diff options
author | Sandro <sandro.jaeckel@gmail.com> | 2024-03-24 21:52:09 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2024-03-24 21:52:09 +0100 |
commit | dabaa7ac657292ff80d7b738428e75544aea450d (patch) | |
tree | c4e2f965b27bff54640a8586416fe5a0185829b7 /nixos | |
parent | 19c4f7c66a74ffacc6cc2ab846db4641889c519d (diff) | |
parent | e035dab4fffc152878e73988272d099c3e6b13c1 (diff) |
Merge pull request #288033 from diogotcorreia/module-dnsproxy
nixos/dnsproxy: init module
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/doc/manual/release-notes/rl-2405.section.md | 2 | ||||
-rw-r--r-- | nixos/modules/module-list.nix | 1 | ||||
-rw-r--r-- | nixos/modules/services/networking/dnsproxy.nix | 106 |
3 files changed, 109 insertions, 0 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md index 19ff6f4485cd0..54f2874b9b35e 100644 --- a/nixos/doc/manual/release-notes/rl-2405.section.md +++ b/nixos/doc/manual/release-notes/rl-2405.section.md @@ -78,6 +78,8 @@ In addition to numerous new and upgraded packages, this release has the followin - [pretalx](https://github.com/pretalx/pretalx), a conference planning tool. Available as [services.pretalx](#opt-services.pretalx.enable). +- [dnsproxy](https://github.com/AdguardTeam/dnsproxy), a simple DNS proxy with DoH, DoT, DoQ and DNSCrypt support. Available as [services.dnsproxy](#opt-services.dnsproxy.enable). + - [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training. - [ollama](https://ollama.ai), server for running large language models locally. diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index d17e638a0883c..81cad0628d5e7 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -944,6 +944,7 @@ ./services/networking/dnscrypt-wrapper.nix ./services/networking/dnsdist.nix ./services/networking/dnsmasq.nix + ./services/networking/dnsproxy.nix ./services/networking/doh-proxy-rust.nix ./services/networking/ejabberd.nix ./services/networking/envoy.nix diff --git a/nixos/modules/services/networking/dnsproxy.nix b/nixos/modules/services/networking/dnsproxy.nix new file mode 100644 index 0000000000000..f0be74d7591f4 --- /dev/null +++ b/nixos/modules/services/networking/dnsproxy.nix @@ -0,0 +1,106 @@ +{ config, lib, pkgs, ... }: + +let + inherit (lib) + escapeShellArgs + getExe + lists + literalExpression + maintainers + mdDoc + mkEnableOption + mkIf + mkOption + mkPackageOption + types; + + cfg = config.services.dnsproxy; + + yaml = pkgs.formats.yaml { }; + configFile = yaml.generate "config.yaml" cfg.settings; + + finalFlags = (lists.optional (cfg.settings != { }) "--config-path=${configFile}") ++ cfg.flags; +in +{ + + options.services.dnsproxy = { + + enable = mkEnableOption (lib.mdDoc "dnsproxy"); + + package = mkPackageOption pkgs "dnsproxy" { }; + + settings = mkOption { + type = yaml.type; + default = { }; + example = literalExpression '' + { + bootstrap = [ + "8.8.8.8:53" + ]; + listen-addrs = [ + "0.0.0.0" + ]; + listen-ports = [ + 53 + ]; + upstream = [ + "1.1.1.1:53" + ]; + } + ''; + description = mdDoc '' + Contents of the `config.yaml` config file. + The `--config-path` argument will only be passed if this set is not empty. + + See <https://github.com/AdguardTeam/dnsproxy/blob/master/config.yaml.dist>. + ''; + }; + + flags = mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ "--upstream=1.1.1.1:53" ]; + description = lib.mdDoc '' + A list of extra command-line flags to pass to dnsproxy. For details on the + available options, see <https://github.com/AdguardTeam/dnsproxy#usage>. + Keep in mind that options passed through command-line flags override + config options. + ''; + }; + + }; + + config = mkIf cfg.enable { + systemd.services.dnsproxy = { + description = "Simple DNS proxy with DoH, DoT, DoQ and DNSCrypt support"; + after = [ "network.target" "nss-lookup.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${getExe cfg.package} ${escapeShellArgs finalFlags}"; + Restart = "always"; + RestartSec = 10; + DynamicUser = true; + + AmbientCapabilities = "CAP_NET_BIND_SERVICE"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + ProtectClock = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + RemoveIPC = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallErrorNumber = "EPERM"; + SystemCallFilter = [ "@system-service" "~@privileged @resources" ]; + }; + }; + }; + + meta.maintainers = with maintainers; [ diogotcorreia ]; + +} |