27 lines
831 B
Nix
27 lines
831 B
Nix
{ config, ... }:
|
|
let
|
|
# TODO: dataDir is currently not provided by upstream
|
|
# data = config.services.dnscrypt-wrapper.dataDir;
|
|
data = "/var/lib/dnscrypt-wrapper";
|
|
sec = toString <secrets>;
|
|
port = 15251;
|
|
user = "dnscrypt-wrapper";
|
|
in {
|
|
services.dnscrypt-wrapper = {
|
|
enable = true;
|
|
address = "0.0.0.0";
|
|
upstream.address = "8.8.8.8";
|
|
providerName = "2.dnscrypt-cert.euer.krebsco.de";
|
|
inherit port;
|
|
};
|
|
networking.firewall.allowedUDPPorts = [ port ];
|
|
systemd.services.prepare-dnscrypt-wrapper-keys = {
|
|
wantedBy = [ "dnscrypt-wrapper.service" ];
|
|
before = [ "dnscrypt-wrapper.service" ];
|
|
script = ''
|
|
install -m700 -o ${user} -v ${sec}/dnscrypt-public.key ${data}/public.key
|
|
install -m700 -o ${user} -v ${sec}/dnscrypt-secret.key ${data}/secret.key
|
|
'';
|
|
};
|
|
}
|