From df629af5ab441eaef880c5943eead682d96e3b5f Mon Sep 17 00:00:00 2001 From: Anish Lakhwara Date: Sat, 13 May 2023 21:12:05 +1000 Subject: [PATCH] working split dns config :3 --- hosts/profiles/dns/default.nix | 104 ++++++++++++++++++++++----------- 1 file changed, 71 insertions(+), 33 deletions(-) diff --git a/hosts/profiles/dns/default.nix b/hosts/profiles/dns/default.nix index 18662b26..d4a27510 100644 --- a/hosts/profiles/dns/default.nix +++ b/hosts/profiles/dns/default.nix @@ -1,38 +1,76 @@ { config, pkgs, lib, ... }: -{ - services.dnsmasq.enable = true; - services.dnsmasq.extraConfig = '' - domain-needed - no-resolv - local=/lan/ - local=/moss/ - cache-size=5000 - addn-hosts=/etc/adblock.hosts - ''; # TODO find a way to make adblock hosts reproducible and updateable - services.dnsmasq.servers = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ]; - # TODO use this list in mossnet-hosts - networking.hosts = { - "192.168.1.240" = [ - "mossnet.lan" - "links.mossnet.lan" - "read.mossnet.lan" - "stats.mossnet.lan" - "music.mossnet.lan" - "rss.mossnet.lan" - "tasks.mossnet.lan" - "file.mossnet.lan" - "books.mossnet.lan" - "fin.mossnet.lan" - "paper.mossnet.lan" - "cal.mossnet.lan" - "archive.mossnet.lan" - "tracks.mossnet.lan" - "grasp.mossnet.lan" - ]; - "192.168.1.226" = [ - "df-web.lan" - ]; +let + adblockLocalZones = pkgs.stdenv.mkDerivation { + name = "unbound-zones-adblock"; + + src = (pkgs.fetchFromGitHub + { + owner = "StevenBlack"; + repo = "hosts"; + rev = "3.12.21"; + sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s="; + } + "/hosts"); + + phases = [ "installPhase" ]; + + installPhase = '' + ${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out + ''; }; + + mossnet = "192.168.1.240"; # The local lan-ip for box + wg-mossnet = "10.0.69.4"; # The wireguard ip for box + mossnet-hosts = [ + "mossnet.lan" + "links.mossnet.lan" + "read.mossnet.lan" + "stats.mossnet.lan" + "music.mossnet.lan" + "rss.mossnet.lan" + "tasks.mossnet.lan" + "file.mossnet.lan" + "books.mossnet.lan" + "fin.mossnet.lan" + "paper.mossnet.lan" + "cal.mossnet.lan" + "archive.mossnet.lan" + "tracks.mossnet.lan" + "grasp.mossnet.lan" + ]; +in +{ + services.unbound = { + enable = true; + settings = { + server = { + include = "${adblockLocalZones}"; + interface = [ "0.0.0.0" ]; + access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ]; + access-control-view = "10.0.69.0/24 wireguard"; + local-zone = ''"mossnet.lan." redirect''; + local-data = ''"mossnet.lan. IN A ${mossnet}"''; + }; + forward-zone = [{ + name = "."; + forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ]; + }]; + view = { + name = "wireguard"; + local-zone = ''"mossnet.lan." redirect''; + local-data = ''"mossnet.lan. IN A ${wg-mossnet}"''; + }; + do-not-query-localhost = "no"; + # Eventually we'll add DNSSEC / DoT + # so-reuseport: yes + # tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt + # tls-upstream: yes + }; + }; + + # With unbound we're doing wildcard redirects, so we don't need that anymore + # networking.hosts = { + # mossnet = mossnet-hosts; + # }; networking.firewall.allowedTCPPorts = [ 53 ]; networking.firewall.allowedUDPPorts = [ 53 ]; }