{ config, pkgs, lib, ... }: let adblockLocalZones = pkgs.stdenv.mkDerivation { name = "unbound-zones-adblock"; src = (pkgs.fetchFromGitHub { owner = "StevenBlack"; repo = "hosts"; rev = "3.12.21"; sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s="; } + "/hosts"); phases = [ "installPhase" ]; installPhase = '' ${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out ''; }; mossnet = "192.168.1.240"; # The local lan-ip for box wg-mossnet = "10.0.69.4"; # The wireguard ip for box mossnet-hosts = [ "mossnet.lan" "headphones.mossnet.lan" "links.mossnet.lan" "read.mossnet.lan" "stats.mossnet.lan" "music.mossnet.lan" "tasks.mossnet.lan" "file.mossnet.lan" "books.mossnet.lan" "fin.mossnet.lan" "paper.mossnet.lan" "cal.mossnet.lan" "archive.mossnet.lan" "headphones.mossnet.lan" "transmission.mossnet.lan" "tracks.mossnet.lan" "grasp.mossnet.lan" "photos.mossnet.lan" ]; in { services.unbound = { enable = true; settings = { server = { include = "${adblockLocalZones}"; prefetch = "yes"; # private-address = "10.0.69.0/8"; # private-address = "192.168.1.0/24"; cache-min-ttl = 0; serve-expired = "yes"; interface = [ "0.0.0.0" ]; access-control = [ "127.0.0.0/8 allow" "192.168.1.0/24 allow" "10.0.69.0/24 allow" ]; access-control-view = "10.0.69.0/24 wireguard"; # so-reuseport = "yes"; tls-upstream = "yes"; domain-insecure = "mossnet.lan"; local-zone = ''"mossnet.lan." redirect''; local-data = ''"mossnet.lan. IN A ${mossnet}"''; }; forward-zone = [{ name = "."; forward-addr = [ "45.90.28.0#6939b9.dns.nextdns.io" "1.1.1.1@853#cloudflare-dns.com" ]; # non-tls # forward-addr = ["45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8"] }]; view = { name = "wireguard"; local-zone = ''"mossnet.lan." redirect''; local-data = ''"mossnet.lan. IN A ${wg-mossnet}"''; }; }; }; # With unbound we're doing wildcard redirects, so we don't need that anymore # networking.hosts = { # mossnet = mossnet-hosts; # }; networking.firewall.allowedTCPPorts = [ 53 ]; networking.firewall.allowedUDPPorts = [ 53 ]; }