os/hosts/pie/unbound.nix

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

107 lines
2.8 KiB
Nix
Raw Normal View History

2023-11-13 14:48:05 +00:00
{
flake,
config,
pkgs,
lib,
...
}: {
age.secrets."unbound_control.key" = {
file = "${flake.self}/secrets/unbound_control.key.age";
mode = "400";
owner = "unbound";
};
age.secrets."unbound_control.pem" = {
file = "${flake.self}/secrets/unbound_control.pem.age";
mode = "400";
owner = "unbound";
};
age.secrets."unbound_server.key" = {
file = "${flake.self}/secrets/unbound_server.key.age";
mode = "400";
owner = "unbound";
};
age.secrets."unbound_server.pem" = {
file = "${flake.self}/secrets/unbound_server.pem.age";
mode = "400";
owner = "unbound";
};
2024-08-18 22:22:59 +00:00
networking.firewall.allowedUDPPorts = [53];
networking.firewall.allowedTCPPorts = [53];
services.resolved.enable = false;
2023-09-11 21:51:13 +00:00
services.unbound = {
enable = true;
settings = {
server = {
include = [
2023-09-12 20:07:05 +00:00
"\"${pkgs.adlist.unbound-adblockStevenBlack}\""
2023-09-11 21:51:13 +00:00
];
interface = [
2023-11-13 14:48:05 +00:00
"127.0.0.1"
"::1"
"192.168.178.2"
"fd00:b12f:acab:1312:acab:2::"
];
access-control = [
2023-11-13 14:48:05 +00:00
"127.0.0.1/32 allow"
# Allow from local network
"192.168.178.0/24 allow"
"fd00:b12f:acab:1312:acab::/64 allow"
# Allow from wireguard
"192.168.178.0/24 allow"
2023-11-13 14:48:05 +00:00
"fd00:b12f:acab:1312::/64 allow"
];
2023-09-11 21:51:13 +00:00
local-zone = [
"\"local\" static"
"\"box\" static"
];
local-data = [
2023-10-10 11:37:17 +00:00
"\"brwb8763f64a364.local. 10800 IN A 192.168.178.4\""
2023-09-11 21:51:13 +00:00
"\"pie.local. 10800 IN A 192.168.178.2\""
"\"pie.local. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\""
"\"pie.b12f.io. 10800 IN A 192.168.178.2\""
"\"firefly.b12f.io. 10800 IN A 192.168.178.2\""
"\"firefly-importer.b12f.io. 10800 IN A 192.168.178.2\""
"\"paperless.b12f.io. 10800 IN A 192.168.178.2\""
"\"invoicing.b12f.io. 10800 IN A 192.168.178.2\""
"\"auth.b12f.io. 10800 IN A 192.168.178.2\""
"\"droppie.b12f.io. 10800 IN A 192.168.178.3\""
"\"media.b12f.io. 10800 IN A 192.168.178.3\""
2023-10-19 22:37:08 +00:00
2023-09-11 21:51:13 +00:00
"\"fritz.box. 10800 IN A 192.168.178.1\""
"\"fritz.box. 10800 IN AAAA fd00::3ea6:2fff:fe57:30b0\""
2023-09-11 21:51:13 +00:00
];
2023-11-13 14:48:05 +00:00
tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt";
2023-09-11 21:51:13 +00:00
};
2023-09-11 21:51:13 +00:00
forward-zone = [
{
name = ".";
forward-addr = [
"192.168.178.7"
"fd00:b12f:acab:1312:acab:7::"
2023-09-11 21:51:13 +00:00
];
}
];
2023-11-12 20:45:02 +00:00
2023-11-13 14:48:05 +00:00
remote-control = {
control-enable = true;
control-key-file = config.age.secrets."unbound_control.key".path;
server-cert-file = config.age.secrets."unbound_server.pem".path;
server-key-file = config.age.secrets."unbound_server.key".path;
control-cert-file = config.age.secrets."unbound_control.pem".path;
};
2023-09-11 21:51:13 +00:00
};
};
}