helm/profiles/helix-zone/dns.nix
2022-09-19 08:13:50 +10:00

55 lines
1.7 KiB
Nix

{ pkgs, ... }:
let
adblockLocalZones = pkgs.stdenv.mkDerivation {
name = "unbound-zones-adblock";
src = (pkgs.fetchFromGitHub {
owner = "StevenBlack";
repo = "hosts";
rev = "3.0.0";
sha256 = "01g6pc9s1ah2w1cbf6bvi424762hkbpbgja9585a0w99cq0n6bxv";
} + "/hosts");
phases = [ "installPhase" ];
installPhase = ''
${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out
'';
};
in {
networking.firewall.allowedTCPPorts = [ 53 853 5353 ];
networking.firewall.allowedUDPPorts = [ 53 853 5353 ];
networking.extraHosts = '' 127.0.0.1 helix.domain '';
# These are causing errors, goes in the server file
# local-data = "mossnet.lan. 10800 IN A 10.0.69.4";
services.unbound = {
enable = true;
settings = {
server = {
interface = [ "0.0.0.0" ];
tls-upstream = true;
tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt";
include = "${adblockLocalZones}";
access-control = "0.0.0.0/0 allow";
verbosity = 2;
do-tcp = true;
do-ip4 = true;
prefetch = true;
prefetch-key = true;
rrset-roundrobin = true;
qname-minimisation-strict = true;
hide-identity = true;
hide-version = true;
local-zone = "mossnet.lan. static";
};
forward-zone = [{
name = ".";
forward-addr = [ "45.90.28.77#c46fd3.dns1.nextdns.io" "2a07:a8c0::#c46fd3.dns1.nextdns.io" "45.90.30.77#c46fd3.dns2.nextdns.io" "2a07:a8c1::#c46fd3.dns2.nextdns.io" ];
}];
remote-control.control-enable = true;
};
};
}