aboutsummaryrefslogtreecommitdiff
path: root/modules/system/nixos/networking/resolved.nix
blob: 161471f09adc269ad532d4191738033a1a49ab52 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
{config, ...}: let
  hostname = config.networking.hostName;
  netname = "${hostname}net0";
in {
  networking.resolvconf.enable = false;

  services.dnsmasq = {
    enable = true;
    settings = {
      port = 5353;
      address = "/.${hostname}/127.0.0.1";
      bind-interfaces = true;
    };
  };

  systemd.network.netdevs."19-localnet" = {
    netdevConfig = {
      Name = netname;
      Kind = "dummy";
    };
  };

  systemd.network.networks."19-localnet" = {
    matchConfig = {
      Name = netname;
    };
    address = ["192.0.2.1/32"]; # BUG(?): a dummy network must have an address for systemd-networkd to attempt to use it to resolve dns queries (that took forever to debug)
    dns = ["127.0.0.1:5353"];
    domains = ["~${hostname}"];
    extraConfig = ''
      LinkLocalAddressing=no
      ConfigureWithoutCarrier=yes
      DNSSEC=no
      DNSOverTLS=no
    '';
  };

  networking.nameservers = [
    "9.9.9.9#dns.quad9.net"
    "149.112.112.112#dns.quad9.net"
  ];

  services.resolved = {
    enable = true;
    settings.Resolve = {
      DNSOverTLS = true;
      DNSSEC = "allow-downgrade";

      LLMNR = false;
      MulticastDNS = false;
    };
  };
}