modules/services/dns.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

{
  flake.modules.nixos.dns =
    { lib, ... }:
    let
      servers = [
        "194.242.2.2#dns.mullvad.net"
        "2a07:e340::2#dns.mullvad.net"
      ];
      fallbackServers = [
        "1.1.1.1#cloudflare-dns.com"
        "1.0.0.1#cloudflare-dns.com"
      ];
    in
    {
      services.resolved = {
        enable = true;
        settings = {
          Resolve = {
            DNS = servers;
            FallbackDNS = fallbackServers;
            DNSSEC = true;
            DNSOverTLS = true;
            Domains = [ "~." ];
          };
        };
      };
      networking = {
        nameservers = servers;
        networkmanager.dns = lib.mkDefault "systemd-resolved";
      };
      # Workaround mullvad dns REFUSED response
      networking.hosts = {
        "216.58.206.78" = [ "www.youtube.com" ];
      };
    };

  flake.modules.darwin.dns =
    { pkgs, lib, ... }:
    {
      environment.systemPackages = [ pkgs.cloudflared ];

      networking = {
        dns = [ "127.0.0.1" ];
        knownNetworkServices = [
          "Wi-Fi"
          "Thunderbolt Bridge"
        ];
      };

      launchd.daemons.cloudflared-dns = {
        serviceConfig = {
          Label = "com.cloudflare.cloudflared-dns";
          ProgramArguments = [
            "${pkgs.cloudflared}/bin/cloudflared"
            "proxy-dns"
            "--upstream"
            "https://dns.mullvad.net/dns-query"
            "--upstream"
            "https://dns.quad9.net/dns-query"
            "--port"
            "53"
            "--address"
            "127.0.0.1"
          ];
          RunAtLoad = true;
          KeepAlive = true;
          StandardOutPath = "/var/log/cloudflared-dns.log";
          StandardErrorPath = "/var/log/cloudflared-dns.log";
        };
      };
    };
}