From f9f970d8364c220c9357f4791fdca2ced72fa804 Mon Sep 17 00:00:00 2001 From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com> Date: Tue, 23 Jun 2026 20:50:07 -0500 Subject: no more mkCaddyConfig, manually specify ports, no more manual /etc/hosts, started using dnsmasq instead. all works! --- modules/services/nixos/agate.nix | 22 ------ modules/services/nixos/btopweb.nix | 9 +-- modules/services/nixos/caddy.nix | 11 +-- modules/services/nixos/cgit/default.nix | 5 +- modules/services/nixos/copyparty.nix | 100 -------------------------- modules/services/nixos/default.nix | 5 +- modules/services/nixos/forgejo.nix | 65 ----------------- modules/services/nixos/ganyupload/AGENTS.md | 65 ----------------- modules/services/nixos/ganyupload/default.nix | 9 ++- modules/services/nixos/goaccess.nix | 71 +++--------------- modules/services/nixos/jta/default.nix | 10 ++- modules/services/nixos/mkCaddyCfg.nix | 30 -------- modules/services/nixos/mopidy.nix | 41 ----------- modules/services/nixos/qbittorrent.nix | 10 +-- modules/services/options.nix | 43 +---------- modules/system/nixos/networking/resolved.nix | 38 +++++++++- 16 files changed, 72 insertions(+), 462 deletions(-) delete mode 100644 modules/services/nixos/agate.nix delete mode 100644 modules/services/nixos/copyparty.nix delete mode 100644 modules/services/nixos/forgejo.nix delete mode 100644 modules/services/nixos/ganyupload/AGENTS.md delete mode 100644 modules/services/nixos/mkCaddyCfg.nix delete mode 100644 modules/services/nixos/mopidy.nix (limited to 'modules') diff --git a/modules/services/nixos/agate.nix b/modules/services/nixos/agate.nix deleted file mode 100644 index f1593e6..0000000 --- a/modules/services/nixos/agate.nix +++ /dev/null @@ -1,22 +0,0 @@ -{ - lib, - config, - ... -}: let - cfg = config.collinux.services.agate; -in - lib.mkIf cfg.enable { - services.agate = { - enable = true; - addresses = [ - "0.0.0.0:1965" - ]; - hostnames = [cfg.publicUrl]; - - onlyTls_1_3 = true; - - contentDir = "/media/public/gmi"; - }; - - networking.firewall.allowedTCPPorts = [1965]; - } diff --git a/modules/services/nixos/btopweb.nix b/modules/services/nixos/btopweb.nix index d27ede1..d8f4598 100644 --- a/modules/services/nixos/btopweb.nix +++ b/modules/services/nixos/btopweb.nix @@ -15,10 +15,6 @@ proc_colors = true ''; in { - imports = [ - (import ./mkCaddyCfg.nix cfg) - ]; - config = lib.mkIf cfg.enable { users.groups."btopweb" = {}; users.users."btopweb" = { @@ -40,5 +36,10 @@ in { ExecStart = ''${pkgs.ttyd}/bin/ttyd -W -i ${cfg.listenAddr} -p ${toString cfg.port} -t renderType=canvas -t fontSize=16 ${pkgs.btop}/bin/btop -c ${btopSettings}''; }; }; + + services.caddy.virtualHosts."btop.ganymede".extraConfig = '' + tls internal + reverse_proxy 127.0.0.1:${toString cfg.port} + ''; }; } diff --git a/modules/services/nixos/caddy.nix b/modules/services/nixos/caddy.nix index df37e9a..b61a3c6 100644 --- a/modules/services/nixos/caddy.nix +++ b/modules/services/nixos/caddy.nix @@ -7,17 +7,10 @@ cfg = config.collinux.services.caddy; in lib.mkIf cfg.enable { + networking.firewall.allowedTCPPorts = [80 443]; + environment.systemPackages = with pkgs; [nss.tools]; # required for caddy https stuff services.caddy = { - # just always install this. No harm in installing an extra plugin - package = pkgs.caddy.withPlugins { - plugins = [ - "github.com/tailscale/caddy-tailscale@v0.0.0-20251204171825-f070d146dd61" - ]; - hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus="; - }; enable = true; environmentFile = cfg.envFile; }; - networking.firewall.allowedTCPPorts = [80 443]; - environment.systemPackages = with