{ flake, config, pkgs, lib, ... }: { age.secrets."unbound_control.key" = { file = "${flake.self}/secrets/unbound_control.key.age"; mode = "400"; owner = "unbound"; }; age.secrets."unbound_control.pem" = { file = "${flake.self}/secrets/unbound_control.pem.age"; mode = "400"; owner = "unbound"; }; age.secrets."unbound_server.key" = { file = "${flake.self}/secrets/unbound_server.key.age"; mode = "400"; owner = "unbound"; }; age.secrets."unbound_server.pem" = { file = "${flake.self}/secrets/unbound_server.pem.age"; mode = "400"; owner = "unbound"; }; networking.firewall.allowedUDPPorts = [ 53 ]; networking.firewall.allowedTCPPorts = [ 53 ]; services.resolved.enable = false; services.unbound = { enable = true; settings = { server = { include = [ "\"${pkgs.adlist.unbound-adblockStevenBlack}\"" ]; interface = [ "127.0.0.1" "::1" "192.168.178.2" "2a02:908:5b1:e3c0:2::" "10.0.1.2" "fd00:b12f:acab:1312:acab:2::" ]; access-control = [ "127.0.0.1/32 allow" # Allow from local network "192.168.178.0/24 allow" "2a02:908:5b1:e3c0::/64 allow" # Allow from wireguard "10.0.1.0/24 allow" "fd00:b12f:acab:1312::/64 allow" ]; local-zone = [ "\"b12f.io\" transparent" "\"local\" static" "\"box\" static" ]; local-data = [ "\"brwb8763f64a364.local. 10800 IN A 192.168.178.4\"" "\"droppie.b12f.io. 10800 IN A 10.0.1.3\"" "\"droppie.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:3::\"" "\"backup.b12f.io. 10800 IN A 10.0.1.3\"" "\"backup.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:3::\"" "\"pie.local. 10800 IN A 192.168.178.2\"" "\"pie.local. 10800 IN AAAA 2a02:908:5b1:e3c0:2::\"" "\"pie.b12f.io. 10800 IN A 10.0.1.2\"" "\"pie.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\"" "\"firefly.b12f.io. 10800 IN A 10.0.1.2\"" "\"firefly.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\"" "\"firefly-importer.b12f.io. 10800 IN A 10.0.1.2\"" "\"firefly-importer.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\"" "\"paperless.b12f.io. 10800 IN A 10.0.1.2\"" "\"paperless.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\"" "\"invoicing.b12f.io. 10800 IN A 10.0.1.2\"" "\"invoicing.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:2::\"" "\"vpn.b12f.io. 10800 IN A 128.140.109.213\"" "\"vpn.b12f.io. 10800 IN AAAA 2a01:4f8:c2c:b60::\"" "\"frikandel.b12f.io. 10800 IN A 10.0.1.7\"" "\"frikandel.b12f.io. 10800 IN AAAA fd00:b12f:acab:1312:acab:7::\"" "\"fritz.box. 10800 IN A 192.168.178.1\"" "\"fritz.box. 10800 IN AAAA fd00::3ea6:2fff:fe57:30b0\"" ]; tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt"; }; forward-zone = [ { name = "."; forward-addr = [ "193.110.81.0#dns0.eu" "2a0f:fc80::#dns0.eu" "185.253.5.0#dns0.eu" "2a0f:fc81::#dns0.eu" ]; forward-tls-upstream = "yes"; } ]; remote-control = { control-enable = true; control-key-file = config.age.secrets."unbound_control.key".path; server-cert-file = config.age.secrets."unbound_server.pem".path; server-key-file = config.age.secrets."unbound_server.key".path; control-cert-file = config.age.secrets."unbound_control.pem".path; }; }; }; }