infra/nix/os/profiles/containers/configuration.nix

{...}: {
  networking.useHostResolvConf = false;

  networking.nameservers = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];

  services.resolved = {
    enable = true;
    dnssec = "true";
    domains = ["~."];
    fallbackDns = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
    extraConfig = ''
      DNSOverTLS=yes
    '';
  };

  imports = [
    ../../modules/ddclient-ovh.nix
    ../../modules/ddclient-hetzner.nix
  ];
}