nixos/profiles/systemd-resolved.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   ...
   6 }:
   7 {
   8   services.resolved = {
   9     enable = true;
  10     domains = [ "~." ];
  11     fallbackDns = [ "" ];
  12     dnssec = "true";
  13     dnsovertls = lib.mkDefault "false";
  14     # Deprecated in favor of MulticastDNS
  15     llmnr = "false";
  16     extraConfig = lib.mkDefault ''
  17       MulticastDNS=false
  18     '';
  19     /*
  20       ToUse(nixos-26.05):
  21       settings = {
  22         Resolve.MulticastDNS = false;
  23       };
  24     */
  25   };
  26   networking.nftables.ruleset = ''
  27     table inet filter {
  28       chain input-lan {
  29         #udp dport mdns counter accept comment "systemd-resolved: MulticastDNS"
  30       }
  31       chain output-lan {
  32         #skuid ${config.users.users.systemd-resolve.name} udp sport mdns udp dport mdns counter accept comment "MulticastDNS"
  33         #meta l4proto { udp, tcp } th dport domain skuid ${config.users.users.systemd-resolve.name} counter accept comment "systemd-resolved: DNS"
  34       }
  35       chain output-net {
  36         #meta l4proto { udp, tcp } th dport domain skuid ${config.users.users.systemd-resolve.name} counter accept comment "systemd-resolved: DNS"
  37       }
  38     }
  39   '';
  40 }