darmanandClaude Sonnet 5
6f24ab69ad
Comments had drifted into multi-paragraph narrative (git commit lineage, debugging stories, restated code) in several hot spots (scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix). Trim every comment to its load-bearing "why" — gotchas, safety warnings, and non-obvious rationale survive verbatim in substance, just tightened to 1-2 sentences; historical narrative and anything already covered in CLAUDE.md is cut. No code/logic changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
37 lines
1.2 KiB
Nix
37 lines
1.2 KiB
Nix
{ ... }:
|
|
|
|
# Local recursive DNS resolver (privacy + DNSSEC) that the adblock DNS
|
|
# (pihole/AdGuard) forwards to instead of a public upstream — listens on
|
|
# 127.0.0.1:5335, so point the adblock engine's upstream there:
|
|
# AdGuard: dns.upstream_dns = [ "127.0.0.1:5335" ];
|
|
# pihole: upstream = "127.0.0.1#5335";
|
|
{
|
|
services.unbound = {
|
|
enable = true;
|
|
# Do NOT point resolv.conf at unbound: it listens on :5335, not :53, so
|
|
# that leaves the host with no resolver until pihole binds :53 — a
|
|
# boot-time deadlock. Host resolves via networking.nameservers instead.
|
|
resolveLocalQueries = false;
|
|
# NixOS manages the DNSSEC root trust anchor (unbound-anchor).
|
|
settings.server = {
|
|
interface = [ "127.0.0.1" ];
|
|
port = 5335;
|
|
access-control = [ "127.0.0.0/8 allow" ];
|
|
|
|
do-ip6 = "no"; # flip to yes if you resolve over IPv6
|
|
prefer-ip6 = "no";
|
|
|
|
# Privacy / hardening (standard pi-hole+unbound guide).
|
|
hide-identity = true;
|
|
hide-version = true;
|
|
harden-glue = true;
|
|
harden-dnssec-stripped = true;
|
|
use-caps-for-id = false;
|
|
qname-minimisation = true;
|
|
|
|
edns-buffer-size = 1232;
|
|
prefetch = true;
|
|
};
|
|
};
|
|
}
|