aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

working split dns

Browse source
This commit is contained in:
Anish Lakhwara 2023-05-22 21:58:46 +10:00
parent 03b1edc941
commit 9723f79d24
1 changed files with 12 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
hosts/profiles/dns/default.nix
View file

@ -44,26 +44,31 @@ in
settings = {
server = {
include = "${adblockLocalZones}";
prefetch = "yes";
# private-address = "10.0.69.0/8";
# private-address = "192.168.1.0/24";
cache-min-ttl = 0;
serve-expired = "yes";
interface = [ "0.0.0.0" ];
access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ];
access-control = [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ];
access-control-view = "10.0.69.0/24 wireguard";
# so-reuseport = "yes";
tls-upstream = "yes";
domain-insecure = "mossnet.lan";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
};
forward-zone = [{
name = ".";
forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
forward-addr = [ "45.90.28.0#6939b9.dns.nextdns.io" "1.1.1.1@853#cloudflare-dns.com" ];
# non-tls
# forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"]
}];
view = {
name = "wireguard";
local-zone = ''"mossnet.lan." redirect'';
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
};
do-not-query-localhost = "no";
# Eventually we'll add DNSSEC / DoT
# so-reuseport: yes
# tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
# tls-upstream: yes
};
};