diff options
| author | Graham Christensen <graham@grahamc.com> | 2018-09-29 20:51:11 -0400 |
|---|---|---|
| committer | Graham Christensen <graham@grahamc.com> | 2018-09-29 20:51:11 -0400 |
| commit | 8413f22bb39bd1c8adcf2ca9e6fcd4c59ddb3549 (patch) | |
| tree | 2fd2a5d5e07bc85ea97ae3c0cb13eb563860ad66 /nixos/modules/services/networking | |
| parent | 9622cd3b38ddbc7faa4cac2a48dbd70bd99570d0 (diff) | |
| download | nixlib-8413f22bb39bd1c8adcf2ca9e6fcd4c59ddb3549.tar nixlib-8413f22bb39bd1c8adcf2ca9e6fcd4c59ddb3549.tar.gz nixlib-8413f22bb39bd1c8adcf2ca9e6fcd4c59ddb3549.tar.bz2 nixlib-8413f22bb39bd1c8adcf2ca9e6fcd4c59ddb3549.tar.lz nixlib-8413f22bb39bd1c8adcf2ca9e6fcd4c59ddb3549.tar.xz nixlib-8413f22bb39bd1c8adcf2ca9e6fcd4c59ddb3549.tar.zst nixlib-8413f22bb39bd1c8adcf2ca9e6fcd4c59ddb3549.zip | |
docs: format
Diffstat (limited to 'nixos/modules/services/networking')
| -rw-r--r-- | nixos/modules/services/networking/dnscrypt-proxy.xml | 69 |
1 files changed, 33 insertions, 36 deletions
diff --git a/nixos/modules/services/networking/dnscrypt-proxy.xml b/nixos/modules/services/networking/dnscrypt-proxy.xml index a97579202523..f90eef69848c 100644 --- a/nixos/modules/services/networking/dnscrypt-proxy.xml +++ b/nixos/modules/services/networking/dnscrypt-proxy.xml @@ -3,67 +3,64 @@ xmlns:xi="http://www.w3.org/2001/XInclude" version="5.0" xml:id="sec-dnscrypt-proxy"> - - <title>DNSCrypt client proxy</title> + <title>DNSCrypt client proxy</title> + <para> + The DNSCrypt client proxy relays DNS queries to a DNSCrypt enabled upstream + resolver. The traffic between the client and the upstream resolver is + encrypted and authenticated, mitigating the risk of MITM attacks, DNS + poisoning attacks, and third-party snooping (assuming the upstream is + trustworthy). + </para> + <sect1 xml:id="sec-dnscrypt-proxy-configuration"> + <title>Basic configuration</title> <para> - The DNSCrypt client proxy relays DNS queries to a DNSCrypt enabled - upstream resolver. The traffic between the client and the upstream - resolver is encrypted and authenticated, mitigating the risk of MITM - attacks, DNS poisoning attacks, and third-party snooping (assuming the - upstream is trustworthy). - </para> - - <sect1 xml:id="sec-dnscrypt-proxy-configuration"><title>Basic configuration</title> - - <para> - To enable the client proxy, set - <programlisting> + To enable the client proxy, set +<programlisting> <xref linkend="opt-services.dnscrypt-proxy.enable"/> = true; </programlisting> </para> <para> - Enabling the client proxy does not alter the system nameserver; to - relay local queries, prepend <literal>127.0.0.1</literal> to - <option>networking.nameservers</option>. + Enabling the client proxy does not alter the system nameserver; to relay + local queries, prepend <literal>127.0.0.1</literal> to + <option>networking.nameservers</option>. </para> - - </sect1> - - <sect1 xml:id="sec-dnscrypt-proxy-forwarder"><title>As a forwarder for another DNS client</title> + </sect1> + <sect1 xml:id="sec-dnscrypt-proxy-forwarder"> + <title>As a forwarder for another DNS client</title> <para> - To run the DNSCrypt proxy client as a forwarder for another - DNS client, change the default proxy listening port to a - non-standard value and point the other client to it: - <programlisting> + To run the DNSCrypt proxy client as a forwarder for another DNS client, + change the default proxy listening port to a non-standard value and point + the other client to it: +<programlisting> <xref linkend="opt-services.dnscrypt-proxy.localPort"/> = 43; </programlisting> </para> - <sect2 xml:id="sec-dnscrypt-proxy-forwarder-dsnmasq"><title>dnsmasq</title> - <para> - <programlisting> + <sect2 xml:id="sec-dnscrypt-proxy-forwarder-dsnmasq"> + <title>dnsmasq</title> + <para> +<programlisting> { <xref linkend="opt-services.dnsmasq.enable"/> = true; <xref linkend="opt-services.dnsmasq.servers"/> = [ "127.0.0.1#43" ]; } </programlisting> - </para> + </para> </sect2> - <sect2 xml:id="sec-dnscrypt-proxy-forwarder-unbound"><title>unbound</title> - <para> - <programlisting> + <sect2 xml:id="sec-dnscrypt-proxy-forwarder-unbound"> + <title>unbound</title> + <para> +<programlisting> { <xref linkend="opt-services.unbound.enable"/> = true; <xref linkend="opt-services.unbound.forwardAddresses"/> = [ "127.0.0.1@43" ]; } </programlisting> - </para> + </para> </sect2> - - </sect1> - + </sect1> </chapter> |