dns over https (DOH) nixos

doh.nix

{

  networking.dhcpcd.extraConfig = "nohook resolv.conf";
  networking.networkmanager.dns = "none";
  networking.nameservers = [ "127.0.0.1" ];

  services.dnscrypt-proxy2.enable = true;
  services.dnscrypt-proxy2.settings = {
    ipv6_servers = true;
    ipv4_servers = true;
    dnscrypt_servers = true;
    doh_servers = true;
    require_nolog = true;
    require_nofilter = true;
    require_dnssec = true;
    server_names = [ "cloudflare" "cloudflare-ipv6" ];
    bootstrap_resolvers = [ "8.8.8.8:53" "1.1.1.1:53" ];
    fallback_resolvers = [ "8.8.8.8:53" "1.1.1.1:53" ];

    sources.public-resolvers = {
      urls = [
        "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
        "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
      ];
      cache_file = "/var/lib/dnscrypt-proxy2/public-resolvers.md";
      minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
    };

  };
}