replace DNSCrypt for DNS in IPsec transport

This commit is contained in:
Michele Guerini Rocco 2024-07-23 00:11:46 +02:00
parent c8e3d63d41
commit 6114b6bd28
Signed by: rnhmjoj
GPG Key ID: BFBAF4C975F76450
7 changed files with 73 additions and 124 deletions

View File

@ -48,19 +48,22 @@
443 80 # reverse proxy
993 # imaps server
25 465 # smtp(s) server
3551 # apcups
18080 # monero p2p
22000 # syncthing transfer
64738 # mumble server
];
firewall.allowedUDPPorts = [
443 # dnscrypt
500 # ipsec
53 # dns
21027 # syncthing discovery
64738 # mumble server
];
nftables.enable = true;
firewall.extraInputRules = ''
meta l4proto esp counter accept comment "allow ipsec"
'';
usePredictableInterfaceNames = false;
nameservers = [ "127.0.0.1" ];
@ -341,8 +344,6 @@
enableSTS = ''
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
'';
listenTLS = [ { addr = "localhost"; port = 443; ssl = true; } ];
listenPlain = [ { addr = "[::]"; port = 80; } { addr = "0.0.0.0"; port = 80; } ];
in
rec {
enable = true;
@ -361,7 +362,6 @@
enableACME = true;
forceSSL = true;
default = true;
listen = listenTLS ++ listenPlain;
extraConfig = disableLog + enableSTS;
# Returns IP address
@ -404,7 +404,6 @@
# Breve URL shortner
virtualHosts."brve.bit" = with config.secrets; {
forceSSL = true;
listen = listenTLS ++ listenPlain;
sslCertificate = certs.breve.crt;
sslCertificateKey = certs.breve.key;
@ -418,7 +417,6 @@
# The Cactalogue
virtualHosts."cacta.bit" = {
root = "/run/nginx/static/cactalogue";
listen = listenPlain;
extraConfig = disableLog;
};
virtualHosts."cacta.eurofusion.eu" = virtualHosts."cacta.bit";

View File

@ -58,13 +58,6 @@
# Keep the key stable across renewals (for DANE)
security.acme.certs.${config.mailserver.fqdn}.extraLegoRenewFlags = [ "--reuse-key" ];
# Listen on localhost:443 for sslh
services.nginx.virtualHosts.${config.mailserver.fqdn}.listen =
[ { addr = "localhost"; port = 443; ssl = true; }
{ addr = "[::]"; port = 80; }
{ addr = "0.0.0.0"; port = 80; }
];
# Utilities
environment.systemPackages = [
# computes the DANE records

View File

@ -58,11 +58,6 @@ in
services.nginx.virtualHosts."riot.${config.var.hostname}" =
{ enableACME = true;
forceSSL = true;
listen =
[ { addr = "localhost"; port = 443; ssl = true; }
{ addr = "[::]"; port = 80; }
{ addr = "0.0.0.0"; port = 80; }
];
locations."/" =
{ index = "index.html";
alias = (pkgs.element-web.override { inherit conf; }) + "/";

View File

@ -1,9 +1,8 @@
{ config, lib, ... }:
# Setup:
# pdns-recursor on localhost:55
# dnsdist on port 53 (DNS) and localhost:54 (DNSCrypt)
# sslh handling both HTTP and DNS on port 443
# pdns-recursor on localhost:54
# dnsdist on port 53 (DNS)
# ncdns for Namecoin bit. zone resolution
{
@ -12,7 +11,7 @@
{ enable = true;
# Configures the bit. zone
resolveNamecoin = true;
dns.port = 55;
dns.port = 54;
};
# Public DNS resolver
@ -26,40 +25,10 @@
setACL({"0.0.0.0/0", "::/0"})
-- Set upstream resolver
newServer({address="[::1]:55", name="pdns"})
newServer({address="[::1]:54", name="pdns"})
'';
};
# DNSCrypt endpoint
services.dnsdist.dnscrypt =
{ enable = true;
listenAddress = "[::1]";
listenPort = 54;
providerKey = config.secrets.dnscrypt.sec;
};
# Demultiplex HTTP and DNS from port 443
services.sslh =
{ enable = true;
method = "ev";
settings.transparent = true;
settings.listen = with config.var; lib.mkForce
[ { host = hostname; port = "443"; is_udp = false; }
{ host = hostname; port = "443"; is_udp = true; }
];
settings.protocols =
[ # Send TLS to nginx (TCP)
{ name = "tls"; host = "localhost"; port= "443"; }
# Send DNSCrypt to dnscrypt-wrapper (TCP or UDP)
{ name = "anyprot"; host = "localhost"; port = "54"; }
{ name = "anyprot"; host = "localhost"; port = "54";
is_udp = true; udp_timeout = 100; }
];
};
# This is needed for the rotation of DNSCrypt keys
security.polkit.enable = true;
# Namecoin resolver
services.ncdns =
{ enable = true;

