nixos/profiles/dnscrypt-proxy2.nix

   1 { lib, ... }:
   2 with lib;
   3 {
   4   networking = {
   5     networkmanager.dns = mkForce "none";
   6     nameservers = [ "127.0.0.1" "::1" ];
   7     #resolvconf.enable = lib.mkForce false;
   8     resolvconf.useLocalResolver = true;
   9     dhcpcd.extraConfig = "nohook resolv.conf";
  10   };
  11
  12   # Create a user for matching egress on it in the firewall
  13   systemd.services.dnscrypt-proxy2.serviceConfig.User = "dnscrypt-proxy2";
  14   users.users.dnscrypt-proxy2 = {
  15     isSystemUser = true;
  16     group = "dnscrypt-proxy2";
  17   };
  18   users.groups.dnscrypt-proxy2 = { };
  19   services.dnscrypt-proxy2 = {
  20     enable = true;
  21     # https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml
  22     upstreamDefaults = true;
  23     settings = {
  24       cache = true;
  25       disabled_server_names = [
  26         "cloudflare"
  27       ];
  28       dnscrypt_servers = true;
  29       doh_servers = true;
  30       fallback_resolvers = [
  31         "9.9.9.9:53" # Quad9
  32         "8.8.8.8:53" # Google
  33       ];
  34       force_tcp = false;
  35       ignore_system_dns = true;
  36       ipv4_servers = true;
  37       ipv6_servers = true;
  38       log_level = 2;
  39       #proxy = "socks5://127.0.0.1:9050";
  40       max_clients = 250;
  41       netprobe_timeout = 60;
  42       query_log = {
  43         file = "/dev/stdout";
  44         format = "tsv";
  45         ignored_qtypes = [ ];
  46       };
  47       require_dnssec = true;
  48       require_nofilter = true;
  49       require_nolog = true;
  50       sources.public-resolvers = {
  51         urls = [
  52           "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
  53           "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
  54         ];
  55         cache_file = "/var/lib/dnscrypt-proxy/public-resolvers.md";
  56         minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
  57       };
  58       timeout = 5000;
  59       use_syslog = true;
  60     };
  61   };
  62 }