68 lines
1.8 KiB
Nix
68 lines
1.8 KiB
Nix
{ config, lib, ... }:
|
|
|
|
{
|
|
services.dnsmasq = {
|
|
enable = true;
|
|
|
|
extraConfig = ''
|
|
bogus-priv # do not forward revese lookups of internal addresses
|
|
domain-needed # do not forward names without domain
|
|
local-service # only respond to queries from local network
|
|
no-hosts # do not resolve hosts from /etc/hosts
|
|
no-resolv # only use explicitly configured resolvers
|
|
|
|
server=/fritz.box/192.168.100.1
|
|
|
|
domain=home.sbruder.de
|
|
|
|
dhcp-range=192.168.100.20,192.168.100.150,12h
|
|
dhcp-option=option:router,192.168.100.1
|
|
'';
|
|
servers = [
|
|
"127.0.0.1#5353"
|
|
"::1#5353"
|
|
];
|
|
};
|
|
|
|
services.prometheus.exporters.dnsmasq = {
|
|
enable = true;
|
|
listenAddress = "127.0.0.1";
|
|
leasesPath = "/var/lib/dnsmasq/dnsmasq.leases";
|
|
};
|
|
|
|
services.stubby = {
|
|
enable = true;
|
|
listenAddresses = [
|
|
"127.0.0.1@5353"
|
|
"0::1@5353"
|
|
];
|
|
upstreamServers = (lib.concatMapStrings
|
|
(server: with server; " - { address_data: ${addr}, tls_auth_name: \"${authName}\" }\n")
|
|
(lib.flatten
|
|
(lib.mapAttrsToList
|
|
(authName: addrs: map (addr: { inherit addr authName; }) addrs)
|
|
{
|
|
"dns.digitale-gesellschaft.ch" = [
|
|
"185.95.218.42"
|
|
"185.95.218.43"
|
|
"2a05:fc84::42"
|
|
"2a05:fc84::43"
|
|
];
|
|
"dns3.digitalcourage.de" = [
|
|
"5.9.164.112"
|
|
];
|
|
"dnsovertls.sinodun.com" = [
|
|
"145.100.185.15"
|
|
"2001:610:1:40ba:145:100:185:15"
|
|
];
|
|
"dnsovertls1.sinodun.com" = [
|
|
"145.100.185.16"
|
|
"2001:610:1:40ba:145:100:185:16"
|
|
];
|
|
})));
|
|
};
|
|
|
|
networking.firewall.allowedUDPPorts = [ 53 67 ];
|
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
|
}
|