67134682d9
As it breaks tailscale <-> openvpn > At the time of September 2023, systemd upstream advise to disable DNSSEC > by default as the current code is not robust enough to deal with > “in the wild” non-compliant servers, which will usually give you a > broken bad experience in addition of insecure.
38 lines
579 B
Nix
38 lines
579 B
Nix
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
enabled = config.mod.openvpn.enable;
|
|
in
|
|
{
|
|
options = {
|
|
mod.openvpn = {
|
|
enable = lib.mkEnableOption "enable openpn module";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf enabled {
|
|
home-manager.users.alex = {
|
|
home.packages = [
|
|
pkgs.openvpn
|
|
];
|
|
};
|
|
|
|
services.resolved = {
|
|
enable = true;
|
|
dnssec = "false";
|
|
domains = [ "~." ];
|
|
fallbackDns = [
|
|
"1.1.1.1#one.one.one.one"
|
|
"1.0.0.1#one.one.one.one"
|
|
];
|
|
extraConfig = ''
|
|
DNSOverTLS=yes
|
|
'';
|
|
};
|
|
};
|
|
}
|