initial

hosts/sarien/system/security/dnscrypt-proxy.nix

@@ -0,0 +1,49 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+with lib; {
+  options = {
+    security.dnscrypt-proxy.enable =
+      mkEnableOption "enable dnscrypt-proxy";
+  };
+  config = mkIf config.security.dnscrypt-proxy.enable {
+    networking = {
+      nameservers = ["127.0.0.1" "::1"];
+      # If using dhcpcd:
+      dhcpcd.extraConfig = "nohook resolv.conf";
+      # If using NetworkManager:
+      networkmanager.dns = "none";
+    };
+
+    # Make sure you don't have services.resolved.enable on.
+    services.dnscrypt-proxy2 = {
+      enable = true;
+      settings = {
+        ipv6_servers = false;
+        require_dnssec = true;
+
+        sources.public-resolvers = {
+          urls = [
+            "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
+            "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
+          ];
+          cache_file = "/var/lib/dnscrypt-proxy2/public-resolvers.md";
+          minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+        };
+
+        # You can choose a specific set of servers from https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/public-resolvers.md
+        server_names = [
+          #"quad9-dnscrypt-ip4-filter-pri"
+          "cloudflare"
+        ];
+      };
+    };
+
+    systemd.services.dnscrypt-proxy2.serviceConfig = {
+      StateDirectory = "dnscrypt-proxy";
+    };
+  };
+}