nixos/modules/system/network/default.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

{ ... }:

{
  networking.hostName = "opus";
   networking.networkmanager.enable = true;

  # Primary DNS via Mullvad DoT (Base mode).
  # When systemd-resolved is enabled, these servers are fed into its
  # `Resolve.DNS` list. The `#server` suffix is systemd-resolved's
  # DoT (DNS-over-TLS) syntax and is ignored by non-resolved consumers.
  networking.nameservers = [
    "194.242.2.4#base.dns.mullvad.net"
    "194.242.2.2#dns.mullvad.net"
  ];

  # systemd-resolved: Mullvad primary, Quad9 fallback.
  # Options live under `settings.Resolve` (the flat `services.resolved.*`
  # aliases were removed upstream — they now emit deprecation warnings).
  services.resolved = {
    enable = true;
    settings.Resolve = {
      DNSOverTLS = "opportunistic";
      DNSSEC = "false";
      Domains = [ "~." ];
      FallbackDNS = [
        "9.9.9.9#dns.quad9.net"
        "149.112.112.112#dns.quad9.net"
      ];
    };
  };

  # Avahi (Printer / Network Discovery)
  services.avahi = {
    enable = true;
    nssmdns4 = true;
    openFirewall = true;
  };
}