NSD AdugardHome Unbound dns.nix example

dns.nix

{ config, pkgs, lib, ... }:
{
  # 253 nsd
  # 153 adguardhome
  # 53  unbound

  services.nsd =
  let dns =
        import ("${builtins.fetchTarball {
          url = "https://github.com/nix-community/dns.nix/archive/refs/tags/v1.2.0.tar.gz";
        }}/dns") { inherit lib; };
      zone = with dns.combinators; {
        SOA = {
          nameServer = "ns1";
          adminEmail = "admin@lab";
          serial = 2023121111;
        };
        NS = [
          "ns1.lab."
        ];
        A = [ "127.0.0.1" ];
        # AAAA = [ "fd00::1" ];
        subdomains = rec {
          gw = host "10.1.1.1" "fdd2:5ef:7dc0::1";
          example = gw;
        };
      };
  in
  {
    enable = true;
    interfaces = [ "127.0.0.1" ];
    port = 253;
    verbosity = 2;
    zones = {
      "lab" = {
        data = toString (dns.evalZone "lab" zone);
      };
      "lan" = {
        data = toString (dns.evalZone "lan" zone);
      };
    };
  };

  services.adguardhome = {
    enable = true;
    port = 3333;
    settings = {
      dns = {
        bind_hosts = [ "0.0.0.0" ];
        bootstrap_dns = [
          # odvr.nic.cz
          # https://www.nic.cz/odvr/
          "193.17.47.1"
          "185.43.135.1"
          "2001:148f:ffff::1"
          "2001:148f:fffe::1"
        ];
        port = 153;
        upstream_dns = [
          "tls://odvr.nic.cz"
          "tls://1.1.1.1"
        ];
      };
    };
    mutableSettings = lib.mkDefault true;
  };

  services.unbound = {
    enable = true;
    settings = {
      server = {
        interface = [
          "10.1.1.1"
          "127.0.0.1"
          "::1"
        ];
        access-control = [
          "10.0.0.0/24 allow"
          "10.1.1.0/24 allow"
          "127.0.0.0/8 allow"
          "::1 allow"
        ];
        do-not-query-localhost = "no";
        domain-insecure = [ "lab" "lan" ];
        private-domain = [ "lab" "lan" ];
        local-zone = [ "lab. transparent" "lan. transparent" ];
        val-permissive-mode = "yes";
      };
      stub-zone = [
        { name = "lab";
          stub-addr = "127.0.0.1@253";
          stub-first = "yes";
        }
        { name = "lan";
          stub-addr = "127.0.0.1@253";
          stub-first = "yes";
        }
      ];
      forward-zone = [
        # example of forwarding some other zone
        # { name = "wg.lab.";
        #   forward-addr = [ "10.23.0.1@53" ];
        # }
        { name = ".";
          forward-addr = [
            # adguard
            "127.0.0.1@153"
          ];
        }
      ];
      remote-control.control-enable = true;
    };
  };
}