pkgs; [nss.tools]; # required for caddy https stuff } diff --git a/modules/services/nixos/cgit/default.nix b/modules/services/nixos/cgit/default.nix index 3c225ee..2a78607 100644 --- a/modules/services/nixos/cgit/default.nix +++ b/modules/services/nixos/cgit/default.nix @@ -20,7 +20,6 @@ }; in { imports = [ - (import ../mkCaddyCfg.nix cfg) ./gitShellCommands.nix ]; @@ -82,7 +81,9 @@ in { }; }; - collinux.services.cgit.manualCaddyConfig = '' + services.caddy.virtualHosts."git.ganymede".extraConfig = '' + tls internal + @assets path /cgit.css /cgit.js /favicon.svg /robots.txt handle @assets { root * ${custom_cgit} diff --git a/modules/services/nixos/copyparty.nix b/modules/services/nixos/copyparty.nix deleted file mode 100644 index 0e607e2..0000000 --- a/modules/services/nixos/copyparty.nix +++ /dev/null @@ -1,100 +0,0 @@ -{ - config, - lib, - inputs, - ... -}: let - cfg = config.collinux.services.copyparty; -in { - imports = [ - inputs.copyparty.nixosModules.default - (import ./mkCaddyCfg.nix cfg) - ]; - - config = lib.mkIf cfg.enable { - users.groups."fileserver".members = [config.collinux.user.name]; - - networking.firewall.allowedTCPPorts = lib.optional (cfg.listenAddr == "0.0.0.0") cfg.port; - - services.copyparty = { - enable = true; - - user = "copyparty"; - group = "fileserver"; - - settings = { - i = cfg.listenAddr; - p = [cfg.port]; - rproxy = "1"; - tls = false; - - name = "files@ganymede"; - usernames = true; - no-robots = true; - chmod-d = "775"; - - e2dsa = true; - hist = "/var/lib/copyparty/cache"; - - # customization - spinner = ",padding:0;border-radius:9em;border:.2em solid #444;border-top:.2em solid #fc0"; # no more tree - ui-nolbar = true; - ui-norepl = true; - }; - - accounts = - cfg.users - |> builtins.mapAttrs (k: v: { - inherit (v) passwordFile; - }); - - groups.admin = cfg.users |> lib.attrsets.filterAttrs (k: v: v.isAdmin == true) |> builtins.attrNames; - - volumes = lib.mkMerge ([ - { - "/" = { - path = "/media/public"; - access = { - r = "*"; - A = "@admin"; - }; - }; - - "/public" = { - path = "/var/empty"; - access.r = "*"; - }; - - "/library" = { - path = "/media/library"; - access = { - g = "*"; - r = "@acct"; - A = "@admin"; - }; - flags = { - fk = 6; - dks = 6; - e2ts = true; # enable music indexing - }; - }; - } - ] - ++ lib.lists.flatten (cfg.users - |> lib.attrsets.mapAttrsToList (k: v: [ - { - "/${k}" = { - path = "/media/${k}"; - access.rwd = k; - }; - } - (lib.optionalAttrs v.hasPublicDir { - "/public/${k}" = { - path = "/media/${k}/public"; - access.r = "*"; - }; - }) - ]))); - }; - }; -} diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix index 13cdcf4..68ed3ee 100644 --- a/modules/services/nixos/default.nix +++ b/modules/services/nixos/default.nix @@ -3,17 +3,14 @@ ./caddy.nix ./openssh.nix - ./forgejo.nix ./goaccess.nix ./btopweb.nix ./cgit ./ganyupload - ./jta - ./agate.nix + ./minecraft.nix ./ngircd.nix - ./copyparty.nix ./qbittorrent.nix ]; } diff --git a/modules/services/nixos/forgejo.nix b/modules/services/nixos/forgejo.nix deleted file mode 100644 index 9176523..0000000 --- a/modules/services/nixos/forgejo.nix +++ /dev/null @@ -1,65 +0,0 @@ -{ - lib, - pkgs, - config, - ... -}: let - cfg = config.collinux.services.forgejo; -in { - imports = [ - (import ./mkCaddyCfg.nix cfg) - ]; - - config = lib.mkIf cfg.enable { - services.forgejo = { - enable = true; - database.type = "sqlite3"; - settings = { - server = { - PROTOCOL = "http"; - ROOT_URL = "https://${ - if cfg.publicUrl != null - then cfg.publicUrl - else if cfg.privateUrl != null - then cfg.privateUrl - else "" - }"; - - HTTP_ADDR = cfg.listenAddr; - HTTP_PORT = cfg.port; - - OFFLINE_MODE = true; # don't use cdns or gravatar - - # ssh - START_SSH_SERVER = false; # use system ssh server - SSH_USER = "forgejo"; - SSH_DOMAIN = "williamsfam.us.com"; - SSH_PORT = 22; - }; - service = { - DISABLE_REGISTRATION = true; - ENABLE_REVERSE_PROXY_AUTHENTICATION = false; - }; - repository = { - # disable stuff - DISABLE_MIGRATIONS = true; - DISABLE_STARS = true; - DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true; - }; - }; - }; - - systemd.services."forgejo" = { - after = lib.mkAfter ["network-online.target"]; - wants = lib.mkAfter ["network-online.target"]; - - # Ensure users (https://wiki.nixos.org/wiki/Forgejo#Ensure_users) - preStart = let - adminCmd = "${lib.getExe pkgs.forgejo} admin user"; - passwd = config.collinux.secrets."collin-forgejo-password"; - in '' - ${adminCmd} create --admin --email "collin@ganymede" --username collin --password "$(tr -d '\n' < ${passwd.path})" || true - ''; - }; - }; -} diff --git a/modules/services/nixos/ganyupload/AGENTS.md b/modules/services/nixos/ganyupload/AGENTS.md deleted file mode 100644 index c4d9192..0000000 --- a/modules/services/nixos/ganyupload/AGENTS.md +++ /dev/null @@ -1,65 +0,0 @@ -# Ganyupload - Agent Instructions - -## Quick Context -- Simple Go file upload service using standard `net/http`. -- Single `main.go`, two Nix files (`default.nix`, `pkg.nix`), one README. -- Embedded README is served on GET /. -- Used as a NixOS module: `collinux.services.ganyupload` enables it, configures port and upload directory via systemd environment. - -## How to Build and Test - -### Build -```bash -nix build -``` - -Alternatively, from the repo root: -```bash -nix build .#nixosConfigurations..config.system.build.toplevel -``` - -### Test -No dedicated test file. Verify locally by running with environment variables: -```bash -PORT=8080 UPLOAD_DIR=/tmp/upload go run main.go -``` - -Then test uploads: -```bash -curl -X PUT --data-binary @file.txt http://localhost:8080/file.txt -curl http://localhost:8080/ # Read embedded README -``` - -## Code Style - -**Go:** -- Keep `main.go` clean; use `gofmt -w .`. -- Match existing error handling (early return, `log.Printf` for warnings, `log.Fatalf` for fatal errors). -- Path traversal prevention is critical; do not weaken `filepath.Clean` + `..` prefix checks. - -**Nix:** -- Follow `/home/collin/nixos/AGENTS.md` conventions (2-space indent, common arg pattern, `lib.mkIf` for gating). -- `default.nix` imports `mkCaddyCfg.nix` to integrate with Caddy reverse proxy; do not remove that import. - -## Key Implementation Notes - -1. **Embedded README:** The README file is embedded at compile time using `//go:embed README`. If you update README, rebuild to reflect changes. -2. **Environment Variables:** - - `UPLOAD_DIR`: Defaults to `.`, overridden by systemd service to `/media/ganyupload`. - - `PORT`: Defaults to `8080`, set by systemd to the configured `cfg.port`. -3. **NixOS Integration:** The service runs as user/group `ganyupload` with home `/var/lib/ganyupload`. Ensure the service has write permission to `UPLOAD_DIR`. -4. **Caddy Integration:** `default.nix` imports `mkCaddyCfg.nix` to configure Caddy as a reverse proxy. Changes to hostname or port must be reflected in both Nix config and the Caddy rule. - -## Common Tasks - -- **Update Go code:** Edit `main.go`, test locally, then nix build to verify. -- **Change upload directory or port:** Update `default.nix` (systemd environment or `cfg.port`). -- **Update README:** Edit README file, then rebuild (`nix build`) so the embedded version updates. -- **Debug NixOS module:** Check `/etc/systemd/system/ganyupload.service` for actual service config after rebuild. - -## Validation - -After changes: -1. Run `nix build` from this directory or `nix build .