pyrox.dev
1{ config, lib, pkgs, ...}:
2
3with lib;
4
5let
6 cfg = config.services.stubby;
7
8 fallbacks = concatMapStringsSep "\n " (x: "- ${x}") cfg.fallbackProtocols;
9 listeners = concatMapStringsSep "\n " (x: "- ${x}") cfg.listenAddresses;
10
11 # By default, the recursive resolvers maintained by the getdns
12 # project itself are enabled. More information about both getdns's servers,
13 # as well as third party options for upstream resolvers, can be found here:
14 # https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers
15 #
16 # You can override these values by supplying a yaml-formatted array of your
17 # preferred upstream resolvers in the following format:
18 #
19 # 106 # - address_data: IPv4 or IPv6 address of the upstream
20 # port: Port for UDP/TCP (default is 53)
21 # tls_auth_name: Authentication domain name checked against the server
22 # certificate
23 # tls_pubkey_pinset: An SPKI pinset verified against the keys in the server
24 # certificate
25 # - digest: Only "sha256" is currently supported
26 # value: Base64 encoded value of the sha256 fingerprint of the public
27 # key
28 # tls_port: Port for TLS (default is 853)
29
30 defaultUpstream = ''
31 - address_data: 145.100.185.15
32 tls_auth_name: "dnsovertls.sinodun.com"
33 tls_pubkey_pinset:
34 - digest: "sha256"
35 value: 62lKu9HsDVbyiPenApnc4sfmSYTHOVfFgL3pyB+cBL4=
36 - address_data: 145.100.185.16
37 tls_auth_name: "dnsovertls1.sinodun.com"
38 tls_pubkey_pinset:
39 - digest: "sha256"
40 value: cE2ecALeE5B+urJhDrJlVFmf38cJLAvqekONvjvpqUA=
41 - address_data: 185.49.141.37
42 tls_auth_name: "getdnsapi.net"
43 tls_pubkey_pinset:
44 - digest: "sha256"
45 value: foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9Q=
46 - address_data: 2001:610:1:40ba:145:100:185:15
47 tls_auth_name: "dnsovertls.sinodun.com"
48 tls_pubkey_pinset:
49 - digest: "sha256"
50 value: 62lKu9HsDVbyiPenApnc4sfmSYTHOVfFgL3pyB+cBL4=
51 - address_data: 2001:610:1:40ba:145:100:185:16
52 tls_auth_name: "dnsovertls1.sinodun.com"
53 tls_pubkey_pinset:
54 - digest: "sha256"
55 value: cE2ecALeE5B+urJhDrJlVFmf38cJLAvqekONvjvpqUA=
56 - address_data: 2a04:b900:0:100::38
57 tls_auth_name: "getdnsapi.net"
58 tls_pubkey_pinset:
59 - digest: "sha256"
60 value: foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9Q=
61 '';
62
63 # Resolution type is not changeable here because it is required per the
64 # stubby documentation:
65 #
66 # "resolution_type: Work in stub mode only (not recursive mode) - required for Stubby
67 # operation."
68 #
69 # https://dnsprivacy.org/wiki/display/DP/Configuring+Stubby
70
71 confFile = pkgs.writeText "stubby.yml" ''
72 resolution_type: GETDNS_RESOLUTION_STUB
73 dns_transport_list:
74 ${fallbacks}
75 tls_authentication: ${cfg.authenticationMode}
76 tls_query_padding_blocksize: ${toString cfg.queryPaddingBlocksize}
77 edns_client_subnet_private: ${if cfg.subnetPrivate then "1" else "0"}
78 idle_timeout: ${toString cfg.idleTimeout}
79 listen_addresses:
80 ${listeners}
81 round_robin_upstreams: ${if cfg.roundRobinUpstreams then "1" else "0"}
82 ${cfg.extraConfig}
83 upstream_recursive_servers:
84 ${cfg.upstreamServers}
85 '';
86in
87
88{
89 options = {
90 services.stubby = {
91
92 enable = mkEnableOption "Stubby DNS resolver";
93
94 fallbackProtocols = mkOption {
95 default = [ "GETDNS_TRANSPORT_TLS" ];
96 type = with types; listOf (enum [
97 "GETDNS_TRANSPORT_TLS"
98 "GETDNS_TRANSPORT_TCP"
99 "GETDNS_TRANSPORT_UDP"
100 ]);
101 description = ''
102 Ordered list composed of one or more transport protocols.
103 Strict mode should only use <literal>GETDNS_TRANSPORT_TLS</literal>.
104 Other options are <literal>GETDNS_TRANSPORT_UDP</literal> and
105 <literal>GETDNS_TRANSPORT_TCP</literal>.
