5 networkmanager.dns = mkForce "none";
6 nameservers = [ "127.0.0.1" "::1" ];
7 #resolvconf.enable = lib.mkForce false;
8 resolvconf.useLocalResolver = true;
9 dhcpcd.extraConfig = "nohook resolv.conf";
11 services.resolved.enable = false;
13 # Create a user for matching egress on it in the firewall
14 systemd.services.dnscrypt-proxy2.serviceConfig.User = "dnscrypt-proxy2";
15 users.users.dnscrypt-proxy2 = {
17 group = "dnscrypt-proxy2";
19 users.groups.dnscrypt-proxy2 = { };
20 services.dnscrypt-proxy2 = {
22 # https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml
23 upstreamDefaults = true;
26 disabled_server_names = [
29 dnscrypt_servers = true;
31 fallback_resolvers = [
36 ignore_system_dns = true;
40 #proxy = "socks5://127.0.0.1:9050";
42 netprobe_timeout = 60;
48 require_dnssec = true;
49 require_nofilter = true;
51 sources.public-resolvers = {
53 "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
54 "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
56 cache_file = "/var/lib/dnscrypt-proxy/public-resolvers.md";
57 minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";