This repository has been archived on 2024-07-08. You can view files and clone it, but cannot push or open issues or pull requests.
nix-config-tn/nixos/hosts/common/optional/dnscrypt-proxy2.nix

42 lines
1.3 KiB
Nix
Raw Normal View History

2024-03-13 06:55:17 -05:00
# Ref: https://nixos.wiki/wiki/Encrypted_DNS#dnscrypt-proxy2
2024-03-18 04:26:02 -05:00
{ inputs
, outputs
, pkgs
, config
, ...
2024-03-17 16:04:32 -05:00
}: {
2024-03-13 06:55:17 -05:00
# Disable resolvd to ensure it doesnt re-write /etc/resolv.conf
2024-03-16 07:46:36 -05:00
config.services.resolved.enable = false;
# Fix this devices DNS resolv.conf else resolvd will point it to dnscrypt
# causing a risk of no dns if service fails.
config.networking = {
2024-03-18 04:26:02 -05:00
nameservers = [ "10.8.10.1" ]; # TODO make varible IP
2024-03-16 07:46:36 -05:00
2024-03-13 06:55:17 -05:00
dhcpcd.extraConfig = "nohook resolv.conf";
};
2024-03-16 07:46:36 -05:00
# configure secret for forwarding rules
config.sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".sopsFile = ./dnscrypt-proxy2.sops.yaml;
2024-03-16 15:25:35 -05:00
config.sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".mode = "0444"; # This is world-readable but theres nothing security related in the file
2024-03-16 07:46:36 -05:00
# Restart dnscrypt when secret changes
2024-03-18 04:26:02 -05:00
config.sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".restartUnits = [ "dnscrypt-proxy2" ];
2024-03-16 07:46:36 -05:00
config.services.dnscrypt-proxy2 = {
2024-03-13 06:55:17 -05:00
enable = true;
settings = {
2024-03-16 07:46:36 -05:00
require_dnssec = true;
forwarding_rules = config.sops.secrets."system/networking/dnscrypt-proxy2/forwarding-rules".path;
2024-03-18 04:26:02 -05:00
server_names = [ "NextDNS-f6fe35" ];
2024-03-16 07:46:36 -05:00
static = {
"NextDNS-f6fe35" = {
stamp = "sdns://AgEAAAAAAAAAAAAOZG5zLm5leHRkbnMuaW8HL2Y2ZmUzNQ";
2024-03-13 06:55:17 -05:00
};
2024-03-16 07:46:36 -05:00
};
2024-03-13 06:55:17 -05:00
};
};
}