{ flake, config, pkgs, lib, ... }: { age.secrets."unbound_control.key" = { file = "${flake.self}/secrets/unbound_control.key.age"; mode = "400"; owner = "unbound"; }; age.secrets."unbound_control.pem" = { file = "${flake.self}/secrets/unbound_control.pem.age"; mode = "400"; owner = "unbound"; }; age.secrets."unbound_server.key" = { file = "${flake.self}/secrets/unbound_server.key.age"; mode = "400"; owner = "unbound"; }; age.secrets."unbound_server.pem" = { file = "${flake.self}/secrets/unbound_server.pem.age"; mode = "400"; owner = "unbound"; }; networking.firewall.allowedUDPPorts = [53]; networking.firewall.allowedTCPPorts = [53]; services.resolved.enable = false; services.unbound = { enable = true; settings = { server = { include = [ "\"${pkgs.adlist.unbound-adblockStevenBlack}\"" ]; interface = [ "127.0.0.1" "::1" "192.168.178.2" "2a02:908:5b1:e3c0:2::" ]; access-control = [ "127.0.0.1/32 allow" # Allow from local network "192.168.178.0/24 allow" "2a02:908:5b1:e3c0::/64 allow" # Allow from wireguard "10.13.12.0/24 allow" "fd00:b12f:acab:1312::/64 allow" ]; local-zone = [ "\"local\" static" "\"box\" static" ]; local-data = [ "\"brwb8763f64a364.local. 10800 IN A 192.168.178.4\"" "\"pie.local. 10800 IN A 192.168.178.2\"" "\"pie.local. 10800 IN AAAA 2a02:908:5b1:e3c0:2::\"" "\"fritz.box. 10800 IN A 192.168.178.1\"" "\"fritz.box. 10800 IN AAAA fd00::3ea6:2fff:fe57:30b0\"" ]; tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt"; }; forward-zone = [ { name = "."; forward-addr = [ "10.13.12.7" "fd00:b12f:acab:1312:acab:7::" ]; } ]; remote-control = { control-enable = true; control-key-file = config.age.secrets."unbound_control.key".path; server-cert-file = config.age.secrets."unbound_server.pem".path; server-key-file = config.age.secrets."unbound_server.key".path; control-cert-file = config.age.secrets."unbound_control.pem".path; }; }; }; }