106 '';
107 };
108
109 authenticationMode = mkOption {
110 default = "GETDNS_AUTHENTICATION_REQUIRED";
111 type = types.enum [
112 "GETDNS_AUTHENTICATION_REQUIRED"
113 "GETDNS_AUTHENTICATION_NONE"
114 ];
115 description = ''
116 Selects the Strict or Opportunistic usage profile.
117 For strict, set to <literal>GETDNS_AUTHENTICATION_REQUIRED</literal>.
118 for opportunistic, use <literal>GETDNS_AUTHENTICATION_NONE</literal>.
119 '';
120 };
121
122 queryPaddingBlocksize = mkOption {
123 default = 128;
124 type = types.int;
125 description = ''
126 EDNS0 option to pad the size of the DNS query to the given blocksize.
127 '';
128 };
129
130 subnetPrivate = mkOption {
131 default = true;
132 type = types.bool;
133 description = ''
134 EDNS0 option for ECS client privacy. Default is
135 <literal>true</literal>. If set, this option prevents the client
136 subnet from being sent to authoritative nameservers.
137 '';
138 };
139
140 idleTimeout = mkOption {
141 default = 10000;
142 type = types.int;
143 description = "EDNS0 option for keepalive idle timeout expressed in
144 milliseconds.";
145 };
146
147 listenAddresses = mkOption {
148 default = [ "127.0.0.1" "0::1" ];
149 type = with types; listOf str;
150 description = ''
151 Sets the listen address for the stubby daemon.
152 Uses port 53 by default.
153 Ise IP@port to specify a different port.
154 '';
155 };
156
157 roundRobinUpstreams = mkOption {
158 default = true;
159 type = types.bool;
160 description = ''
161 Instructs stubby to distribute queries across all available name
162 servers. Default is <literal>true</literal>. Set to
163 <literal>false</literal> in order to use the first available.
164 '';
165 };
166
167 upstreamServers = mkOption {
168 default = defaultUpstream;
169 type = types.lines;
170 description = ''
171 Add additional upstreams. See <citerefentry><refentrytitle>stubby
172 </refentrytitle><manvolnum>1</manvolnum></citerefentry> for an
173 example of the entry formatting. In Strict mode, at least one of the
174 following settings must be supplied for each nameserver:
175 <literal>tls_auth_name</literal> or
176 <literal>tls_pubkey_pinset</literal>.
177 '';
178 };
179
180 debugLogging = mkOption {
181 default = false;
182 type = types.bool;
183 description = "Enable or disable debug level logging.";
184 };
185
186 extraConfig = mkOption {
187 default = "";
188 type = types.lines;
189 description = ''
190 Add additional configuration options. see <citerefentry>
191 <refentrytitle>stubby</refentrytitle><manvolnum>1</manvolnum>
192 </citerefentry>for more options.
193 '';
194 };
195 };
196 };
197
198 config = mkIf cfg.enable {
199 environment.systemPackages = [ pkgs.stubby ];
200 systemd.services.stubby = {
201 description = "Stubby local DNS resolver";
202 after = [ "network.target" ];
203 before = [ "nss-lookup.target" ];
204 wantedBy = [ "multi-user.target" ];
205
206 serviceConfig = {
207 AmbientCapabilities = "CAP_NET_BIND_SERVICE";
208 CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
209 ExecStart = "${pkgs.stubby}/bin/stubby -C ${confFile} ${optionalString cfg.debugLogging "-l"}";
210 DynamicUser = true;
211 };
212 };
213 };
214}