Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ma dnscrypt: provide client and server config

Browse Source
This commit is contained in:
makefu 2017-09-04 10:11:07 +02:00
parent 729549d154
commit 50e450d065
No known key found for this signature in database
GPG Key ID: 36F7711F3FC0F225
2 changed files with 41 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
makefu/2configs/dnscrypt/client.nix
View File

@ -1,6 +1,18 @@
{ { config, ... }:
services.dnscrypt-proxy.enable = true; let
services.dnscrypt-proxy.resolverName = "cs-de"; customResolver = {
# TODO: put this somewhere else
address = config.krebs.hosts.gum.nets.internet.ip4.addr;
port = 15251;
name = "2.dnscrypt-cert.euer.krebsco.de";
# dnscrypt-wrapper --show-provider-publickey --provider-publickey-file public.key
key = "1AFC:E58D:F242:0FBB:9EE9:4E51:47F4:5373:D9AE:C2AB:DD96:8448:333D:5D79:272C:A44C";
};
in {
services.dnscrypt-proxy = {
enable = true;
inherit customResolver;
};
networking.extraResolvconfConf = '' networking.extraResolvconfConf = ''
name_servers='127.0.0.1' name_servers='127.0.0.1'
''; '';

26
makefu/2configs/dnscrypt/server.nix Normal file
View File

@ -0,0 +1,26 @@
{ config, ... }:
let
# TODO: dataDir is currently not provided by upstream
# data = config.services.dnscrypt-wrapper.dataDir;
data = "/var/lib/dnscrypt-wrapper";
sec = toString <secrets>;
port = 15251;
user = "dnscrypt-wrapper";
in {
services.dnscrypt-wrapper = {
enable = true;
address = "0.0.0.0";
upstream.address = "8.8.8.8";
providerName = "2.dnscrypt-cert.euer.krebsco.de";
inherit port;
};
networking.firewall.allowedUDPPorts = [ port ];
systemd.services.prepare-dnscrypt-wrapper-keys = {
wantedBy = [ "dnscrypt-wrapper.service" ];
before = [ "dnscrypt-wrapper.service" ];
script = ''
install -m700 -o ${user} -v ${sec}/dnscrypt-public.key ${data}/public.key
install -m700 -o ${user} -v ${sec}/dnscrypt-secret.key ${data}/secret.key
'';
};
}