diff options
| author | toufic ar <contact@toufy.me> | 2026-09-24 17:55:10 +0300 |
|---|---|---|
| committer | toufic ar <contact@toufy.me> | 2026-09-24 17:55:10 +0300 |
| commit | b2dc346246c7e0d462780021e34e31ee76d9db1d (patch) | |
| tree | 9a4c28701d2f782e7f58dffb6fe0eaffd0f4f0c2 | |
| parent | 4cb38e0b5873eda411c59719742df36f45c4839e (diff) | |
| download | servers-b2dc346246c7e0d462780021e34e31ee76d9db1d.tar.gz servers-b2dc346246c7e0d462780021e34e31ee76d9db1d.zip | |
aphrodite: dns blocklist
| -rw-r--r-- | aphrodite/dns/default.nix | 34 | ||||
| -rw-r--r-- | flake.nix | 12 |
2 files changed, 45 insertions, 1 deletions
diff --git a/aphrodite/dns/default.nix b/aphrodite/dns/default.nix index 6dc664d..ff3844d 100644 --- a/aphrodite/dns/default.nix +++ b/aphrodite/dns/default.nix @@ -1,5 +1,13 @@ -{config, ...}: let +{ + config, + pkgs, + inputs, + ... +}: let domain = config.customOps.domain.fqdn; + hagezi_pro = pkgs.writeText "hagezi_pro.rpz" builtins.readFile inputs.hagezi_pro_rpz; + hagezi_tif_part1 = pkgs.writeText "hagezi_tif_part1.rpz" builtins.readFile inputs.hagezi_tif_part1_rpz; + hagezi_tif_part2 = pkgs.writeText "hagezi_tif_part2.rpz" builtins.readFile inputs.hagezi_tif_part2_rpz; in { networking.firewall = { allowedTCPPorts = [53 853]; @@ -16,6 +24,30 @@ in { "[::]:853" "0.0.0.0:853" ]; + extraConfig = '' + modules.load('policy') + policy.add( + policy.rpz( + policy.DENY_MSG('blocked by "hagezi pro" list'), + '${hagezi_pro}', + false + ) + ) + policy.add( + policy.rpz( + policy.DENY_MSG('blocked by "hagezi TIF" list'), + '${hagezi_tif_part1}', + false + ) + ) + policy.add( + policy.rpz( + policy.DENY_MSG('blocked by "hagezi TIF" list'), + '${hagezi_tif_part2}', + false + ) + ) + ''; }; doh-server = { enable = true; @@ -13,6 +13,18 @@ inputs.nixpkgs.follows = "nixpkgs"; }; makeshiftci.url = "git+https://git.toufy.me/makeshiftci"; + hagezi_pro_rpz = { + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/refs/heads/main/rpz/pro.txt"; + flake = false; + }; + hagezi_tif_part1_rpz = { + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/refs/heads/main/rpz/tif-1.txt"; + flake = false; + }; + hagezi_tif_part2_rpz = { + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/refs/heads/main/rpz/tif-2.txt"; + flake = false; + }; }; outputs = inputs @ { |