blob: 5601ff82a9bfa1d89004ca863041234cdf919f52 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
{ ... }:
{
networking.hostName = "opus";
networking.networkmanager.enable = true;
programs.amnezia-vpn.enable = true;
# Primary DNS via Mullvad DoT (Base mode).
# When systemd-resolved is enabled, these servers are fed into its
# `Resolve.DNS` list. The `#server` suffix is systemd-resolved's
# DoT (DNS-over-TLS) syntax and is ignored by non-resolved consumers.
networking.nameservers = [
"194.242.2.4#base.dns.mullvad.net"
"194.242.2.2#dns.mullvad.net"
];
# systemd-resolved: Mullvad primary, Quad9 fallback.
# Options live under `settings.Resolve` (the flat `services.resolved.*`
# aliases were removed upstream — they now emit deprecation warnings).
services.resolved = {
enable = true;
settings.Resolve = {
DNSOverTLS = "opportunistic";
DNSSEC = "false";
Domains = [ "~." ];
FallbackDNS = [
"9.9.9.9#dns.quad9.net"
"149.112.112.112#dns.quad9.net"
];
};
};
# Avahi (Printer / Network Discovery)
services.avahi = {
enable = true;
nssmdns4 = true;
openFirewall = true;
};
}
|
