commit 76f32d7208a23ee35479fa43c982f518e0ab8562 parent 8b7b4f9ae65429eefc04a257cd2dd5cba1881117 Author: vin <git@vineetk.net> Date: Thu, 9 Apr 2026 11:34:18 -0400 hastur: getting unbound rpz localfile support to work is hard without patching out the maybe-string validation from the service config as the daemon can't seem to read from outside the guix store (not even /etc). Diffstat:
| M | epistemia/systems/hastur.scm | | | 15 | +++++++-------- |
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/epistemia/systems/hastur.scm b/epistemia/systems/hastur.scm @@ -128,7 +128,10 @@ "::1" "10.0.13.2")) (hide-version #t) - (hide-identity #t))) + (hide-identity #t) + (extra-options '((ip-freebind . yes) + (aggressive-nsec . no) + (module-config . "respip validator iterator"))))) (forward-zone (list (unbound-zone @@ -143,13 +146,9 @@ server: access-control: 10.0.13.0/24 allow access-control: ::1 allow - ip-freebind: yes - aggressive-nsec: no - module-config: \"respip validator iterator\" - rpz: - name: localhost - zonefile: /data/src/clones/networking/hagezi_dns-blocklists/rpz/ultimate.txt\n"))) + name: hagezi.ultimate + url: https://raw.githubusercontent.com/hagezi/dns-blocklists/refs/heads/main/rpz/ultimate.txt\n"))) (service dhcpcd-service-type (dhcpcd-configuration (option '("rapid_commit" "interface_mtu")) @@ -158,7 +157,7 @@ rpz: "domain_name_servers" "domain_name" "domain_search")) - (static '("domain_name_servers=9.9.9.9" + (static '("domain_name_servers=127.0.0.1" "domain_search=epistemia")) (no-hook '("hostname")))) (service wpa-supplicant-service-type