60 lines
1.9 KiB
Nix
60 lines
1.9 KiB
Nix
{ pkgs, config, lib, ... }:
|
|
{
|
|
networking = {
|
|
nameservers = lib.mkForce [ "127.0.0.1" "::1" ];
|
|
# nameservers = lib.mkForce [ "127.0.0.1:8053" "[::1]:8053" ];
|
|
dhcpcd.extraConfig = "nohook resolv.conf"; # dhcp
|
|
networkmanager.dns = "none"; # nm
|
|
resolvconf.useLocalResolver = true; # resoved
|
|
};
|
|
|
|
services.tor = {
|
|
enable = true;
|
|
client.enable = true;
|
|
torsocks = {
|
|
enable = true;
|
|
allowInbound = false;
|
|
};
|
|
settings.SafeSocks = true;
|
|
settings.TestSocks = true;
|
|
};
|
|
|
|
services.dnscrypt-proxy2 = {
|
|
enable = true;
|
|
settings = {
|
|
ipv6_servers = config.networking.enableIPv6;
|
|
ipv4_servers = true;
|
|
require_dnssec = true;
|
|
dnscrypt_servers = true;
|
|
doh_servers = true;
|
|
odoh_servers = false;
|
|
require_nolog = true;
|
|
require_nofilter = true;
|
|
listen_addresses = [ "127.0.0.1:53" ];
|
|
proxy = "socks5://${config.services.tor.torsocks.server}";
|
|
force_tcp = true;
|
|
|
|
sources.public-resolvers = let
|
|
serverList = pkgs.fetchurl {
|
|
# fetching during build prevents issues e.g. when the certificate can't be validated if the clock is wrong
|
|
url = "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md";
|
|
hash = "sha256-2Pjs37mMolfWaaTf2c+tTbc1mzjCncK9qLyyZJn0LgA=";
|
|
};
|
|
in {
|
|
urls = [
|
|
"https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
|
|
"https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
|
|
];
|
|
cache_file = serverList;
|
|
minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
|
|
};
|
|
|
|
# You can choose a specific set of servers from https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md
|
|
# server_names = [ ... ];
|
|
};
|
|
};
|
|
|
|
systemd.services.dnscrypt-proxy2.serviceConfig = {
|
|
StateDirectory = "dnscrypt-proxy";
|
|
};
|
|
}
|