77 lines
2.2 KiB
Nix
77 lines
2.2 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
let
|
|
adblockLocalZones = pkgs.stdenv.mkDerivation {
|
|
name = "unbound-zones-adblock";
|
|
|
|
src = (pkgs.fetchFromGitHub
|
|
{
|
|
owner = "StevenBlack";
|
|
repo = "hosts";
|
|
rev = "3.12.21";
|
|
sha256 = "Yzr6PY/zqQE+AHH0J6ioHTsgkikM+dz4aelbGpQJa1s=";
|
|
} + "/hosts");
|
|
|
|
phases = [ "installPhase" ];
|
|
|
|
installPhase = ''
|
|
${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out
|
|
'';
|
|
};
|
|
|
|
mossnet = "192.168.1.240"; # The local lan-ip for box
|
|
wg-mossnet = "10.0.69.4"; # The wireguard ip for box
|
|
mossnet-hosts = [
|
|
"mossnet.lan"
|
|
"links.mossnet.lan"
|
|
"read.mossnet.lan"
|
|
"stats.mossnet.lan"
|
|
"music.mossnet.lan"
|
|
"tasks.mossnet.lan"
|
|
"file.mossnet.lan"
|
|
"books.mossnet.lan"
|
|
"fin.mossnet.lan"
|
|
"paper.mossnet.lan"
|
|
"cal.mossnet.lan"
|
|
"archive.mossnet.lan"
|
|
"tracks.mossnet.lan"
|
|
"grasp.mossnet.lan"
|
|
"photos.mossnet.lan"
|
|
];
|
|
in
|
|
{
|
|
services.unbound = {
|
|
enable = true;
|
|
settings = {
|
|
server = {
|
|
include = "${adblockLocalZones}";
|
|
interface = [ "0.0.0.0" ];
|
|
access-control = [ "127.0.0.0/24 allow" "192.168.0.0/24 allow" "10.0.69.0/24 allow" ];
|
|
access-control-view = "10.0.69.0/24 wireguard";
|
|
local-zone = ''"mossnet.lan." redirect'';
|
|
local-data = ''"mossnet.lan. IN A ${mossnet}"'';
|
|
};
|
|
forward-zone = [{
|
|
name = ".";
|
|
forward-addr = [ "45.90.30.49" "45.90.28.49" "1.1.1.1" "8.8.8.8" ];
|
|
}];
|
|
view = {
|
|
name = "wireguard";
|
|
local-zone = ''"mossnet.lan." redirect'';
|
|
local-data = ''"mossnet.lan. IN A ${wg-mossnet}"'';
|
|
};
|
|
do-not-query-localhost = "no";
|
|
# Eventually we'll add DNSSEC / DoT
|
|
# so-reuseport: yes
|
|
# tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
|
|
# tls-upstream: yes
|
|
};
|
|
};
|
|
|
|
# With unbound we're doing wildcard redirects, so we don't need that anymore
|
|
# networking.hosts = {
|
|
# mossnet = mossnet-hosts;
|
|
# };
|
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
}
|