commit c76c98c211c6ee03a9f0a5d3fed38b5e4dfaea09 parent 31036a1f0e3c974c7145cc703d31ab6f4aad0781 Author: Vineet Kumar <git@vineetk.net> Date: Thu, 25 Dec 2025 22:58:20 -0500 add unbound config to demiurge Diffstat:
| M | epistemia/systems/demiurge.scm | | | 45 | +++++++++++++++++++++++++++++++++++++++++++++ |
1 file changed, 45 insertions(+), 0 deletions(-)
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm @@ -5,6 +5,7 @@ #:use-module (gnu packages linux) #:use-module (gnu packages version-control) #:use-module (gnu services desktop) + #:use-module (gnu services dns) #:use-module (gnu services linux) #:use-module (gnu services networking) #:use-module (gnu services shepherd) @@ -105,6 +106,50 @@ ListenAddress 127.0.0.1:22 ListenAddress 192.168.1.2:22 ListenAddress 10.0.13.2:22"))) + (service unbound-service-type + (unbound-configuration + (server + (unbound-server + (interface '("127.0.0.1" + "::1" + "10.0.13.2")) + (hide-version #t) + (hide-identity #t))) + (forward-zone + (list + (unbound-zone + (name ".") + (forward-addr '("192.168.1.1"))))) + (extra-content "\ +server: + access-control: 127.0.0.0/8 allow + access-control: 10.0.13.0/24 allow + access-control: ::1 allow + + ip-freebind: yes + aggressive-nsec: no + module-config: \"respip validator iterator\" + + local-data: \"demiurge.epistemia. 86400 IN A 10.0.13.2\" + local-data: \"demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2\" + local-data: \"hastur.epistemia. 86400 IN A 10.0.13.3\" + local-data: \"hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3\" + local-data: \"iphonebob.epistemia. 86400 IN A 10.0.13.4\" + local-data: \"iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4\" + local-data: \"lab.epistemia. 86400 IN A 10.0.13.5\" + local-data: \"lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5\" + local-data: \"saklas.epistemia. 86400 IN A 10.0.13.1\" + local-data: \"saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1\" + local-zone: \"demiurge.epistemia.\" redirect + local-zone: \"hastur.epistemia.\" redirect + local-zone: \"iphonebob.epistemia.\" redirect + local-zone: \"lab.epistemia.\" redirect + local-zone: \"saklas.epistemia.\" redirect + +rpz: + name: \"hagezi.ultimate\" + zonefile: \"hagezi.ultimate\" + url: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"))) (service wireguard-service-type (wireguard-configuration (interface "wg0")