blob: ff3844d52ff5e0969072ce399f15c7dccad3b3c0 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
{
config,
pkgs,
inputs,
...
}: let
domain = config.customOps.domain.fqdn;
hagezi_pro = pkgs.writeText "hagezi_pro.rpz" builtins.readFile inputs.hagezi_pro_rpz;
hagezi_tif_part1 = pkgs.writeText "hagezi_tif_part1.rpz" builtins.readFile inputs.hagezi_tif_part1_rpz;
hagezi_tif_part2 = pkgs.writeText "hagezi_tif_part2.rpz" builtins.readFile inputs.hagezi_tif_part2_rpz;
in {
networking.firewall = {
allowedTCPPorts = [53 853];
allowedUDPPorts = [53];
};
services = {
kresd = {
enable = true;
listenPlain = [
"[::]:53"
"0.0.0.0:53"
];
listenTLS = [
"[::]:853"
"0.0.0.0:853"
];
extraConfig = ''
modules.load('policy')
policy.add(
policy.rpz(
policy.DENY_MSG('blocked by "hagezi pro" list'),
'${hagezi_pro}',
false
)
)
policy.add(
policy.rpz(
policy.DENY_MSG('blocked by "hagezi TIF" list'),
'${hagezi_tif_part1}',
false
)
)
policy.add(
policy.rpz(
policy.DENY_MSG('blocked by "hagezi TIF" list'),
'${hagezi_tif_part2}',
false
)
)
'';
};
doh-server = {
enable = true;
settings = {
path = "/";
upstream = ["udp:127.0.0.1:53"];
};
};
nginx.virtualHosts."dns.${domain}" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8053";
extraConfig = ''
proxy_http_version 1.1;
'';
};
};
};
}
|
