public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos: cosmetic improvements to dnscrypt-proxy service module

Browse Source 
Remove superflous whitespace & comments
This commit is contained in:
Joachim Fasting 2015-03-15 22:22:45 +01:00
parent a88a6bc676
commit 2e8bc2bd5c
1 changed files with 29 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
nixos/modules/services/networking/dnscrypt-proxy.nix
View File

@ -15,26 +15,19 @@ let
in in
{ {
##### interface
options = { options = {
services.dnscrypt-proxy = { services.dnscrypt-proxy = {
enable = mkOption { enable = mkOption {
default = false; default = false;
type = types.bool; type = types.bool;
description = '' description = ''
Enable dnscrypt-proxy. Enable dnscrypt-proxy. The proxy relays regular DNS queries to a
The proxy relays regular DNS queries to a DNSCrypt enabled DNSCrypt enabled upstream resolver. The traffic between the
upstream resolver. client and the upstream resolver is encrypted and authenticated,
The traffic between the client and the upstream resolver is which may mitigate the risk of MITM attacks and third-party
encrypted and authenticated, which may mitigate the risk of MITM snooping (assuming the upstream is trustworthy).
attacks and third-party snooping (assuming the upstream is
trustworthy).
''; '';
}; };
localAddress = mkOption { localAddress = mkOption {
default = "127.0.0.1"; default = "127.0.0.1";
type = types.string; type = types.string;
@ -42,7 +35,6 @@ in
Listen for DNS queries on this address. Listen for DNS queries on this address.
''; '';
}; };
port = mkOption { port = mkOption {
default = 53; default = 53;
type = types.int; type = types.int;
@ -50,7 +42,6 @@ in
Listen on this port. Listen on this port.
''; '';
}; };
resolverName = mkOption { resolverName = mkOption {
default = "opendns"; default = "opendns";
type = types.string; type = types.string;
@ -61,33 +52,22 @@ in
location). location).
''; '';
}; };
tcpOnly = mkOption { tcpOnly = mkOption {
default = false; default = false;
type = types.bool; type = types.bool;
description = '' description = ''
Force sending encrypted DNS queries to the upstream resolver Force sending encrypted DNS queries to the upstream resolver
over TCP instead of UDP (on port 443). over TCP instead of UDP (on port 443). Enabling this option may
Enabling this option may help circumvent filtering, but should help circumvent filtering, but should not be used otherwise.
not be used otherwise.
''; '';
}; };
}; };
}; };
##### implementation
config = mkIf cfg.enable { config = mkIf cfg.enable {
### AppArmor profile security.apparmor.profiles = mkIf apparmorEnabled (singleton (pkgs.writeText "apparmor-dnscrypt-proxy" ''
security.apparmor.profiles = mkIf apparmorEnabled [
(pkgs.writeText "apparmor-dnscrypt-proxy" ''
${dnscrypt-proxy}/bin/dnscrypt-proxy { ${dnscrypt-proxy}/bin/dnscrypt-proxy {
/dev/null rw, /dev/null rw,
/dev/urandom r, /dev/urandom r,
@ -112,8 +92,7 @@ in
${resolverListFile} r, ${resolverListFile} r,
} }
'') ''));
];
users.extraUsers.dnscrypt-proxy = { users.extraUsers.dnscrypt-proxy = {
uid = config.ids.uids.dnscrypt-proxy; uid = config.ids.uids.dnscrypt-proxy;
@ -121,26 +100,21 @@ in
}; };
users.extraGroups.dnscrypt-proxy.gid = config.ids.gids.dnscrypt-proxy; users.extraGroups.dnscrypt-proxy.gid = config.ids.gids.dnscrypt-proxy;
## derived from upstream dnscrypt-proxy.socket
systemd.sockets.dnscrypt-proxy = { systemd.sockets.dnscrypt-proxy = {
description = "dnscrypt-proxy listening socket"; description = "dnscrypt-proxy listening socket";
socketConfig = { socketConfig = {
ListenStream = "${cfg.localAddress}:${toString cfg.port}"; ListenStream = "${cfg.localAddress}:${toString cfg.port}";
ListenDatagram = "${cfg.localAddress}:${toString cfg.port}"; ListenDatagram = "${cfg.localAddress}:${toString cfg.port}";
}; };
wantedBy = [ "sockets.target" ]; wantedBy = [ "sockets.target" ];
}; };
# derived from upstream dnscrypt-proxy.service
systemd.services.dnscrypt-proxy = { systemd.services.dnscrypt-proxy = {
description = "dnscrypt-proxy daemon"; description = "dnscrypt-proxy daemon";
after = [ "network.target" ] ++ optional apparmorEnabled "apparmor.service"; after = [ "network.target" ] ++ optional apparmorEnabled "apparmor.service";
requires = [ "dnscrypt-proxy.socket "] ++ optional apparmorEnabled "apparmor.service"; requires = [ "dnscrypt-proxy.socket "] ++ optional apparmorEnabled "apparmor.service";
serviceConfig = { serviceConfig = {
Type = "simple"; Type = "simple";
## note: NonBlocking is required for socket activation to work
NonBlocking = "true"; NonBlocking = "true";
ExecStart = "${dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}"; ExecStart = "${dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}";
User = "dnscrypt-proxy"; User = "dnscrypt-proxy";
@ -149,6 +123,5 @@ in
PrivateDevices = true; PrivateDevices = true;
}; };
}; };
}; };
} }