···

       
102
       
102
       
 
       
  in mkIf cfg.enable {

     

       
103
       
103
       
 
       
    networking = {

     

       
104
       
104
       
 
       
      useNetworkd = true;

     

       
105
       
105
       
+
       
      hosts."127.0.0.2" = mkForce [];

     

       
105
       
106
       
 
       
      firewall = mkIf (intern != null) {

     

       
106
       
107
       
 
       
        trustedInterfaces = [ "lo" intern.name ];

     

       
107
       
108
       
 
       
      };

     
···

       
199
       
200
       
 
       


     

       
200
       
201
       
 
       
    services.resolved = {

     

       
201
       
202
       
 
       
      enable = true;

     

       
203
       
203
       
+
       
      llmnr = "false";

     

       
204
       
204
       
+
       
      domains = [ "~." ];

     

       
202
       
205
       
 
       
      fallbackDns = [

     

       
203
       
206
       
 
       
        "1.0.0.1"

     

       
204
       
207
       
 
       
      ] ++ (if cfg.ipv6 then [ "2606:4700:4700::1001" ] else []);

     

       
205
       
208
       
 
       
      dnsovertls = "opportunistic";

     

       
206
       
209
       
 
       
      extraConfig = strings.concatStringsSep "\n" [

     

       
207
       
207
       
-
       
        ''

     

       
208
       
208
       
-
       
          [Resolve]

     

       
209
       
209
       
-
       
          ReadEtcHosts=no

     

       
210
       
210
       
-
       
        ''

     

       
210
       
210
       
+
       
        "[Resolve]"

     

       
211
       
211
       
 
       
        (optionalString cfg.mdns ''

     

       
212
       
212
       
 
       
          MulticastDNS=yes

     

       
213
       
213
       
 
       
        '')

     

···

       
105
       
105
       
 
       
        :80 {

     

       
106
       
106
       
 
       
          import network_paths

     

       
107
       
107
       
 
       
        }

     

       
108
       
108
       
+
       


     

       
109
       
109
       
+
       
        :443 {

     

       
110
       
110
       
+
       
          import network_paths

     

       
111
       
111
       
+
       
        }

     

       
108
       
112
       
 
       
      '';

     

       
109
       
113
       
 
       
    };

     

       
110
       
114
       
 
       
  };