nixos/profiles/systemd-resolved.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   ...
   6 }:
   7 {
   8   services.resolved = {
   9     enable = true;
  10     domains = [ "~." ];
  11     fallbackDns = [ "" ];
  12     dnssec = "true";
  13     dnsovertls = lib.mkDefault "false";
  14     # Deprecated in favor of MulticastDNS
  15     llmnr = "false";
  16     extraConfig = lib.mkDefault ''
  17       MulticastDNS=false
  18     '';
  19   };
  20   networking.nftables.ruleset = ''
  21     table inet filter {
  22       chain input-lan {
  23         #udp dport mdns counter accept comment "systemd-resolved: MulticastDNS"
  24       }
  25       chain output-lan {
  26         #skuid ${config.users.users.systemd-resolve.name} udp sport mdns udp dport mdns counter accept comment "MulticastDNS"
  27         #meta l4proto { udp, tcp } th dport domain skuid ${config.users.users.systemd-resolve.name} counter accept comment "systemd-resolved: DNS"
  28       }
  29       chain output-net {
  30         #meta l4proto { udp, tcp } th dport domain skuid ${config.users.users.systemd-resolve.name} counter accept comment "systemd-resolved: DNS"
  31       }
  32     }
  33   '';
  34 }