From b2dc346246c7e0d462780021e34e31ee76d9db1d Mon Sep 17 00:00:00 2001
From: toufic ar <contact@toufy.me>
Date: Thu, 24 Sep 2026 17:55:10 +0300
Subject: aphrodite: dns blocklist

---
 aphrodite/dns/default.nix | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

(limited to 'aphrodite/dns/default.nix')

diff --git a/aphrodite/dns/default.nix b/aphrodite/dns/default.nix
index 6dc664d..ff3844d 100644
--- a/aphrodite/dns/default.nix
+++ b/aphrodite/dns/default.nix
@@ -1,5 +1,13 @@
-{config, ...}: let
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}: let
   domain = config.customOps.domain.fqdn;
+  hagezi_pro = pkgs.writeText "hagezi_pro.rpz" builtins.readFile inputs.hagezi_pro_rpz;
+  hagezi_tif_part1 = pkgs.writeText "hagezi_tif_part1.rpz" builtins.readFile inputs.hagezi_tif_part1_rpz;
+  hagezi_tif_part2 = pkgs.writeText "hagezi_tif_part2.rpz" builtins.readFile inputs.hagezi_tif_part2_rpz;
 in {
   networking.firewall = {
     allowedTCPPorts = [53 853];
@@ -16,6 +24,30 @@ in {
         "[::]:853"
         "0.0.0.0:853"
       ];
+      extraConfig = ''
+        modules.load('policy')
+        policy.add(
+          policy.rpz(
+            policy.DENY_MSG('blocked by "hagezi pro" list'),
+            '${hagezi_pro}',
+            false
+          )
+        )
+        policy.add(
+          policy.rpz(
+            policy.DENY_MSG('blocked by "hagezi TIF" list'),
+            '${hagezi_tif_part1}',
+            false
+          )
+        )
+        policy.add(
+          policy.rpz(
+            policy.DENY_MSG('blocked by "hagezi TIF" list'),
+            '${hagezi_tif_part2}',
+            false
+          )
+        )
+      '';
     };
     doh-server = {
       enable = true;
-- 
cgit v1.3.1