1 files changed, 38 insertions, 0 deletions
diff --git a/aphrodite/dns/default.nix b/aphrodite/dns/default.nix
new file mode 100644
index 0000000..6dc664d
--- /dev/null
+++ b/aphrodite/dns/default.nix
@@ -0,0 +1,38 @@
+{config, ...}: let
+  domain = config.customOps.domain.fqdn;
+in {
+  networking.firewall = {
+    allowedTCPPorts = [53 853];
+    allowedUDPPorts = [53];
+  };
+  services = {
+    kresd = {
+      enable = true;
+      listenPlain = [
+        "[::]:53"
+        "0.0.0.0:53"
+      ];
+      listenTLS = [
+        "[::]:853"
+        "0.0.0.0:853"
+      ];
+    };
+    doh-server = {
+      enable = true;
+      settings = {
+        path = "/";
+        upstream = ["udp:127.0.0.1:53"];
+      };
+    };
+    nginx.virtualHosts."dns.${domain}" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8053";
+        extraConfig = ''
+          proxy_http_version 1.1;
+        '';
+      };
+    };
+  };
+}