diff options
Diffstat (limited to 'os/srv/dns.nix')
| -rw-r--r-- | os/srv/dns.nix | 247 |
1 files changed, 247 insertions, 0 deletions
diff --git a/os/srv/dns.nix b/os/srv/dns.nix new file mode 100644 index 0000000..f0c50a6 --- /dev/null +++ b/os/srv/dns.nix @@ -0,0 +1,247 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.dns; + unboundPort = 5335; +in +{ + options.os.srv.dns.enable = lib.mkEnableOption "enables dns scanning"; + config = lib.mkIf cfg.enable { + services.unbound = { + enable = true; + settings = { + server = { + interface = [ "127.0.0.1" ]; + port = unboundPort; + + do-ip4 = true; + do-ip6 = false; + do-udp = true; + do-tcp = true; + + num-threads = 4; + msg-cache-slabs = 4; + rrset-cache-slabs = 4; + infra-cache-slabs = 4; + key-cache-slabs = 4; + + msg-cache-size = "256m"; + rrset-cache-size = "512m"; + infra-cache-numhosts = 20000; + + so-rcvbuf = "8m"; + so-sndbuf = "8m"; + so-reuseport = true; + + qname-minimisation = true; + prefetch = true; + prefetch-key = true; + harden-glue = true; + harden-dnssec-stripped = true; + hide-identity = true; + hide-version = true; + use-caps-for-id = false; # might try this later + edns-buffer-size = 1232; + + access-control = [ + "127.0.0.0/8 allow" + "0.0.0.0/0 deny" + ]; + }; + }; + }; + + services.adguardhome = { + enable = true; + mutableSettings = true; + + settings = { + http.address = "0.0.0.0:3000"; + dns = { + bind_hosts = [ + "127.0.0.1" + config.os.core.network.lan.ip + config.os.core.network.wg.ip + config.os.core.network.hs.ip + ]; + port = 53; + upstream_dns = [ "127.0.0.1:${toString unboundPort}" ]; + bootstrap_dns = [ "9.9.9.9" ]; + cache_size = 536870912; + # anonymize_client_ip = true; + }; + + filtering = { + filtering_enabled = true; + interval = 24; + }; + filters = [ + { + enabled = true; + name = "Black Mirror Blocklist"; + url = "https://raw.githubusercontent.com/T145/black-mirror/refs/heads/master/dist/ADGUARD_SOURCES.txt"; + } + { + enabled = true; + name = "Scam Blocklist by DurableNapkin"; + url = "https://raw.githubusercontent.com/durablenapkin/scamblocklist/master/adguard.txt"; + } + { + enabled = true; + name = "Neo Dev Host Blocklist"; + url = "https://raw.githubusercontent.com/neodevpro/neodevhost/master/adblocker"; + } + { + enabled = true; + name = "hBlock Blocklist"; + url = "https://hblock.molinero.dev/hosts_adblock.txt"; + } + { + enabled = true; + name = "OISD Big Blocklist"; + url = "https://big.oisd.nl"; + } + { + enabled = true; + name = "StevenBlack Unified"; + url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"; + } + { + enabled = true; + name = "StevenBlack Fakenews"; + url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts"; + } + { + enabled = true; + name = "StevenBlack Gambling"; + url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/gambling-only/hosts"; + } + + #----------------------------------------------------------------------------- + + # HaGeZi's Blocklists + + { + enabled = true; + name = "HaGeZi's Ultimate Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/ultimate.txt"; + } + { + enabled = false; # Added but disabled Pro++ as a fallback if Ultimate proves to be too aggressive + name = "HaGeZi's Pro++ DNS Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.plus.txt"; + } + { + enabled = true; + name = "HaGeZi's Fake DNS Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/fake.txt"; + } + { + enabled = true; + name = "HaGeZi's Threat Intelligence Feeds DNS Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt"; + } + { + enabled = true; + name = "HaGeZi's Dynamic DNS Blocklsit"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dyndns.txt"; + } + { + enabled = true; + name = "HaGeZi's Badware Hoster Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/hoster.txt"; + } + { + enabled = true; + name = "HaGeZi's URL Shortener Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/urlshortener.txt"; + } + { + enabled = true; + name = "HaGeZi's DNS Rebind Protection"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adguard/dns-rebind-protection.txt"; + } + { + enabled = true; + name = "HaGeZi's Gambling DNS Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/gambling.txt"; + } + + #----------------------------------------------------------------------------- + + # NEWLY REGISTERED DOMAINS / ENTROPY DGAs + + { + enabled = true; + name = "HaGeZi's Newly Registered Domains 7 days ago to yesterday"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd7.txt"; + } + { + enabled = true; + name = "HaGeZi's Newly Registered Domains 14 days ago to 8 days ago"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd14-8.txt"; + } + { + enabled = true; + name = "HaGeZi's Newly Registered Domains 21 days ago to 15 days ago"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd21-15.txt"; + } + { + enabled = true; + name = "HaGeZi's Newly Registered Domains 28 days ago to 12 days ago"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd28-22.txt"; + } + { + enabled = true; + name = "HaGeZi's Newly Registered Domains 35 days ago to 29 days ago"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nrd35-29.txt"; + } + { + enabled = true; + name = "HaGeZi's Newly Registered High Entropy Domains"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/dga30.txt"; + } + + #----------------------------------------------------------------------------- + + # DNS BYPASS BLOCKLISTS + + { + enabled = true; + name = "HaGeZi's DNS Bypass Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/doh-vpn-proxy-bypass.txt"; + } + { + enabled = true; + name = "DNS HTTPS Blocklist"; + url = "https://raw.githubusercontent.com/Bryantdl7/pihole-blocklists/main/dns-https-block.txt"; + } + + #----------------------------------------------------------------------------- + + # NSFW DNS BLOCKLISTS + + { + enabled = true; + name = "HaGeZi's NSFW DNS Blocklist"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/nsfw.txt"; + } + { + enabled = true; + name = "oisd NSFW"; + url = "https://nsfw.oisd.nl"; + } + { + enabled = true; + name = "StevenBlack NSFW Blocklist"; + url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn-only/hosts"; + } + ]; + }; + }; + + networking.firewall = { + allowedUDPPorts = [ 53 ]; + allowedTCPPorts = [ 53 ]; + }; + }; +} |