55 lines
1.7 KiB
Nix
55 lines
1.7 KiB
Nix
{ pkgs, ... }:
|
|
|
|
let
|
|
adblockLocalZones = pkgs.stdenv.mkDerivation {
|
|
name = "unbound-zones-adblock";
|
|
|
|
src = (pkgs.fetchFromGitHub {
|
|
owner = "StevenBlack";
|
|
repo = "hosts";
|
|
rev = "3.0.0";
|
|
sha256 = "01g6pc9s1ah2w1cbf6bvi424762hkbpbgja9585a0w99cq0n6bxv";
|
|
} + "/hosts");
|
|
|
|
phases = [ "installPhase" ];
|
|
|
|
installPhase = ''
|
|
${pkgs.gawk}/bin/awk '{sub(/\r$/,"")} {sub(/^127\.0\.0\.1/,"0.0.0.0")} BEGIN { OFS = "" } NF == 2 && $1 == "0.0.0.0" { print "local-zone: \"", $2, "\" static"}' $src | tr '[:upper:]' '[:lower:]' | sort -u > $out
|
|
'';
|
|
};
|
|
|
|
in {
|
|
networking.firewall.allowedTCPPorts = [ 53 853 5353 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 853 5353 ];
|
|
networking.extraHosts = '' 127.0.0.1 helix.domain '';
|
|
# These are causing errors, goes in the server file
|
|
# local-data = "mossnet.lan. 10800 IN A 10.0.69.4";
|
|
services.unbound = {
|
|
enable = true;
|
|
settings = {
|
|
server = {
|
|
interface = [ "0.0.0.0" ];
|
|
tls-upstream = true;
|
|
tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt";
|
|
include = "${adblockLocalZones}";
|
|
access-control = "0.0.0.0/0 allow";
|
|
verbosity = 2;
|
|
do-tcp = true;
|
|
do-ip4 = true;
|
|
prefetch = true;
|
|
prefetch-key = true;
|
|
rrset-roundrobin = true;
|
|
qname-minimisation-strict = true;
|
|
hide-identity = true;
|
|
hide-version = true;
|
|
local-zone = "mossnet.lan. static";
|
|
};
|
|
forward-zone = [{
|
|
name = ".";
|
|
forward-addr = [ "45.90.28.77#c46fd3.dns1.nextdns.io" "2a07:a8c0::#c46fd3.dns1.nextdns.io" "45.90.30.77#c46fd3.dns2.nextdns.io" "2a07:a8c1::#c46fd3.dns2.nextdns.io" ];
|
|
}];
|
|
remote-control.control-enable = true;
|
|
};
|
|
};
|
|
}
|