aphrodite: dns blocklist

1 files changed, 33 insertions, 1 deletions

diff --git a/aphrodite/dns/default.nix b/aphrodite/dns/default.nix
index 6dc664d..ff3844d 100644
--- a/aphrodite/dns/default.nix
+++ b/aphrodite/dns/default.nix
@@ -1,5 +1,13 @@
-{config, ...}: let
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}: let
   domain = config.customOps.domain.fqdn;
+  hagezi_pro = pkgs.writeText "hagezi_pro.rpz" builtins.readFile inputs.hagezi_pro_rpz;
+  hagezi_tif_part1 = pkgs.writeText "hagezi_tif_part1.rpz" builtins.readFile inputs.hagezi_tif_part1_rpz;
+  hagezi_tif_part2 = pkgs.writeText "hagezi_tif_part2.rpz" builtins.readFile inputs.hagezi_tif_part2_rpz;
 in {
   networking.firewall = {
     allowedTCPPorts = [53 853];
@@ -16,6 +24,30 @@ in {
         "[::]:853"
         "0.0.0.0:853"
       ];
+      extraConfig = ''
+        modules.load('policy')
+        policy.add(
+          policy.rpz(
+            policy.DENY_MSG('blocked by "hagezi pro" list'),
+            '${hagezi_pro}',
+            false
+          )
+        )
+        policy.add(
+          policy.rpz(
+            policy.DENY_MSG('blocked by "hagezi TIF" list'),
+            '${hagezi_tif_part1}',
+            false
+          )
+        )
+        policy.add(
+          policy.rpz(
+            policy.DENY_MSG('blocked by "hagezi TIF" list'),
+            '${hagezi_tif_part2}',
+            false
+          )
+        )
+      '';
     };
     doh-server = {
       enable = true;