blob: 85d6c362b466b11174f27f6fa025b996e746acac (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
{ config, lib, pkgs, ... }:
let
inherit (lib)
concatStringsSep
mkEnableOption mkIf mkOption types;
cfg = config.services.https-dns-proxy;
providers = {
cloudflare = {
ips = [ "1.1.1.1" "1.0.0.1" ];
url = "https://cloudflare-dns.com/dns-query";
};
google = {
ips = [ "8.8.8.8" "8.8.4.4" ];
url = "https://dns.google/dns-query";
};
quad9 = {
ips = [ "9.9.9.9" "149.112.112.112" ];
url = "https://dns.quad9.net/dns-query";
};
};
defaultProvider = "quad9";
providerCfg =
let
isCustom = cfg.provider.kind == "custom";
in
lib.concatStringsSep " " [
"-b"
(concatStringsSep "," (if isCustom then cfg.provider.ips else providers."${cfg.provider.kind}".ips))
"-r"
(if isCustom then cfg.provider.url else providers."${cfg.provider.kind}".url)
];
in
{
meta.maintainers = with lib.maintainers; [ peterhoeg ];
###### interface
options.services.https-dns-proxy = {
enable = mkEnableOption "https-dns-proxy daemon";
address = mkOption {
description = "The address on which to listen";
type = types.str;
default = "127.0.0.1";
};
port = mkOption {
description = "The port on which to listen";
type = types.port;
default = 5053;
};
provider = {
kind = mkOption {
description = ''
The upstream provider to use or custom in case you do not trust any of
the predefined providers or just want to use your own.
The default is ${defaultProvider} and there are privacy and security trade-offs
when using any upstream provider. Please consider that before using any
of them.
If you pick a custom provider, you will need to provide the bootstrap
IP addresses as well as the resolver https URL.
'';
type = types.enum ((builtins.attrNames providers) ++ [ "custom" ]);
default = defaultProvider;
};
ips = mkOption {
description = "The custom provider IPs";
type = types.listOf types.str;
};
url = mkOption {
description = "The custom provider URL";
type = types.str;
};
};
preferIPv4 = mkOption {
description = ''
https_dns_proxy will by default use IPv6 and fail if it is not available.
To play it safe, we choose IPv4.
'';
type = types.bool;
default = true;
};
extraArgs = mkOption {
description = "Additional arguments to pass to the process.";
type = types.listOf types.str;
default = [ "-v" ];
};
};
###### implementation
config = lib.mkIf cfg.enable {
systemd.services.https-dns-proxy = {
description = "DNS to DNS over HTTPS (DoH) proxy";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = rec {
Type = "exec";
DynamicUser = true;
ExecStart = lib.concatStringsSep " " (
[
"${pkgs.https-dns-proxy}/bin/https_dns_proxy"
"-a ${toString cfg.address}"
"-p ${toString cfg.port}"
"-l -"
providerCfg
]
++ lib.optional cfg.preferIPv4 "-4"
++ cfg.extraArgs
);
Restart = "on-failure";
};
};
};
}
|