface = [ "0.0.0.0" ]; - access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ]; + access-control = [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ]; access-control-view = "10.0.69.0/24 wireguard"; + # so-reuseport = "yes"; + tls-upstream = "yes"; + domain-insecure = "mossnet.lan"; local-zone = ''"mossnet.lan." redirect''; local-data = ''"mossnet.lan. IN A ${mossnet}"''; }; forward-zone = [{ name = "."; - forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ]; + forward-addr = [ "45.90.28.0#6939b9.dns.nextdns.io" "1.1.1.1@853#cloudflare-dns.com" ]; + # non-tls + # forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"] }]; view = { name = "wireguard"; local-zone = ''"mossnet.lan." redirect''; local-data = ''"mossnet.lan. IN A ${wg-mossnet}"''; }; - do-not-query-localhost = "no"; - # Eventually we'll add DNSSEC / DoT - # so-reuseport: yes - # tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt - # tls-upstream: yes }; };