2 files changed, 18 insertions, 16 deletions
diff --git a/nixos/modules/features/cli-tools/default.nix b/nixos/modules/features/cli-tools/default.nix
index 054ddc1..ef13ddd 100644
--- a/nixos/modules/features/cli-tools/default.nix
+++ b/nixos/modules/features/cli-tools/default.nix
@@ -16,6 +16,8 @@
     caligula
     fetch
     smartmontools
+    amneziawg-tools
+    amneziawg-go
   ];
 
   # Cross-shell prompt; its config lives in the dotfiles repo, not NixOS.
diff --git a/nixos/modules/features/vpn-utils/default.nix b/nixos/modules/features/vpn-utils/default.nix
index 89b92e4..91f2594 100644
--- a/nixos/modules/features/vpn-utils/default.nix
+++ b/nixos/modules/features/vpn-utils/default.nix
@@ -8,24 +8,24 @@
 
   programs.amnezia-vpn.enable = true;
 
-  networking.wireguard.enable = true;
-
-  boot.kernelModules = [ "wireguard" ];
-
   environment.systemPackages = with pkgs; [
     wireguard-tools
   ];
 
-  systemd.services.wireguard-client = {
-    description = "WireGuard client tunnel (wg)";
-    after = [ "network-online.target" ];
-    wants = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = "${pkgs.wireguard-tools}/bin/wg-quick up wg";
-      ExecStop = "${pkgs.wireguard-tools}/bin/wg-quick down wg";
-    };
-  };
+  # Throne's sing-box core resolves its underlying DNS by running
+  # `resolvectl -i <default-iface> dns` and fails to parse the empty
+  # per-link output (enp42s0 has no per-link DNS; ours is global Mullvad
+  # in services.resolved). Push the same Mullvad servers per-link so the
+  # resolvectl parse succeeds and proxy hostnames can be looked up.
+  networking.networkmanager.dispatcherScripts = [
+    {
+      type = "basic";
+      source = pkgs.writeText "link-dns.sh" ''
+        #!/bin/sh
+        if [ "$1" = "enp42s0" ] && { [ "$2" = "up" ] || [ "$2" = "dhcp4-change" ]; }; then
+          ${pkgs.systemd}/bin/resolvectl dns enp42s0 194.242.2.2 194.242.2.4 || true
+        fi
+      '';
+    }
+  ];
 }
 \ No newline at end of file