Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge remote-tracking branch 'ni/master'

Browse Source
This commit is contained in:
lassulus 2023-07-03 14:15:56 +02:00
commit 0e6c1e2d94
2 changed files with 96 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

84
tv/3modules/unbound.nix Normal file
View File

@ -0,0 +1,84 @@
{ config, lib, pkgs, ... }: {
options.tv.unbound = {
enable = lib.mkEnableOption "tv.unbound";
DoH.enable = lib.mkEnableOption "tv.unbound.DoH";
DoT.enable = lib.mkEnableOption "tv.unbound.DoT";
host = lib.mkOption {
type = lib.types.str;
};
useACMEHost = lib.mkOption {
type = lib.types.str;
};
};
imports = let
cfg = config.tv.unbound;
in [
(lib.mkIf cfg.enable {
services.unbound = {
enable = true;
settings.server = {
access-control = [
"::/0 allow"
"0.0.0.0/0 allow"
];
interface = [
"127.0.0.1@53"
"retiolum@53"
"wiregrill@53"
];
prefetch = true;
prefetch-key = true;
};
};
# Since we use this for local dns resolving, we don't want to stop/start
# but just restart, so we quickly get it back.
systemd.services.unbound.stopIfChanged = false;
tv.iptables.input-retiolum-accept-udp = [ "domain" ];
tv.iptables.input-wiregrill-accept-udp = [ "domain" ];
})
(lib.mkIf cfg.DoH.enable (let
http-port = 8053;
http-endpoint = "/query";
in {
services.unbound.package = pkgs.unbound-with-systemd.override {
withDoH = true;
};
services.unbound.settings.server.interface = [
"127.0.0.1@${toString http-port}"
];
services.unbound.settings.server = {
https-port = http-port;
http-endpoint = http-endpoint;
http-notls-downstream = true;
};
services.nginx.virtualHosts.${cfg.host} = {
useACMEHost = cfg.useACMEHost;
forceSSL = true;
http2 = true;
locations."/".return = ''404 "Not Found\n"'';
locations.${http-endpoint}.extraConfig = ''
grpc_pass grpc://127.0.0.1:${toString http-port};
'';
};
tv.iptables.input-internet-accept-tcp = [ "https" ];
}))
(lib.mkIf cfg.DoT.enable {
services.unbound.settings.server = {
interface = [
"::@853"
"0.0.0.0@853"
];
tls-service-key = "/run/credentials/unbound.service/tls-service-key";
tls-service-pem = "/run/credentials/unbound.service/tls-service-pem";
};
krebs.systemd.services.unbound.restartIfCredentialsChange = true;
systemd.services.unbound.serviceConfig.LoadCredential = [
"tls-service-key:/var/lib/acme/${cfg.useACMEHost}/key.pem"
"tls-service-pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
];
tv.iptables.input-internet-accept-tcp = [ "domain-s" ];
})
];
}

8
tv/5pkgs/override/alacritty.nix
View File

@ -1,14 +1,16 @@
self: super:
super.alacritty.overrideAttrs (old:
assert self.lib.versions.majorMinor old.version == "0.11";
if self.lib.versions.majorMinor old.version == "0.12" then
{
version = "${old.version}-tv";
src = self.fetchFromGitHub {
owner = "4z3";
repo = "alacritty";
rev = "touchscreen-support-0.11";
hash = "sha256-oA4earrJ7lPVSBm9vRccWatAQ49hfDKsa7M72B5uQpY=";
rev = "touchscreen-support-0.12";
hash = "sha256-yDG7IeQUmJhKMJebhMDzHLb3UHGLcO1FVZnmGe5Xr9w=";
};
}
else
builtins.trace "not overriding alacritty because unsupported version" {}
)