commit 2e8bc2bd5c264cf30bfb9b357e2a2b64416002e1 · pyrox.dev/nixpkgs

+29 -56
nixos/modules/services/networking/dnscrypt-proxy.nix
···

       15
       15
        
       in

     

       16
       16
        
       

     

       17
       17
        
       {

     

       18
       18
       -
         ##### interface

     

       19
       19
       -
       

     

       20
       18
        
         options = {

     

       21
       21
       -
       

     

       22
       19
        
           services.dnscrypt-proxy = {

     

       23
       23
       -
       

     

       24
       20
        
             enable = mkOption {

     

       25
       21
        
               default = false;

     

       26
       22
        
               type = types.bool;

     

       27
       23
        
               description = ''

     

       28
       28
       -
                 Enable dnscrypt-proxy.

     

       29
       29
       -
                 The proxy relays regular DNS queries to a DNSCrypt enabled

     

       30
       30
       -
                 upstream resolver.

     

       31
       31
       -
                 The traffic between the client and the upstream resolver is

     

       32
       32
       -
                 encrypted and authenticated, which may mitigate the risk of MITM

     

       33
       33
       -
                 attacks and third-party snooping (assuming the upstream is

     

       34
       34
       -
                 trustworthy).

     

       24
       24
       +
                 Enable dnscrypt-proxy. The proxy relays regular DNS queries to a

     

       25
       25
       +
                 DNSCrypt enabled upstream resolver. The traffic between the

     

       26
       26
       +
                 client and the upstream resolver is encrypted and authenticated,

     

       27
       27
       +
                 which may mitigate the risk of MITM attacks and third-party

     

       28
       28
       +
                 snooping (assuming the upstream is trustworthy).

     

       35
       29
        
               '';

     

       36
       30
        
             };

     

       37
       37
       -
       

     

       38
       31
        
             localAddress = mkOption {

     

       39
       32
        
               default = "127.0.0.1";

     

       40
       33
        
               type = types.string;

     
···

       42
       35
        
                 Listen for DNS queries on this address.

     

       43
       36
        
               '';

     

       44
       37
        
             };

     

       45
       45
       -
       

     

       46
       38
        
             port = mkOption {

     

       47
       39
        
               default = 53;

     

       48
       40
        
               type = types.int;

     
···

       50
       42
        
                 Listen on this port.

     

       51
       43
        
               '';

     

       52
       44
        
             };

     

       53
       53
       -
       

     

       54
       45
        
             resolverName = mkOption {

     

       55
       46
        
               default = "opendns";

     

       56
       47
        
               type = types.string;

     
···

       61
       52
        
                 location).

     

       62
       53
        
               '';

     

       63
       54
        
             };

     

       64
       64
       -
       

     

       65
       55
        
             tcpOnly = mkOption {

     

       66
       56
        
               default = false;

     

       67
       57
        
               type = types.bool;

     

       68
       58
        
               description = ''

     

       69
       59
        
                 Force sending encrypted DNS queries to the upstream resolver

     

       70
       70
       -
                 over TCP instead of UDP (on port 443).

     

       71
       71
       -
                 Enabling this option may help circumvent filtering, but should

     

       72
       72
       -
                 not be used otherwise.

     

       60
       60
       +
                 over TCP instead of UDP (on port 443). Enabling this option may

     

       61
       61
       +
                 help circumvent filtering, but should not be used otherwise.

     

       73
       62
        
               '';

     

       74
       63
        
             };

     

       75
       75
       -
       

     

       76
       64
        
           };

     

       77
       77
       -
       

     

       78
       65
        
         };

     

       79
       66
        
       

     

       80
       80
       -
         ##### implementation

     

       81
       81
       -
       

     

       82
       67
        
         config = mkIf cfg.enable {

     

       83
       68
        
       

     

       84
       84
       -
           ### AppArmor profile

     

       69
       69
       +
           security.apparmor.profiles = mkIf apparmorEnabled (singleton (pkgs.writeText "apparmor-dnscrypt-proxy" ''

     

       70
       70
       +
             ${dnscrypt-proxy}/bin/dnscrypt-proxy {

     

       71
       71
       +
               /dev/null rw,

     

       72
       72
       +
               /dev/urandom r,

     

       85
       73
        
       

     

       86
       86
       -
           security.apparmor.profiles = mkIf apparmorEnabled [

     

       87
       87
       -
             (pkgs.writeText "apparmor-dnscrypt-proxy" ''

     

       74
       74
       +
               /etc/passwd r,

     

       75
       75
       +
               /etc/group r,

     

       76
       76
       +
               ${config.environment.etc."nsswitch.conf".source} r,

     

       88
       77
        
       

     

       89
       89
       -
               ${dnscrypt-proxy}/bin/dnscrypt-proxy {

     

       78
       78
       +
               ${pkgs.glibc}/lib/*.so mr,

     

