blob: 0e1725915c29bb9518cd5e90bfb8a0861e22af39 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
{ config, oisd, ... }:
let
inherit (config.age) secrets;
tailscaleDns = [ "/serval-moth.ts.net/100.100.100.100" ];
cloudflareServers = [
"1.1.1.1"
"1.0.0.1"
"2606:4700:4700::1111"
"2606:4700:4700::1001"
];
quad9Servers = [
"9.9.9.9"
"149.112.112.112"
"2620:fe::fe"
"2620:fe::9"
];
upstreamServers = cloudflareServers ++ quad9Servers ++ tailscaleDns;
dnsProxyPort = 4157;
dohInternalPort = 4158;
dotInternalPort = 4159;
# well-known
dnsPort = 53;
dotPort = 853;
in
{
networking.firewall = {
allowedTCPPorts = [
dnsPort
dotPort
];
allowedUDPPorts = [ dnsPort ];
};
services.resolved.enable = false;
age.secrets.internal-tls = {
file = ../secrets/internal-tls.age;
};
services = {
dnsmasq = {
enable = true;
# Ref: https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html
settings = {
interface = [
"enp1s0"
"tailscale0"
];
bind-dynamic = true;
server = upstreamServers;
cache-size = 4096;
no-resolv = true;
bogus-priv = true;
domain-needed = true;
localise-queries = true;
conf-file = "${oisd}/dnsmasq2_big.txt";
log-queries = "extra";
};
};
dnsproxy = {
enable = true;
settings = {
listen-addrs = [ "127.0.0.1" ];
listen-ports = [ dnsProxyPort ]; # just so that it doesn't bind to 53
upstream = [ "127.0.0.1:53" ];
cache = false;
# NOTE: DoH only supports DNS Wireformat so far.
# JSON support has been requested.
# see issue: https://github.com/AdguardTeam/dnsproxy/issues/422
# NOTE(2): also, there's an open PR to avoid dealing with these
# certificates and expose dnsproxy through HTTP, to later
# reverse proxy Nginx to it, like I'm doing here.
# see: https://github.com/AdguardTeam/dnsproxy/pull/302
https-port = [ dohInternalPort ];
tls-port = [ dotInternalPort ];
tls-crt = ../assets/internal-tls.crt;
};
flags = [ "--tls-key=\${CREDENTIALS_DIRECTORY}/internal-tls" ];
};
nginx = {
# DNS-over-HTTPS
virtualHosts."dns.rnrd.eu" = {
useACMEHost = "rnrd.eu";
forceSSL = true;
locations."/" = {
proxyPass = "https://127.0.0.1:${toString dohInternalPort}";
extraConfig = ''
proxy_ssl_trusted_certificate ${../assets/internal-tls.crt};
proxy_ssl_verify off;
'';
};
extraConfig = ''
access_log /var/log/nginx/dns.access.log json_combined;
'';
};
# DNS-over-TLS
streamConfig =
let
rnrdCertPath = config.security.acme.certs."rnrd.eu".directory;
in
''
server {
listen [::]:${toString dotPort} ssl ipv6only=off;
ssl_certificate ${rnrdCertPath}/fullchain.pem;
ssl_certificate_key ${rnrdCertPath}/key.pem;
ssl_trusted_certificate ${rnrdCertPath}/chain.pem;
proxy_pass 127.0.0.1:${toString dotInternalPort};
proxy_ssl on;
proxy_ssl_trusted_certificate ${../assets/internal-tls.crt};
proxy_ssl_verify off;
}
'';
};
};
systemd.services.dnsproxy.serviceConfig = {
LoadCredential = "internal-tls:${secrets.internal-tls.path}";
};
}
|
