From b2dc346246c7e0d462780021e34e31ee76d9db1d Mon Sep 17 00:00:00 2001
From: toufic ar <contact@toufy.me>
Date: Thu, 24 Sep 2026 17:55:10 +0300
Subject: aphrodite: dns blocklist

---
 aphrodite/dns/default.nix | 34 +++++++++++++++++++++++++++++++++-
 flake.nix                 | 12 ++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/aphrodite/dns/default.nix b/aphrodite/dns/default.nix
index 6dc664d..ff3844d 100644
--- a/aphrodite/dns/default.nix
+++ b/aphrodite/dns/default.nix
@@ -1,5 +1,13 @@
-{config, ...}: let
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}: let
   domain = config.customOps.domain.fqdn;
+  hagezi_pro = pkgs.writeText "hagezi_pro.rpz" builtins.readFile inputs.hagezi_pro_rpz;
+  hagezi_tif_part1 = pkgs.writeText "hagezi_tif_part1.rpz" builtins.readFile inputs.hagezi_tif_part1_rpz;
+  hagezi_tif_part2 = pkgs.writeText "hagezi_tif_part2.rpz" builtins.readFile inputs.hagezi_tif_part2_rpz;
 in {
   networking.firewall = {
     allowedTCPPorts = [53 853];
@@ -16,6 +24,30 @@ in {
         "[::]:853"
         "0.0.0.0:853"
       ];
+      extraConfig = ''
+        modules.load('policy')
+        policy.add(
+          policy.rpz(
+            policy.DENY_MSG('blocked by "hagezi pro" list'),
+            '${hagezi_pro}',
+            false
+          )
+        )
+        policy.add(
+          policy.rpz(
+            policy.DENY_MSG('blocked by "hagezi TIF" list'),
+            '${hagezi_tif_part1}',
+            false
+          )
+        )
+        policy.add(
+          policy.rpz(
+            policy.DENY_MSG('blocked by "hagezi TIF" list'),
+            '${hagezi_tif_part2}',
+            false
+          )
+        )
+      '';
     };
     doh-server = {
       enable = true;
diff --git a/flake.nix b/flake.nix
index 55457ff..0e75165 100644
--- a/flake.nix
+++ b/flake.nix
@@ -13,6 +13,18 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     makeshiftci.url = "git+https://git.toufy.me/makeshiftci";
+    hagezi_pro_rpz = {
+      url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/refs/heads/main/rpz/pro.txt";
+      flake = false;
+    };
+    hagezi_tif_part1_rpz = {
+      url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/refs/heads/main/rpz/tif-1.txt";
+      flake = false;
+    };
+    hagezi_tif_part2_rpz = {
+      url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/refs/heads/main/rpz/tif-2.txt";
+      flake = false;
+    };
   };
 
   outputs = inputs @ {
-- 
cgit v1.3.1