DoH

modules/core/ca/root_ca.crt

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBszCCAVqgAwIBAgIRAPCAxajuCEmnXKploQS+KAkwCgYIKoZIzj0EAwIwODEW
+MBQGA1UEChMNTW9vbnMgSG9tZSBDQTEeMBwGA1UEAxMVTW9vbnMgSG9tZSBDQSBS
+b290IENBMB4XDTI1MTIwNjE4MDgwN1oXDTM1MTIwNDE4MDgwN1owODEWMBQGA1UE
+ChMNTW9vbnMgSG9tZSBDQTEeMBwGA1UEAxMVTW9vbnMgSG9tZSBDQSBSb290IENB
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDw2M0NQMju2zN5ZXwsYaTieWggId
+XmRSXjOHW4/pBEI11xk1GkMFbeVmppr1cbcNmbB+fmxoFa+oKguhFDSsdaNFMEMw
+DgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFGuC
+UGL5CxdamFfBVC8xH306Wo6xMAoGCCqGSM49BAMCA0cAMEQCIBqWCNWBuwhWDYoi
+fpqOqz2HSChOsKCIAgfTJlUUgSlSAiALekUJ+4M+L4/vP4GpkrSovuQ7JOMXV44+
+30Pcx4AoJg==
+-----END CERTIFICATE-----

modules/core/network.nix

@@ -2,7 +2,6 @@
 {
   networking = {
     hostName = "${host}";
-
     nameservers = [ "127.0.0.1" "::1" ];
 
     networkmanager = {
@@ -10,10 +9,8 @@
       dns = "none";
       wifi.powersave = false;
       wifi.backend = "wpa_supplicant";
-
       settings = {
         "device"."wifi.scan-rand-mac-address" = "no";
-
         "connection"."wifi.cloned-mac-address" = "permanent";
       };
     };
@@ -29,32 +26,24 @@
 
   services.resolved.enable = false;
 
-  environment.systemPackages = [
+  environment.systemPackages = [ pkgs.networkmanagerapplet ];
-    pkgs.networkmanagerapplet
-  ];
   programs.nm-applet.enable = true;
 
+  security.pki.certificateFiles = [ ./ca/root_ca.crt ];
+
   services.dnscrypt-proxy2 = {
     enable = true;
     settings = {
       doh_servers = true;
       dnscrypt_servers = false;
 
-      ipv6_servers = true;
+      server_names = [ "moons14-doh" ];
-      require_dnssec = true;
-      require_nolog = true;
-      require_nofilter = true;
 
-      sources.public-resolvers = {
+      static."moons14-doh".stamp = "sdns://AgcAAAAAAAAACzE3Mi4zMS4zMC4yAA9kbnMubW9vbnMxNC5jb20KL2Rucy1xdWVyeQ";
-        urls = [
-          "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
-          "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
-        ];
-        cache_file = "/var/cache/dnscrypt-proxy/public-resolvers.md";
-        minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
-      };
 
-      server_names = [ "cloudflare" "quad9-doh" ];
+      ignore_system_dns = true;
+      bootstrap_resolvers = [ "172.31.30.2:53" ];
+      fallback_resolvers  = [ "172.31.30.2:53" ];
 
       listen_addresses = [ "127.0.0.1:53" "[::1]:53" ];
     };