From 0287a28426b6fc8452e73d037820213638c97659 Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Thu, 13 Feb 2025 15:53:54 -0500 Subject: feb2025 sprint --- machines/xnet/net/dns.nix | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 machines/xnet/net/dns.nix (limited to 'machines/xnet/net/dns.nix') diff --git a/machines/xnet/net/dns.nix b/machines/xnet/net/dns.nix new file mode 100644 index 0000000..579d6aa --- /dev/null +++ b/machines/xnet/net/dns.nix @@ -0,0 +1,39 @@ +{ ... }: { + services.resolved.enable = false; + + services.unbound = { + enable = true; + settings.server = { + interface = [ "127.0.0.1" ]; + access-control = [ + "0.0.0.0/0 refuse" + "127.0.0.0/8 allow" + ]; + + private-domain = [ ]; + private-address = [ ]; + + harden-glue = true; + harden-dnssec-stripped = true; + use-caps-for-id = false; + prefetch = true; + edns-buffer-size = 1232; + hide-identity = true; + hide-version = true; + tls-system-cert = true; + }; + + settings.forward-zone = [{ + name = "."; + forward-tls-upstream = true; + forward-addr = [ + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + ]; + }]; + }; + + networking = { + nameservers = [ "::1" ]; + }; +} -- cgit v1.3.1