working split dns config :3
This commit is contained in:
		
							parent
							
								
									f374e8bd1f
								
							
						
					
					
						commit
						df629af5ab
					
				|  | @ -1,38 +1,76 @@ | |||
| { config, pkgs, lib, ... }: | ||||
| { | ||||
|   services.dnsmasq.enable = true; | ||||
|   services.dnsmasq.extraConfig = '' | ||||
|     domain-needed | ||||
|     no-resolv | ||||
|     local=/lan/ | ||||
|     local=/moss/ | ||||
|     cache-size=5000 | ||||
|     addn-hosts=/etc/adblock.hosts  | ||||
|   ''; # TODO find a way to make adblock hosts reproducible and updateable | ||||
|   services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ]; | ||||
|   # TODO use this list in mossnet-hosts | ||||
|   networking.hosts = { | ||||
|     "192.168.1.240" = [ | ||||
|       "mossnet.lan" | ||||
|       "links.mossnet.lan" | ||||
|       "read.mossnet.lan" | ||||
|       "stats.mossnet.lan" | ||||
|       "music.mossnet.lan" | ||||
|       "rss.mossnet.lan" | ||||
|       "tasks.mossnet.lan" | ||||
|       "file.mossnet.lan" | ||||
|       "books.mossnet.lan" | ||||
|       "fin.mossnet.lan" | ||||
|       "paper.mossnet.lan" | ||||
|       "cal.mossnet.lan" | ||||
|       "archive.mossnet.lan" | ||||
|       "tracks.mossnet.lan" | ||||
|       "grasp.mossnet.lan" | ||||
|     ]; | ||||
|     "192.168.1.226" = [ | ||||
|       "df-web.lan" | ||||
|     ]; | ||||
| let | ||||
|   adblockLocalZones = pkgs.stdenv.mkDerivation { | ||||
|     name = "unbound-zones-adblock"; | ||||
| 
 | ||||
|     src = (pkgs.fetchFromGitHub | ||||
|       { | ||||
|         owner = "StevenBlack"; | ||||
|         repo = "hosts"; | ||||
|         rev = "3.12.21"; | ||||
|         sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s="; | ||||
|       } + "/hosts"); | ||||
| 
 | ||||
|     phases = [ "installPhase" ]; | ||||
| 
 | ||||
|     installPhase = '' | ||||
|       ${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u >  $out | ||||
|     ''; | ||||
|   }; | ||||
| 
 | ||||
|   mossnet = "192.168.1.240"; # The local lan-ip for box | ||||
|   wg-mossnet = "10.0.69.4";  # The wireguard ip for box | ||||
|   mossnet-hosts = [ | ||||
|     "mossnet.lan" | ||||
|     "links.mossnet.lan" | ||||
|     "read.mossnet.lan" | ||||
|     "stats.mossnet.lan" | ||||
|     "music.mossnet.lan" | ||||
|     "rss.mossnet.lan" | ||||
|     "tasks.mossnet.lan" | ||||
|     "file.mossnet.lan" | ||||
|     "books.mossnet.lan" | ||||
|     "fin.mossnet.lan" | ||||
|     "paper.mossnet.lan" | ||||
|     "cal.mossnet.lan" | ||||
|     "archive.mossnet.lan" | ||||
|     "tracks.mossnet.lan" | ||||
|     "grasp.mossnet.lan" | ||||
|   ]; | ||||
| in | ||||
| { | ||||
|   services.unbound = { | ||||
|     enable = true; | ||||
|     settings = { | ||||
|       server = { | ||||
|         include = "${adblockLocalZones}"; | ||||
|         interface = [ "0.0.0.0" ]; | ||||
|         access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ]; | ||||
|         access-control-view = "10.0.69.0/24 wireguard"; | ||||
|         local-zone = ''"mossnet.lan." redirect''; | ||||
|         local-data = ''"mossnet.lan. IN A ${mossnet}"''; | ||||
|       }; | ||||
|       forward-zone = [{ | ||||
|         name = "."; | ||||
|         forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ]; | ||||
|       }]; | ||||
|       view = { | ||||
|         name = "wireguard"; | ||||
|         local-zone = ''"mossnet.lan." redirect''; | ||||
|         local-data = ''"mossnet.lan. IN A ${wg-mossnet}"''; | ||||
|       }; | ||||
|       do-not-query-localhost = "no"; | ||||
|       #  Eventually we'll add DNSSEC / DoT | ||||
|       #  so-reuseport: yes | ||||
|       #  tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt | ||||
|       #  tls-upstream: yes | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   # With unbound we're doing wildcard redirects, so we don't need that anymore | ||||
|   # networking.hosts = { | ||||
|   #   mossnet = mossnet-hosts; | ||||
|   # }; | ||||
|   networking.firewall.allowedTCPPorts = [ 53 ]; | ||||
|   networking.firewall.allowedUDPPorts = [ 53 ]; | ||||
| } | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue