summaryrefslogtreecommitdiff
path: root/os/srv/dns.nix
diff options
context:
space:
mode:
Diffstat (limited to 'os/srv/dns.nix')
-rw-r--r--os/srv/dns.nix286
1 files changed, 0 insertions, 286 deletions
diff --git a/os/srv/dns.nix b/os/srv/dns.nix
deleted file mode 100644
index b8a973f..0000000
--- a/os/srv/dns.nix
+++ /dev/null
@@ -1,286 +0,0 @@
-{
- config,
- lib,
- masterDomain,
- securityTemplates,
- ...
-}:
-let
- cfg = config.os.srv.dns;
- unboundPort = 5335;
-in
-{
- options.os.srv.dns = {
- enable = lib.mkEnableOption "enables dns scanning";
- adguardProxyConfig = lib.mkOption {
- type = lib.types.attrs;
- default = { };
- };
- };
- config = lib.mkIf cfg.enable {
- services.unbound = {
- enable = true;
- settings = {
- server = {
- interface = [ "127.0.0.1" ];
- port = unboundPort;
-
- do-ip4 = true;
- do-ip6 = false;
- do-udp = true;
- do-tcp = true;
-
- num-threads = 4;
- msg-cache-slabs = 4;
- rrset-cache-slabs = 4;
- infra-cache-slabs = 4;
- key-cache-slabs = 4;
-
- msg-cache-size = "256m";
- rrset-cache-size = "512m";
- infra-cache-numhosts = 20000;
-
- so-rcvbuf = "8m";
- so-sndbuf = "8m";
- so-reuseport = true;
-
- qname-minimisation = true;
- prefetch = true;
- prefetch-key = true;
- harden-glue = true;
- harden-dnssec-stripped = true;
- hide-identity = true;
- hide-version = true;
- use-caps-for-id = false; # might try this later
- edns-buffer-size = 1232;
-
- access-control = [
- "127.0.0.0/8 allow"
- "0.0.0.0/0 deny"
- ];
- };
- };
- };
-
- services.adguardhome = {
- enable = true;
- mutableSettings = true;
-
- settings = {
- http.address = "0.0.0.0:3000";
- dns = {
- bind_hosts = [
- "127.0.0.1"
- config.os.core.network.lan.ip
- config.os.core.network.wg.ip
- config.os.core.network.hs.ip
- ];
- rewrites = [
- {
- domain = "router.lan";
- answer = config.os.core.network.ips.opnsense-vm;
- }
- {
- domain = "nas.lan";
- answer = config.os.core.network.ips.bare-metal;
- }
- {
- domain = "ldap.${masterDomain}";
- answer = config.os.core.network.ips.gateway-vm;
- }
- ];
- port = 53;
- upstream_dns = [ "127.0.0.1:${toString unboundPort}" ];
- fallback_dns = [ "9.9.9.9" ];
- bootstrap_dns = [ "9.9.9.9" ];
- cache_size = 536870912;
- anonymize_client_ip = true;
- };
-
- filtering = {
- filtering_enabled = true;
- interval = 24;
- };
- filters = [
- {
- enabled = true;
- name = "Black Mirror Blocklist";
- url = "https://raw.githubusercontent.com/T145/black-mirror/refs/heads/master/dist/ADGUARD_SOURCES.txt";
- }
- {
- enabled = true;
- name = "Scam Blocklist by DurableNapkin";
- url = "https://raw.githubusercontent.com/durablenapkin/scamblocklist/master/adguard.txt";
- }
- {
- enabled = true;
- name = "Neo Dev Host Blocklist";
- url = "https://raw.githubusercontent.com/neodevpro/neodevhost/master/adblocker";
- }
- {
- enabled = true;
- name = "hBlock Blocklist";
- url = "https://hblock.molinero.dev/hosts_adblock.txt";
- }
- {
- enabled = true;
- name = "OISD Big Blocklist";
- url = "https://big.oisd.nl";
- }
- {
- enabled = true;
- name = "StevenBlack Unified";
- url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts";
- }
- {
- enabled = true;
- name = "StevenBlack Fakenews";
- url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts";
- }
- {
- enabled = true;
- name = "StevenBlack Gambling";
- url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/gambling-only/hosts";
- }
-
- #-----------------------------------------------------------------------------
-
- # HaGeZi's Blocklists
-
- {
- enabled = true;
- name = "HaGeZi's Ultimate Blocklist";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/ultimate.txt";
- }
- {
- enabled = false; # Added but disabled Pro++ as a fallback if Ultimate proves to be too aggressive
- name = "HaGeZi's Pro++ DNS Blocklist";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.plus.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's Fake DNS Blocklist";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/fake.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's Threat Intelligence Feeds DNS Blocklist";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's Dynamic DNS Blocklsit";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dyndns.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's Badware Hoster Blocklist";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/hoster.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's URL Shortener Blocklist";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/urlshortener.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's DNS Rebind Protection";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adguard/dns-rebind-protection.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's Gambling DNS Blocklist";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/gambling.txt";
- }
-
- #-----------------------------------------------------------------------------
-
- # NEWLY REGISTERED DOMAINS / ENTROPY DGAs
-
- {
- enabled = true;
- name = "HaGeZi's Newly Registered Domains 7 days ago to yesterday";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd7.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's Newly Registered Domains 14 days ago to 8 days ago";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd14-8.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's Newly Registered Domains 21 days ago to 15 days ago";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd21-15.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's Newly Registered Domains 28 days ago to 12 days ago";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd28-22.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's Newly Registered Domains 35 days ago to 29 days ago";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd35-29.txt";
- }
- {
- enabled = true;
- name = "HaGeZi's Newly Registered High Entropy Domains";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dga30.txt";
- }
-
- #-----------------------------------------------------------------------------
-
- # DNS BYPASS BLOCKLISTS
-
- {
- enabled = true;
- name = "HaGeZi's DNS Bypass Blocklist";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/doh-vpn-proxy-bypass.txt";
- }
- {
- enabled = true;
- name = "DNS HTTPS Blocklist";
- url = "https://raw.githubusercontent.com/Bryantdl7/pihole-blocklists/main/dns-https-block.txt";
- }
-
- #-----------------------------------------------------------------------------
-
- # NSFW DNS BLOCKLISTS
-
- {
- enabled = true;
- name = "HaGeZi's NSFW DNS Blocklist";
- url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nsfw.txt";
- }
- {
- enabled = true;
- name = "oisd NSFW";
- url = "https://nsfw.oisd.nl";
- }
- {
- enabled = true;
- name = "StevenBlack NSFW Blocklist";
- url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts";
- }
- ];
- };
- };
-
- os.srv.dns.adguardProxyConfig = {
- "adguard.${masterDomain}" = {
- enableACME = true;
- forceSSL = true;
-
- locations."/" = {
- proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
- extraConfig = securityTemplates.restrictToInternal;
- };
- };
- };
-
- networking.firewall = {
- allowedUDPPorts = [ 53 ];
- allowedTCPPorts = [ 53 ];
- };
- };
-}
generated by cgit v1.3 (git 2.53.0) at 2026-08-16 23:29:09 +0000