caspervk/nixos
1
0
Fork 0
Code Actions Activity

replace systemd-resolved with unbound

Browse source 
Resolved seems to crash on some DNSSEC-enabled NXDOMANs??
This commit is contained in:
Casper V. Kristensen 2024-04-01 01:11:23 +02:00
parent 5108b95244
commit 42f0bcdfa3
1 changed files with 29 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
modules/base/network.nix
View file

@ -1,4 +1,4 @@
{...}: {
{lib, ...}: {
# https://nixos.wiki/wiki/Networking
# https://nixos.wiki/wiki/Systemd-networkd
@ -10,7 +10,7 @@
# Do not spam dmesg/journalctl with refused connections
logRefusedConnections = false;
};
nameservers = ["127.0.0.53"]; # resolved stub resolver
nameservers = ["127.0.0.1"]; # unbound
search = ["caspervk.net"];
};
@ -19,26 +19,34 @@
networking.useNetworkd = true;
systemd.network.enable = true;
# systemd-resolved provides DNS resolution to local applications through
# D-Bus, NSS, and a local stub resolver on 127.0.0.53. It implements caching
# and DNSSEC validation. We configure it to only, and always, use
# dns.caspervk.net over TLS. By the way, it's surprisingly hard to get the
# system to always follow the custom DNS servers rather than the
# DHCP-provided ones. Check the traffic with:
# sudo tcpdump -n --interface=any '(udp port 53) or (tcp port 853)'
# https://nixos.wiki/wiki/Encrypted_DNS
# https://nixos.wiki/wiki/Systemd-resolved
services.resolved = {
# Force-disable the systemd-resolved stub resolver, which is enabled
# automatically in some cases, such as when enabling systemd-networkd.
services.resolved.enable = lib.mkForce false;
# Unbound provides DNS resolution to local applications on 127.0.0.1. It
# enables caching and DNSSEC validation by default. We configure it to only,
# and always, use dns.caspervk.net over TLS.
# By the way, it's surprisingly hard to get the system to always follow the
# custom DNS servers rather than the DHCP-provided ones. Check the traffic
# with: sudo tcpdump -n --interface=any '(udp port 53) or (tcp port 853)'
# https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html
services.unbound = {
enable = true;
dnssec = "true";
# Resolved falls back to DNS servers operated by American internet
# surveillance and adtech companies by default. No thanks, I'd rather have
# no DNS at all.
fallbackDns = ["159.69.4.2#dns.caspervk.net" "2a01:4f8:1c0c:70d1::1#dns.caspervk.net"];
extraConfig = ''
DNS=159.69.4.2#dns.caspervk.net 2a01:4f8:1c0c:70d1::1#dns.caspervk.net
DNSOverTLS=yes
'';
settings = {
server = {
interface = ["127.0.0.1" "::1"];
};
forward-zone = [
{
name = ".";
forward-addr = [
"159.69.4.2#dns.caspervk.net"
"2a01:4f8:1c0c:70d1::1#dns.caspervk.net"
];
forward-tls-upstream = "yes";
}
];
};
};
# TCP BBR has significantly increased throughput and reduced latency. Note