       79
       79
       +
               ${pkgs.tzdata}/share/zoneinfo/** r,

     

       90
       80
        
       

     

       91
       91
       -
                 /dev/null rw,

     

       92
       92
       -
                 /dev/urandom r,

     

       81
       81
       +
               network inet stream,

     

       82
       82
       +
               network inet6 stream,

     

       83
       83
       +
               network inet dgram,

     

       84
       84
       +
               network inet6 dgram,

     

       93
       85
        
       

     

       94
       94
       -
                 /etc/passwd r,

     

       95
       95
       -
                 /etc/group r,

     

       96
       96
       -
                 ${config.environment.etc."nsswitch.conf".source} r,

     

       97
       97
       -
       

     

       98
       98
       -
                 ${pkgs.glibc}/lib/*.so mr,

     

       99
       99
       -
                 ${pkgs.tzdata}/share/zoneinfo/** r,

     

       100
       100
       -
       

     

       101
       101
       -
                 network inet stream,

     

       102
       102
       -
                 network inet6 stream,

     

       103
       103
       -
                 network inet dgram,

     

       104
       104
       -
                 network inet6 dgram,

     

       105
       105
       -
       

     

       106
       106
       -
                 ${pkgs.gcc.cc}/lib/libssp.so.* mr,

     

       107
       107
       -
                 ${pkgs.libsodium}/lib/libsodium.so.* mr,

     

       108
       108
       -
                 ${pkgs.systemd}/lib/libsystemd.so.* mr,

     

       109
       109
       -
                 ${pkgs.xz}/lib/liblzma.so.* mr,

     

       110
       110
       -
                 ${pkgs.libgcrypt}/lib/libgcrypt.so.* mr,

     

       111
       111
       -
                 ${pkgs.libgpgerror}/lib/libgpg-error.so.* mr,

     

       86
       86
       +
               ${pkgs.gcc.cc}/lib/libssp.so.* mr,

     

       87
       87
       +
               ${pkgs.libsodium}/lib/libsodium.so.* mr,

     

       88
       88
       +
               ${pkgs.systemd}/lib/libsystemd.so.* mr,

     

       89
       89
       +
               ${pkgs.xz}/lib/liblzma.so.* mr,

     

       90
       90
       +
               ${pkgs.libgcrypt}/lib/libgcrypt.so.* mr,

     

       91
       91
       +
               ${pkgs.libgpgerror}/lib/libgpg-error.so.* mr,

     

       112
       92
        
       

     

       113
       113
       -
                 ${resolverListFile} r,

     

       114
       114
       -
               }

     

       115
       115
       -
             '')

     

       116
       116
       -
           ];

     

       93
       93
       +
               ${resolverListFile} r,

     

       94
       94
       +
             }

     

       95
       95
       +
           ''));

     

       117
       96
        
       

     

       118
       97
        
           users.extraUsers.dnscrypt-proxy = {

     

       119
       98
        
             uid = config.ids.uids.dnscrypt-proxy;

     
···

       121
       100
        
           };

     

       122
       101
        
           users.extraGroups.dnscrypt-proxy.gid = config.ids.gids.dnscrypt-proxy;

     

       123
       102
        
       

     

       124
       124
       -
           ## derived from upstream dnscrypt-proxy.socket

     

       125
       103
        
           systemd.sockets.dnscrypt-proxy = {

     

       126
       104
        
             description = "dnscrypt-proxy listening socket";

     

       127
       127
       -
       

     

       128
       105
        
             socketConfig = {

     

       129
       106
        
               ListenStream = "${cfg.localAddress}:${toString cfg.port}";

     

       130
       107
        
               ListenDatagram = "${cfg.localAddress}:${toString cfg.port}";

     

       131
       108
        
             };

     

       132
       132
       -
       

     

       133
       109
        
             wantedBy = [ "sockets.target" ];

     

       134
       110
        
           };

     

       135
       111
        
       

     

       136
       136
       -
           # derived from upstream dnscrypt-proxy.service

     

       137
       112
        
           systemd.services.dnscrypt-proxy = {

     

       138
       113
        
             description = "dnscrypt-proxy daemon";

     

       139
       114
        
             after = [ "network.target" ] ++ optional apparmorEnabled "apparmor.service";

     

       140
       115
        
             requires = [ "dnscrypt-proxy.socket "] ++ optional apparmorEnabled "apparmor.service";

     

       141
       116
        
             serviceConfig = {

     

       142
       117
        
               Type = "simple";

     

       143
       143
       -
               ## note: NonBlocking is required for socket activation to work

     

       144
       118
        
               NonBlocking = "true";

     

       145
       119
        
               ExecStart = "${dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}";

     

       146
       120
        
               User = "dnscrypt-proxy";

     
···

       149
       123
        
               PrivateDevices = true;

     

       150
       124
        
             };

     

       151
       125
        
           };

     

       152
       152
       -
       

     

       153
       126
        
         };

     

       154
       127
        
       }