caspervk/nixos
1
0
Fork 0
Code Activity Actions

proper systemd-resolved dns

Browse source
This commit is contained in:
Casper V. Kristensen 2024-04-05 01:07:48 +02:00
parent 80d1256b96
commit 704f98ca14
2 changed files with 23 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
modules/base/network.nix
View file

@ -1,4 +1,4 @@
{...}: { {config, ...}: {
# https://nixos.wiki/wiki/Networking # https://nixos.wiki/wiki/Networking
# https://nixos.wiki/wiki/Systemd-networkd # https://nixos.wiki/wiki/Systemd-networkd
@ -10,7 +10,7 @@
# Do not spam dmesg/journalctl with refused connections # Do not spam dmesg/journalctl with refused connections
logRefusedConnections = false; logRefusedConnections = false;
}; };
nameservers = ["127.0.0.53"]; # resolved stub resolver nameservers = ["159.69.4.2#dns.caspervk.net" "2a01:4f8:1c0c:70d1::1#dns.caspervk.net"];
search = ["caspervk.net"]; search = ["caspervk.net"];
}; };
@ -22,23 +22,33 @@
# systemd-resolved provides DNS resolution to local applications through # systemd-resolved provides DNS resolution to local applications through
# D-Bus, NSS, and a local stub resolver on 127.0.0.53. It implements caching # D-Bus, NSS, and a local stub resolver on 127.0.0.53. It implements caching
# and DNSSEC validation. We configure it to only, and always, use # and DNSSEC validation. We configure it to only, and always, use
# dns.caspervk.net over TLS. By the way, it's surprisingly hard to get the # dns.caspervk.net over TLS.
# system to always follow the custom DNS servers rather than the
# DHCP-provided ones. Check the traffic with:
# sudo tcpdump -n --interface=any '(udp port 53) or (tcp port 853)'
# https://nixos.wiki/wiki/Encrypted_DNS # https://nixos.wiki/wiki/Encrypted_DNS
# https://nixos.wiki/wiki/Systemd-resolved # https://nixos.wiki/wiki/Systemd-resolved
services.resolved = { services.resolved = {
enable = true; enable = true;
dnssec = "true"; dnsovertls = "true";
# TODO: DNSSEC support in systemd-resolved is considered experimental and
# incomplete. Upstream will validate for us anyway, and we trust it.
# https://wiki.archlinux.org/title/systemd-resolved#DNSSEC
dnssec = "false";
# Resolved falls back to DNS servers operated by American internet # Resolved falls back to DNS servers operated by American internet
# surveillance and adtech companies by default. No thanks, I'd rather have # surveillance and adtech companies by default. No thanks, I'd rather have
# no DNS at all. # no DNS at all.
fallbackDns = ["159.69.4.2#dns.caspervk.net" "2a01:4f8:1c0c:70d1::1#dns.caspervk.net"]; fallbackDns = config.networking.nameservers;
extraConfig = '' };
DNS=159.69.4.2#dns.caspervk.net 2a01:4f8:1c0c:70d1::1#dns.caspervk.net
DNSOverTLS=yes # It's surprisingly hard to get the system to always follow the custom DNS
''; # servers rather than the DHCP-provided ones. Force-ignore DHCP DNS on all
# interfaces. Check the traffic with:
# > sudo tcpdump -n --interface=any '(udp port 53) or (tcp port 853)'
# or
# > sudo resolvectl log-level debug
# > sudo journalctl -fu systemd-resolved.service
systemd.network.networks."00-no-dhcp-dns" = {
matchConfig.Name = "*";
dhcpV4Config.UseDNS = false;
dhcpV6Config.UseDNS = false;
}; };
# TCP BBR has significantly increased throughput and reduced latency. Note # TCP BBR has significantly increased throughput and reduced latency. Note

2
modules/desktop/network.nix
View file

@ -4,7 +4,7 @@
# Instead, we enable NetworkManager and the nmtui interface. # Instead, we enable NetworkManager and the nmtui interface.
networkmanager = { networkmanager = {
enable = true; enable = true;
dns = lib.mkForce "none"; dns = lib.mkForce "none"; # see modules/base/network.nix
}; };
}; };