61 lines
1.5 KiB
Nix
61 lines
1.5 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
let
|
|
net = import ../data/network.nix;
|
|
in
|
|
{
|
|
# Enable Blocky
|
|
services.blocky = {
|
|
enable = true;
|
|
settings = {
|
|
# Listen on port 53 (standard DNS port)
|
|
ports.dns = 53;
|
|
|
|
# Custom DNS entries for your local services
|
|
customDNS = {
|
|
# This maps your domains to your Pi's IP
|
|
mapping = net.dnsMappings;
|
|
# mapping = dnsMappings;
|
|
};
|
|
|
|
conditional = {
|
|
fallbackUpstream = false;
|
|
mapping = builtins.mapAttrs (name: value: net.ips.router) net.dnsMappings;
|
|
};
|
|
|
|
# Upstream DNS servers (with fallback)
|
|
upstreams = {
|
|
groups = {
|
|
default =
|
|
["https://cloudflare-dns.com/dns-query"] ++ net.fallback_dns_servers;
|
|
};
|
|
};
|
|
|
|
# Bootstrap DNS (for initially resolving DoH servers)
|
|
bootstrapDns = {
|
|
upstream = "https://1.1.1.1/dns-query";
|
|
ips = ["1.1.1.1" "1.0.0.1"];
|
|
};
|
|
|
|
# Enable caching for better performance
|
|
caching = {
|
|
minTime = "5m";
|
|
maxTime = "30m";
|
|
prefetching = true;
|
|
};
|
|
|
|
# blocking = {
|
|
# denylists = {
|
|
# ads = ["https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"];
|
|
# };
|
|
# clientGroupsBlock = {
|
|
# default = ["ads"];
|
|
# };
|
|
# };
|
|
};
|
|
};
|
|
|
|
# Allow DNS through the firewall
|
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
}
|