View File

@ -1,67 +1,64 @@
U2FsdGVkX1/nq5r1BVTsdStBBh8D6Yi9VfVJIHCJHzAZ5rbTWx2r/ZXrjzw7u7ZN
kQsRXP/4vpP89IgEblly8uQYdbgkpdT3LQBHke9lCxGF0TneQTgTqGxKZOpCWkNV
ikGX3u8ROYJizOpxxG9r/dPtxioKMTuAYIzYHhgtlbMKvgnalX7LuXCRo1XWfJ5p
yt58x0JI7ji4R8r7q8zrTqHWg2SOYFKTRL1p6xhmUa2vLbvg2LFT7rRWLmfothkK
0rZAxP1Xo4EC3BvaIYusGXh6co7X3tQDrYLtaozuTSlJqMMT60iua69oIbmz6M3U
VuYz6cMPnwDFK/yCM/WnM8xcbm8ek81luTqcBYFMXzjRRXOfoReyYXw3FaF20a2y
y5fLXBy7+U9VSgWwIgJLJadaDxkxr+ovyKuGzMCieuqm856BwYRWJp+P2/Ik0Zhw
2GCjR3Z5eVCZYwCiNaA7QUrNt7vXzBjj+lMk5/65zwuJ1EIp3XvQLPbv0FBMc7nB
ztvHcj9XxLV31CNY4fU1NIggxdNF/2Y6h5uCqIpmAQzDVWpcfTDvJrTLdvT7mCLY
ZUnzcG1KPt2oIkQduO1tU1zBEP99wgXcVdB13Vn5ZWvlafhq4kVG+l2gtyZtldlw
kZ+psem6w2zREx8+Ow0Ga9M2zCs9JNROXmLTFaOTFOfh6WpnWR+xxGo21DlgbwXp
RaKvaJ0j0FiSinXzP7SBU+eTsTx3Mj1Dcn6IId6PfFG0lslxFcCeijy4sigU0QHM
oYmP+g8crcAoRFzCJqFEj1HwbNrF6hejt2w0Agwo+GnakeGUvxu7+r45cu0BgJWm
hJgoPOkErWeqHOaM3xM9QRS3qcHeOWN8b9eCeBAVUK2qNfEB4S+YjJhyjEY+eD4+
VshudyKsGDgxYkuYGuz49UqhEQgn3sqR56jtEWSkxVwZ1kxr/XkLclT2KhzU5nOi
QSCnQnfrBB0T6Tvg0xBCDzGFTYaVXmVuMn4sfnqqOYJY1jgpy/zXegFvauGqtoN2
3nxYehXafHEazcSxJXOAXWGURfuvHsxLXsPqjLPva5T5px4J7oM5vc0+ACeyrU8D
LdVIZMmtn5UaK+JnnrhLPvbe1RwVKY7WuXCZ5yh6r1OhRswsMcNAYLs2JAg+eqvb
wra1hHH8pAO2LSxQZ5aB14PN82161UXQ4c6TootvXYlLQnKxTndUZyaz8JvGZptZ
EdHcXtD/otB4fjfQClj+TF6jfinPAheoCwrTbErYjH7WWDUMPUIT2t77peY1ieXU
xasx/+i7dtRepn/WTPB6HbhQG4e56RYYbibeKRW3UXUcXjuI2pyAD0IW9aq7Sy0b
s5GwH8WSElaZAwsaOCt4p+LykyxK8csWokRIGjWOKQf/rNMgkYBu4mr38dR6rzj8
sGu8z9WfaxSwF+mqWa8id1rOyxsfeXKniTsZhuYQ8WHOI5QRn+IWBaS4eP8SnCNm
Fc0Qil5/0iYu9u7kIRsfjHghXxVbHdFIWF2FZDWe1bVnDrxxzRKg0SIWj/ecYVzd
mPV/x1qpOeNvERNdf/ltq72q/TND1HQHu/YYLb1WH50mgcopeuSt5zuQiUhltLIf
kZplCic7vk3JPiiyA2rI7f4Tm7YZlTpupJcJytkmo/INPJUHDzjko8EZZ6dzceqQ
