blob: ed5bb8dd2f01274b3c5a75be202a048537a74e36 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
{ pkgs, ... }:
{
programs.throne = {
enable = true;
tunMode.enable = true;
};
programs.amnezia-vpn.enable = true;
environment.systemPackages = with pkgs; [
wireguard-tools
amneziawg-tools
amneziawg-go
];
# Throne's sing-box core resolves its underlying DNS by running
# `resolvectl -i <default-iface> dns` and fails to parse the empty
# per-link output (enp42s0 has no per-link DNS; ours is global Mullvad
# in services.resolved). Push the same Mullvad servers per-link so the
# resolvectl parse succeeds and proxy hostnames can be looked up.
networking.networkmanager.dispatcherScripts = [
{
type = "basic";
source = pkgs.writeText "link-dns.sh" ''
#!/bin/sh
if [ "$1" = "enp42s0" ] && { [ "$2" = "up" ] || [ "$2" = "dhcp4-change" ]; }; then
${pkgs.systemd}/bin/resolvectl dns enp42s0 194.242.2.2 194.242.2.4 || true
fi
'';
}
];
}
|
