nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-10-31 22:51:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/https-dns-proxy: add OpenDNS support

Browse Source
This commit is contained in:
Peter Hoeg 2022-08-14 20:22:40 +08:00
parent f0ec7d7698
commit 28116cfd9b
1 changed files with 23 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
nixos/modules/services/networking/https-dns-proxy.nix
View File

@ -20,19 +20,23 @@ let
ips = [ "9.9.9.9" "149.112.112.112" ];
url = "https://dns.quad9.net/dns-query";
};
opendns = {
ips = [ "208.67.222.222" "208.67.220.220" ];
url = "https://doh.opendns.com/dns-query";
};
custom = {
inherit (cfg.provider) ips url;
};
};
defaultProvider = "quad9";
providerCfg =
let
isCustom = cfg.provider.kind == "custom";
in
lib.concatStringsSep " " [
concatStringsSep " " [
"-b"
(concatStringsSep "," (if isCustom then cfg.provider.ips else providers."${cfg.provider.kind}".ips))
(concatStringsSep "," providers."${cfg.provider.kind}".ips)
"-r"
(if isCustom then cfg.provider.url else providers."${cfg.provider.kind}".url)
providers."${cfg.provider.kind}".url
];
in
@ -62,14 +66,16 @@ in
The upstream provider to use or custom in case you do not trust any of
the predefined providers or just want to use your own.
The default is ${defaultProvider} and there are privacy and security trade-offs
when using any upstream provider. Please consider that before using any
of them.
The default is ${defaultProvider} and there are privacy and security
trade-offs when using any upstream provider. Please consider that
before using any of them.
If you pick a custom provider, you will need to provide the bootstrap
IP addresses as well as the resolver https URL.
Supported providers: ${concatStringsSep ", " (builtins.attrNames providers)}
If you pick the custom provider, you will need to provide the
bootstrap IP addresses as well as the resolver https URL.
'';
type = types.enum ((builtins.attrNames providers) ++ [ "custom" ]);
type = types.enum (builtins.attrNames providers);
default = defaultProvider;
};
@ -105,14 +111,18 @@ in
config = lib.mkIf cfg.enable {
systemd.services.https-dns-proxy = {
description = "DNS to DNS over HTTPS (DoH) proxy";
requires = [ "network.target" ];
after = [ "network.target" ];
wants = [ "nss-lookup.target" ];
before = [ "nss-lookup.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = rec {
Type = "exec";
DynamicUser = true;
ProtectHome = "tmpfs";
ExecStart = lib.concatStringsSep " " (
[
"${pkgs.https-dns-proxy}/bin/https_dns_proxy"
(lib.getExe pkgs.https-dns-proxy)
"-a ${toString cfg.address}"
"-p ${toString cfg.port}"
"-l -"