privatevoid.net/depot
1
1
Fork 0
Code Issues 23 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

services/dns: add DNS-over-TLS resolver

Browse source
This commit is contained in:
Max Headroom 2022-06-19 14:04:46 +02:00
parent 303532b2fb
commit 91a29e5255
1 changed files with 31 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
hosts/VEGAS/services/dns/default.nix
View file

@ -1,16 +1,33 @@
{ config, hosts, inputs, pkgs, ... }:
{ config, hosts, inputs, pkgs, tools, ... }:
# TODO: is this secure?
let
inherit (hosts.${config.networking.hostName}) interfaces;
inherit (tools.meta) domain;
dot = config.security.acme.certs."securedns.${domain}";
in {
imports = [ ./zones.nix ];
networking.firewall = {
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 ];
allowedTCPPorts = [ 53 853 ];
allowedUDPPorts = [ 53 853 ];
};
systemd.services.coredns.after = [ "network-addresses-vstub.service" ];
systemd.services.coredns = {
after = [ "network-addresses-vstub.service" ];
serviceConfig.LoadCredential = [
"dot-cert.pem:${dot.directory}/fullchain.pem"
"dot-key.pem:${dot.directory}/key.pem"
];
};
security.acme.certs."securedns.${domain}" = {
group = "nginx";
webroot = "/var/lib/acme/acme-challenge";
# using a different ACME provider because Android Private DNS is fucky
server = "https://api.buypass.com/acme/directory";
reloadServices = [
"coredns.service"
];
};
services.coredns = {
enable = true;
config = ''
@ -22,6 +39,15 @@ in {
chaos "Private Void DNS" info@privatevoid.net
forward . 127.0.0.1
}
tls://.:853 {
bind ${interfaces.primary.addr}
tls {$CREDENTIALS_DIRECTORY}/dot-cert.pem {$CREDENTIALS_DIRECTORY}/dot-key.pem
hosts ${inputs.self.packages.${pkgs.system}.stevenblack-hosts} {
fallthrough
}
chaos "Private Void DNS" info@privatevoid.net
forward . ${interfaces.primary.addr}
}
'';
};
@ -36,19 +62,17 @@ in {
acl "trusted" {
127.0.0.0/8;
::1/128;
${interfaces.primary.addr}/32;
${interfaces.vstub.addr}/32;
10.100.0.0/16;
10.10.0.0/16;
};
acl "publicservers" {
${interfaces.primary.addr}/32;
116.202.226.86/32;
};
'';
extraOptions = ''
recursion yes;
allow-recursion { trusted; };
allow-recursion { trusted; ${interfaces.primary.addr}/32; };
dnssec-validation no;
'';
};