networkmanager: use resolved and set dns over tls

profiles/core.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, unstablePkgs, ... }:
 let inherit (lib) fileContents;
 
 in {
@@ -119,6 +119,8 @@ in {
 
   };
 
+  systemd.package = unstablePkgs.systemd;
+
   services.earlyoom.enable = true;
 
   users.mutableUsers = false;

profiles/networkmanager/default.nix

@@ -1,7 +1,23 @@
 { ... }: {
-  imports = [ ../misc ];
+  imports = [ ../misc/adblocking.nix ];
+
+  networking.networkmanager = {
+    enable = true;
+    wifi.backend = "iwd";
+  };
+
+  networking.nameservers =
+    [ "1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one" ];
 
-  networking.networkmanager.enable = true;
-  networking.networkmanager.wifi.backend = "iwd";
   networking.wireless.iwd.enable = true;
+
+  services.resolved = {
+    enable = true;
+    dnssec = "true";
+    fallbackDns = [ "1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one" ];
+    extraConfig = ''
+      DNSOverTLS=yes
+    '';
+  };
+
 }