mirror of
https://github.com/ilyakooo0/nixpkgs.git
synced 2024-09-11 07:15:54 +03:00
Merge pull request #288033 from diogotcorreia/module-dnsproxy
nixos/dnsproxy: init module
This commit is contained in:
commit
dabaa7ac65
@ -78,6 +78,8 @@ In addition to numerous new and upgraded packages, this release has the followin
|
||||
|
||||
- [pretalx](https://github.com/pretalx/pretalx), a conference planning tool. Available as [services.pretalx](#opt-services.pretalx.enable).
|
||||
|
||||
- [dnsproxy](https://github.com/AdguardTeam/dnsproxy), a simple DNS proxy with DoH, DoT, DoQ and DNSCrypt support. Available as [services.dnsproxy](#opt-services.dnsproxy.enable).
|
||||
|
||||
- [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.
|
||||
|
||||
- [ollama](https://ollama.ai), server for running large language models locally.
|
||||
|
@ -944,6 +944,7 @@
|
||||
./services/networking/dnscrypt-wrapper.nix
|
||||
./services/networking/dnsdist.nix
|
||||
./services/networking/dnsmasq.nix
|
||||
./services/networking/dnsproxy.nix
|
||||
./services/networking/doh-proxy-rust.nix
|
||||
./services/networking/ejabberd.nix
|
||||
./services/networking/envoy.nix
|
||||
|
106
nixos/modules/services/networking/dnsproxy.nix
Normal file
106
nixos/modules/services/networking/dnsproxy.nix
Normal file
@ -0,0 +1,106 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib)
|
||||
escapeShellArgs
|
||||
getExe
|
||||
lists
|
||||
literalExpression
|
||||
maintainers
|
||||
mdDoc
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkOption
|
||||
mkPackageOption
|
||||
types;
|
||||
|
||||
cfg = config.services.dnsproxy;
|
||||
|
||||
yaml = pkgs.formats.yaml { };
|
||||
configFile = yaml.generate "config.yaml" cfg.settings;
|
||||
|
||||
finalFlags = (lists.optional (cfg.settings != { }) "--config-path=${configFile}") ++ cfg.flags;
|
||||
in
|
||||
{
|
||||
|
||||
options.services.dnsproxy = {
|
||||
|
||||
enable = mkEnableOption (lib.mdDoc "dnsproxy");
|
||||
|
||||
package = mkPackageOption pkgs "dnsproxy" { };
|
||||
|
||||
settings = mkOption {
|
||||
type = yaml.type;
|
||||
default = { };
|
||||
example = literalExpression ''
|
||||
{
|
||||
bootstrap = [
|
||||
"8.8.8.8:53"
|
||||
];
|
||||
listen-addrs = [
|
||||
"0.0.0.0"
|
||||
];
|
||||
listen-ports = [
|
||||
53
|
||||
];
|
||||
upstream = [
|
||||
"1.1.1.1:53"
|
||||
];
|
||||
}
|
||||
'';
|
||||
description = mdDoc ''
|
||||
Contents of the `config.yaml` config file.
|
||||
The `--config-path` argument will only be passed if this set is not empty.
|
||||
|
||||
See <https://github.com/AdguardTeam/dnsproxy/blob/master/config.yaml.dist>.
|
||||
'';
|
||||
};
|
||||
|
||||
flags = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
example = [ "--upstream=1.1.1.1:53" ];
|
||||
description = lib.mdDoc ''
|
||||
A list of extra command-line flags to pass to dnsproxy. For details on the
|
||||
available options, see <https://github.com/AdguardTeam/dnsproxy#usage>.
|
||||
Keep in mind that options passed through command-line flags override
|
||||
config options.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.dnsproxy = {
|
||||
description = "Simple DNS proxy with DoH, DoT, DoQ and DNSCrypt support";
|
||||
after = [ "network.target" "nss-lookup.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = "${getExe cfg.package} ${escapeShellArgs finalFlags}";
|
||||
Restart = "always";
|
||||
RestartSec = 10;
|
||||
DynamicUser = true;
|
||||
|
||||
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectClock = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallErrorNumber = "EPERM";
|
||||
SystemCallFilter = [ "@system-service" "~@privileged @resources" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
meta.maintainers = with maintainers; [ diogotcorreia ];
|
||||
|
||||
}
|
Loading…
Reference in New Issue
Block a user