136 lines
3.0 KiB
Nix
136 lines
3.0 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
primary-ip = "10.0.0.1";
|
|
dns-proxy-ip = "10.0.0.2";
|
|
|
|
in {
|
|
fudo.local-network = {
|
|
# FIXME: think about this -- actual network config?
|
|
enable = true;
|
|
# NOTE: requests go:
|
|
# - local bind instance
|
|
# - pi-hole
|
|
# - DoH resolver
|
|
dns-servers = [ primary-ip ];
|
|
gateway = primary-ip;
|
|
dhcp-interfaces = [ "intif0" ];
|
|
dns-serve-ips = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
|
|
recursive-resolver = "${primary-ip} port 5353";
|
|
server-ip = primary-ip;
|
|
domain = "rus.selby.ca";
|
|
};
|
|
|
|
networking = {
|
|
firewall = {
|
|
enable = true;
|
|
trustedInterfaces = [ "intif0" "docker0" ];
|
|
allowedTCPPorts = [ 22 ];
|
|
};
|
|
|
|
interfaces = {
|
|
enp2s0.useDHCP = false;
|
|
enp3s0.useDHCP = false;
|
|
enp4s0.useDHCP = false;
|
|
|
|
enp1s0.useDHCP = true;
|
|
|
|
intif0 = {
|
|
useDHCP = false;
|
|
ipv4.addresses = [
|
|
{
|
|
address = primary-ip;
|
|
prefixLength = 22;
|
|
}
|
|
{
|
|
address = dns-proxy-ip;
|
|
prefixLength = 32;
|
|
}
|
|
];
|
|
};
|
|
|
|
extif0 = { useDHCP = true; };
|
|
};
|
|
|
|
nat = {
|
|
enable = true;
|
|
externalInterface = "extif0";
|
|
internalInterfaces = [ "intif0" ];
|
|
};
|
|
};
|
|
|
|
fudo = {
|
|
garbage-collector = {
|
|
enable = true;
|
|
timing = "weekly";
|
|
};
|
|
|
|
secure-dns-proxy = {
|
|
enable = true;
|
|
listen-port = 53;
|
|
upstream-dns =
|
|
[ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
|
|
bootstrap-dns = "1.1.1.1";
|
|
listen-ips = [ dns-proxy-ip ];
|
|
};
|
|
};
|
|
|
|
# environment.systemPackages = with pkgs; [ dnsproxy ];
|
|
|
|
virtualization = {
|
|
docker = {
|
|
enable = true;
|
|
autoPrune.enable = true;
|
|
enableOnBoot = true;
|
|
};
|
|
};
|
|
|
|
docker-containers = {
|
|
pihole = {
|
|
image = "pihole/pihole:v5.1.2";
|
|
ports = [ "5353:53/tcp" "5353:53/udp" "3080:80/tcp" ];
|
|
environment = {
|
|
ServerIP = primary-ip;
|
|
VIRTUAL_HOST = "dns-hole.rus.selby.ca";
|
|
DNS1 = dns-proxy-ip;
|
|
};
|
|
volumes = [
|
|
"/srv/pihole/etc-pihole/:/etc/pihole/"
|
|
"/srv/pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/"
|
|
];
|
|
};
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
|
|
recommendedOptimisation = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedProxySettings = true;
|
|
|
|
virtualHosts = {
|
|
"dns-hole.rus.selby.ca" = {
|
|
serverAliases = [
|
|
"pihole.rus.selby.ca"
|
|
"hole.rus.selby.ca"
|
|
"pihole"
|
|
"dns-hole"
|
|
"hole"
|
|
];
|
|
|
|
locations."/" = {
|
|
proxyPass = "http://127.0.0.1:3080";
|
|
|
|
# extraConfig = ''
|
|
# proxy_set_header Host $host;
|
|
# proxy_set_header X-Real-IP $remote_addr;
|
|
# proxy_set_header X-Forwarded-By $server_addr:$server_port;
|
|
# proxy_set_header X-Forwarded-For $remote_addr;
|
|
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
# '';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|