steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

sj-vps-htz0,containers/dns: remove IPv6, opportunistic TLS

Browse source
This commit is contained in:
steveej 2023-11-25 09:19:31 +01:00
parent d86fdd61c9
commit f5882396e3
3 changed files with 26 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/os/devices/sj-vps-htz0/system.nix
View file

@ -8,6 +8,10 @@
}: let
wireguardPort = 51820;
in {
imports = [
../../snippets/systemd-resolved.nix
];
networking.firewall.enable = true;
networking.nftables.enable = true;
@ -47,18 +51,6 @@ in {
interface = "eth0";
};
networking.nameservers = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
services.resolved = {
enable = true;
dnssec = "true";
domains = ["~."];
fallbackDns = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
extraConfig = ''
DNSOverTLS=yes
'';
};
networking.nat = {
enable = true;
internalInterfaces = ["ve-*" "wg*"];

13
nix/os/profiles/containers/configuration.nix
View file

@ -1,19 +1,8 @@
{...}: {
networking.useHostResolvConf = false;
networking.nameservers = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
services.resolved = {
enable = true;
dnssec = "true";
domains = ["~."];
fallbackDns = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
extraConfig = ''
DNSOverTLS=yes
'';
};
imports = [
../../snippets/systemd-resolved.nix
# ../../modules/ddclient-ovh.nix
# ../../modules/ddclient-hetzner.nix
];

21
nix/os/snippets/systemd-resolved.nix Normal file
View file

@ -0,0 +1,21 @@
{
networking.nameservers = [
# https://dnsforge.de/
"176.9.93.198"
"176.9.1.117"
# TODO: enable IPv6
# "2a01:4f8:151:34aa::198"
# "2a01:4f8:141:316d::117"
];
services.resolved = {
enable = true;
dnssec = "true";
domains = ["~."];
extraConfig = ''
# TODO: figure out why "true" doesn't work
DNSOverTLS=opportunistic
'';
};
}