{ pkgs, ... }: let adblockLocalZones = pkgs.stdenv.mkDerivation { name = "unbound-zones-adblock"; src = (pkgs.fetchFromGitHub { owner = "StevenBlack"; repo = "hosts"; rev = "3.0.0"; sha256 = "01g6pc9s1ah2w1cbf6bvi424762hkbpbgja9585a0w99cq0n6bxv"; } + "/hosts"); phases = [ "installPhase" ]; installPhase = '' ${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out ''; }; in { networking.firewall.allowedTCPPorts = [ 53 853 5353 ]; networking.firewall.allowedUDPPorts = [ 53 853 5353 ]; networking.extraHosts = '' 127.0.0.1 helix.domain ''; # These are causing errors, goes in the server file # local-data = "mossnet.lan. 10800 IN A 10.0.69.4"; services.unbound = { enable = true; settings = { server = { interface = [ "0.0.0.0" ]; tls-upstream = true; tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt"; include = "${adblockLocalZones}"; access-control = "0.0.0.0/0 allow"; verbosity = 2; do-tcp = true; do-ip4 = true; prefetch = true; prefetch-key = true; rrset-roundrobin = true; qname-minimisation-strict = true; hide-identity = true; hide-version = true; local-zone = "mossnet.lan. static"; }; forward-zone = [{ name = "."; forward-addr = [ "45.90.28.77#c46fd3.dns1.nextdns.io" "2a07:a8c0::#c46fd3.dns1.nextdns.io" "45.90.30.77#c46fd3.dns2.nextdns.io" "2a07:a8c1::#c46fd3.dns2.nextdns.io" ]; }]; remote-control.control-enable = true; }; }; }