#nixosConfigurations..config.system.build.toplevel` from repo root. -2. If applicable, test via `PORT=8080 UPLOAD_DIR=/tmp go run main.go`. -3. Verify no Nix lint issues (use repo-level `yo test` or `nix run nixpkgs#alejandra -- .` for formatting). diff --git a/modules/services/nixos/ganyupload/default.nix b/modules/services/nixos/ganyupload/default.nix index 0138100..2ec704b 100644 --- a/modules/services/nixos/ganyupload/default.nix +++ b/modules/services/nixos/ganyupload/default.nix @@ -5,13 +5,8 @@ ... }: let cfg = config.collinux.services.ganyupload; - package = pkgs.callPackage ./pkg.nix {}; in { - imports = [ - (import ../mkCaddyCfg.nix cfg) - ]; - config = lib.mkIf cfg.enable { users.groups."ganyupload" = {}; users.users."ganyupload" = { @@ -43,5 +38,9 @@ in { wantedBy = ["multi-user.target"]; }; + + services.caddy.virtualHosts."upld.williamsfam.us.com".extraConfig = '' + reverse_proxy 127.0.0.1:${toString cfg.port} + ''; }; } diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix index 703e263..b77f370 100644 --- a/modules/services/nixos/goaccess.nix +++ b/modules/services/nixos/goaccess.nix @@ -14,13 +14,8 @@ log-file = "/var/log/caddy/access-williamsfam.us.com.log"; geoip-database = inputs.geolite-db; - ws-url = - if cfg.publicUrl != null - then "wss://${cfg.publicUrl}:443/ws" - else if cfg.privateUrl != null - then "wss://${cfg.privateUrl}:443/ws" - else null; - port = 7890; + ws-url = "wss://stats.ganymede:443/ws"; + port = cfg.port; addr = cfg.listenAddr; real-time-html = "true"; @@ -42,10 +37,6 @@ settingsFile = pkgs.writeText "goaccess.conf" (settings |> builtins.mapAttrs (k: v: "${k} ${toString v}") |> builtins.attrValues |> lib.concatStringsSep "\n"); in { - imports = [ - (import ./mkCaddyCfg.nix cfg) - ]; - config = lib.mkIf cfg.enable { users.groups."goaccess" = {}; users.users."goaccess" = { @@ -59,75 +50,35 @@ in { restartIfChanged = true; wants = ["network-online.target" "caddy.service"]; after = ["network-online.target" "caddy.service"]; + wantedBy = ["multi-user.target"]; serviceConfig = { User = "goaccess"; Type = "simple"; + ReadWritePaths = "/var/www/goaccess"; WorkingDirectory = "/var/www/goaccess"; ExecStart = "${pkgs.goaccess}/bin/goaccess -p ${settingsFile}"; - AmbientCapabilities = []; - CapabilityBoundingSet = [ - "~CAP_RAWIO" - "~CAP_MKNOD" - "~CAP_AUDIT_CONTROL" - "~CAP_AUDIT_READ" - "~CAP_AUDIT_WRITE" - "~CAP_SYS_BOOT" - "~CAP_SYS_TIME" - "~CAP_SYS_MODULE" - "~CAP_SYS_PACCT" - "~CAP_LEASE" - "~CAP_LINUX_IMMUTABLE" - "~CAP_IPC_LOCK" - "~CAP_BLOCK_SUSPEND" - "~CAP_WAKE_ALARM" - "~CAP_SYS_TTY_CONFIG" - "~CAP_MAC_ADMIN" - "~CAP_MAC_OVERRIDE" - "~CAP_NET_ADMIN" - "~CAP_NET_BROADCAST" - "~CAP_NET_RAW" - "~CAP_SYS_ADMIN" - "~CAP_SYS_PTRACE" - "~CAP_SYSLOG" - ]; - DevicePolicy = "closed"; - KeyringMode = "private"; - LockPersonality = true; NoNewPrivileges = true; - PrivateDevices = true; - PrivateMounts = true; PrivateTmp = true; - ProtectClock = true; - ProtectControlGroups = true; + ProtectSystem = "strict"; ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; ProtectKernelTunables = true; - ProtectSystem = "full"; - RemoveIPC = true; - RestrictAddressFamilies = [ - "AF_UNIX" - "AF_INET" - "AF_INET6" - ]; - RestrictNamespaces = true; - RestrictRealtime = true; + ProtectKernelModules = true; + ProtectControlGroups = true; }; - - wantedBy = ["multi-user.target"]; }; systemd.tmpfiles.rules = ["d /var/www/goaccess/ 755 goaccess goaccess"]; - collinux.services.goaccess.manualCaddyConfig = '' + services.caddy.virtualHosts."stats.ganymede".extraConfig = '' + tls internal + root * /var/www/goaccess file_server - reverse_proxy /ws 127.0.0.1:7890 + reverse_proxy /ws 127.0.0.1:${toString cfg.port} ''; }; } diff --git a/modules/services/nixos/jta/default.nix b/modules/services/nixos/jta/default.nix index d2908bc..31f5bbd 100644 --- a/modules/services/nixos/jta/default.nix +++ b/modules/services/nixos/jta/default.nix @@ -5,13 +5,8 @@ ... }: let cfg = config.collinux.services.jta; - package = pkgs.callPackage ./pkg.nix {}; in { - imports = [ - (import ../mkCaddyCfg.nix cfg) - ]; - config = lib.mkIf cfg.enable { users.groups."jta" = {}; users.users."jta" = { @@ -25,7 +20,6 @@ in { }; systemd.services."jta" = { - description = "Juksere trives aldri, kids"; restartIfChanged = true; wants = ["network-online.target" "caddy.service"]; after = ["network-online.target" "caddy.service"]; @@ -46,5 +40,9 @@ in { wantedBy = ["multi-user.target"]; }; + + services.caddy.virtualHosts."jta.williamsfam.us.com".extraConfig = '' + reverse_proxy 127.0.0.1:${toString cfg.port} + ''; }; } diff --git a/modules/services/nixos/mkCaddyCfg.nix b/modules/services/nixos/mkCaddyCfg.nix deleted file mode 100644 index 02b9a0a..0000000 --- a/modules/services/nixos/mkCaddyCfg.nix +++ /dev/null @@ -1,30 +0,0 @@ -cfg: let - caddyConfig = - if cfg ? reverseProxy && cfg.reverseProxy == true - then ''reverse_proxy ${cfg.listenAddr}:${toString cfg.port}'' - else cfg.manualCaddyConfig; -in { - networking.extraHosts = - if cfg.privateUrl != null - then "127.0.0.1 ${cfg.privateUrl}" - else ""; - - services.caddy.virtualHosts = - ( - if cfg.publicUrl != null - then { - ${cfg.publicUrl}.extraConfig = caddyConfig; - } - else {} - ) - // ( - if cfg.privateUrl != null - then { - "${cfg.privateUrl}".extraConfig = '' - tls internal - ${caddyConfig} - ''; - } - else {} - ); -} diff --git a/modules/services/nixos/mopidy.nix b/modules/services/nixos/mopidy.nix deleted file mode 100644 index 844a387..0000000 --- a/modules/services/nixos/mopidy.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ - pkgs, - config, - lib, - ... -}: let - cfg = config.collinux.services.mopidy; -in { - config = lib.mkIf cfg.enable { - services.mopidy = { - enable = true; - extensionPackages = with pkgs; [mopidy-youtube mopidy-mpd mopidy-local]; - settings = { - mpd = { - enabled = true; - hostname = "0.0.0.0"; - port = cfg.port; - }; - - # disable default plugins - file.enabled = false; - http.enabled = false; # only use mpd - - local = { - enabled = true; - media_dir = "/media/library/music"; - }; - - youtube = { - enabled = true; - allow_cache = true; - musicapi_enabled = true; - youtube_dl_package = "yt_dlp"; - autoplay_enabled = true; - strict_autoplay = false; - search_results = 15; - }; - }; - }; - }; -} diff --git a/modules/services/nixos/qbittorrent.nix b/modules/services/nixos/qbittorrent.nix index 13bf114..bb0fab7 100644 --- a/modules/services/nixos/qbittorrent.nix +++ b/modules/services/nixos/qbittorrent.nix @@ -5,10 +5,6 @@ }: let cfg = config.collinux.services.qbittorrent; in { - imports = [ - (import ./mkCaddyCfg.nix cfg) - ]; - config = lib.mkIf cfg.enable { users.users."qbittorrent" = { uid = 985; @@ -23,7 +19,11 @@ in { webuiPort = cfg.port; torrentingPort = 49252; }; - systemd.services.qbittorrent.serviceConfig.PrivateUsers = lib.mkForce false; + + services.caddy.virtualHosts."bittorrent.ganymede".extraConfig = '' + tls internal + reverse_proxy ${toString cfg.port} + ''; }; } diff --git a/modules/services/options.nix b/modules/services/options.nix index 1888f5b..1cb1019 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -9,7 +9,6 @@ # A helper function to generate the submodule webserviceOptions = { service_name, - default_port ? null, reverse_proxy ? true, }: { @@ -41,7 +40,6 @@ port = mkOption { description = "The port on which ${service_name} will listen for incomming connections"; type = lib.types.port; - default = default_port; }; } else { @@ -78,7 +76,7 @@ in { public = mkEnableOption "whether to make this service accessable over the internet"; }; ngircd = { - enable = mkEnableOption "ncircd IRC server"; + enable = mkEnableOption "ngircd IRC server"; port = mkOption { type = lib.types.port; default = 6667; @@ -86,33 +84,21 @@ in { public = mkEnableOption "whether to make this service accessable over the internet"; }; - agate = { - enable = mkEnableOption "Agate Gemini Protocol Server"; - publicUrl = mkOption { - description = "domain to run this gemini server on"; - type = lib.types.str; - }; - }; jta = webserviceOptions { service_name = "jta"; - default_port = 8072; }; ganyupload = webserviceOptions { service_name = "ganyupload"; - default_port = 8073; }; forgejo = webserviceOptions { service_name = "forgejo"; - default_port = 8010; }; btopweb = webserviceOptions { service_name = "btopweb"; - default_port = 8017; }; goaccess = webserviceOptions { service_name = "goaccess"; - reverse_proxy = false; }; cgit = webserviceOptions { service_name = "cgit"; @@ -120,34 +106,7 @@ in { }; qbittorrent = webserviceOptions { service_name = "qbittorrent"; - default_port = 8076; }; - copyparty = - (webserviceOptions { - service_name = "copyparty"; - default_port = 8099; - }) - // { - users = mkOption { - description = "List of users to configure on the copyparty server"; - type = lib.types.attrsOf (lib.types.submodule ({config, ...}: { - options = { - name = mkOption { - type = lib.types.str; - default = config._module.args.name; - internal = true; - }; - isAdmin = mkEnableOption "whether this user is an admin"; - passwordFile = mkOption { - description = "Absolute path to a file containing the password for this user"; - type = lib.types.str; - example = "/run/secrets.d/copyparty-passwd"; - }; - hasPublicDir = mkEnableOption "give this user a world-readable directory at /public/"; - }; - })); - }; - }; caddy = { enable = mkEnableOption "caddy https server"; diff --git a/modules/system/nixos/networking/resolved.nix b/modules/system/nixos/networking/resolved.nix index ba2ca76..161471f 100644 --- a/modules/system/nixos/networking/resolved.nix +++ b/modules/system/nixos/networking/resolved.nix @@ -1,6 +1,40 @@ -{ +{config, ...}: let + hostname = config.networking.hostName; + netname = "${hostname}net0"; +in { networking.resolvconf.enable = false; + services.dnsmasq = { + enable = true; + settings = { + port = 5353; + address = "/.${hostname}/127.0.0.1"; + bind-interfaces = true; + }; + }; + + systemd.network.netdevs."19-localnet" = { + netdevConfig = { + Name = netname; + Kind = "dummy"; + }; + }; + + systemd.network.networks."19-localnet" = { + matchConfig = { + Name = netname; + }; + address = ["192.0.2.1/32"]; # BUG(?): a dummy network must have an address for systemd-networkd to attempt to use it to resolve dns queries (that took forever to debug) + dns = ["127.0.0.1:5353"]; + domains = ["~${hostname}"]; + extraConfig = '' + LinkLocalAddressing=no + ConfigureWithoutCarrier=yes + DNSSEC=no + DNSOverTLS=no + ''; + }; + networking.nameservers = [ "9.9.9.9#dns.quad9.net" "149.112.112.112#dns.quad9.net" @@ -10,7 +44,7 @@ enable = true; settings.Resolve = { DNSOverTLS = true; - DNSSEC = true; + DNSSEC = "allow-downgrade"; LLMNR = false; MulticastDNS = false; -- cgit v1.3.1