work on network configuration from jupiter

3 files changed, 26 insertions, 15 deletions

diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
index 076dc33..6e991fa 100644
--- a/modules/services/nixos/networking/default.nix
+++ b/modules/services/nixos/networking/default.nix
@@ -8,13 +8,15 @@
   # DNS
   services.resolved = {
     enable = true;
+    llmnr = "false";
     dnsovertls = "opportunistic";
-    domains = [
+    fallbackDns = [
       "9.9.9.9#dns.quad9.net"
       "149.112.112.112#dns.quad9.net"
-      "1.1.1.1"
-      "1.0.0.1"
     ];
+    extraConfig = ''
+      MulticastDNS=no
+    '';
   };
   networking.resolvconf.enable = false;
 
diff --git a/modules/services/nixos/networking/networkmanager.nix b/modules/services/nixos/networking/networkmanager.nix
index f22f922..46edf96 100644
--- a/modules/services/nixos/networking/networkmanager.nix
+++ b/modules/services/nixos/networking/networkmanager.nix
@@ -3,13 +3,21 @@
   config,
   ...
 }: let
-  cfg = config.collinux.services.networking;
+  cfg = config.collinux.services.networking.networkmanager;
 in
-  lib.mkIf (cfg.enable && cfg.networkmanager.enable) {
+  lib.mkIf cfg.enable {
     networking = {
-      nameservers = ["1.1.1.1" "1.0.0.1"];
-      enableIPv6 = false;
+      networkmanager = {
+        dns = "systemd-resolved";
+        dhcp = "internal";
+        enable = true;
+      };
 
-      networkmanager.enable = true;
+      dhcpcd.enable = false;
+      useNetworkd = false;
     };
+
+    systemd.network.enable = false;
+
+    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=true";
   }
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
index 196dab5..eb77cf6 100644
--- a/modules/services/nixos/selfhost/adguard.nix
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -21,14 +21,15 @@ in
           };
           users = []; # disable auth (only accessable over tailscale anyway)
           dns = {
-            bind_hosts = [
-              (
-                if config.collinux.services.networking.tailscale.enable
-                then tailscaleIP
-                else "0.0.0.0"
-              )
+            bind_hosts =
+              [
+                "127.0.0.1"
+              ]
+              ++ lib.optional config.collinux.services.networking.tailscale.enable tailscaleIP;
+            upstream_dns = [
+              "https://dns.quad9.net/dns-query"
             ];
-            upstream_dns = ["1.1.1.1"];
+            enable_dnssec = true;
           };
           tls.enabled = false;
           dhcp.enabled = false;