SZB3OZR9BPnqJKd1AOZSN8StEoJcpcr1vNLVgRg8D+I6W/n9ClQBpCz/hhn8ruRc
SJAU8IghHgfQPQ2pyuvVhpSobrFtWz/36jTuxNUo/Jsd2f7TWy3IX0taimCxBlL5
8rqefN8EHGa9EYRmnr9E4yK16CjjxyDk3IZeWxb3KRlfW0zfbqNQ2FJdAPA8ViYZ
EqHJFUxIGuWUKelp3YW2RUMfHtNTqrEQJytoTRVL7trY+u4g5TypdAXJ/LvRhAWk
3Oxpzq/+zpJ8x0FR7ZguqcIJaysFWFTIoAqkH8Z1JkZ3I1VGXqVUFY+1tlqDFtAY
7sk7InsLqVCaKt392Vxl4vhkapNjNLlJbYVb3QwJhvFDwRktBYfdLLTIjh6iGXRn
PPmjKW1eCQ1KWuLrndEcB+Ai9JccoDmxdm7Avgu2gikGeYswt1gekKL0zSxptxJt
48TfsC6jDxaezHN9P4dDszsMEU6xsyro8WpkQCojcuSkduP2xhxrLUmC/bn2/VNv
R6yyiAGOMCzKGWQh+w2PpmMlHLNNm8y3Hs11YtKkMcxLP9+wNJWcZ9ydqkpBwr3Y
6UZf+5aZxe2CUDSYRTNKc6jYEnYeoHoQs2fge0iHwfOGyMsjxiPk0yTuzRGWFlTB
XtAvkszQpxyXBPN5b8W038n8sOCArSb5Y+GsglZvVuG3Q0C9XvT2fQSjlMSLPVpT
hnUuzcyemPZAn6z0fR5lD+oe+LQWJro1aW/Om5WrsWIXrUfgTggJzUdhQIxqK9b2
tO7cdG5lk0voR/GEZv4S7/OjaNgANUGx85mv78d63prdRP7eZbCJ8Uqe9rHKLv2Z
EClRnknkYbivBxVkY4PBUIgXLJpd7W7QtiXsLD/tOE46xRIc9nVjtfO4vqgUdyg9
XL0xlprIB16q4uu5qxvPvIdt4QIKV5RlhoxP5gutqC/b0Tp2nQ19PmGuxlstHz5B
mrWlOINWsKdOgV/+6lhCr+VAWrJ3bd6RSQtWY8cp/+i0HJbZAmnHKJ1gY5Raryi+
3tAU5lSuYjys1veB/gE2eP0IZHSXTul2YbbMTOqmT+5oreKZP3AvvhfVGtl1BfKh
vI2p4BEcocLalpkzfbxznI9bWwV2PtI3VjL0l1py/B71qTVUgwK624O4ZcMWhXMN
OojlTkBvvAJn2LjNxOvtvNYWw3SLhbH1H5+108sAZxI6PSkXNVJCfq9V5ZCS7Ulu
4a5/4HsSDlTxJULbAcXFWY5nMjsJrG+oc+enMVeGMn5pfdXIqm2c7QfrVbE53U66
uzMreQFA5KZknx5rSIwvoSrk9K1b0RuHD6e0pHd0UgjJHomeSnp3ABZDby/lfREC
OXrCnbUgeLrNbgtr3Q39Lau2TyVC2aaS/7nkcHjYMO5UZo0natRIIRnA7Nr42LOJ
d4y9CeZIADiR3Ig4iYrkaYu0Bpw86jofI6MgnB05ENZEyOOHJl5jMuwVbozrvYH3
zRI0Yu5AYKukE5jnY2mVg4Prt+wgpTVO1Nccu8JslhZj5phskJ5lVvLxEH25Hsx5
HX2PUy3HZbDcy8aKJClWOtJdS9y8g/VeCO5UUb8P3BqrtTswMCLwIHobyfWX/v7j
kUHsXntGarR4EMpd1cAPvqnTI4zrf0wHRdpZ1CMWd9V/wH2qn4UuGqTP/14n4oOA
XoFN22fDhkZWspAP3DfaLZHjn/2HMFkl1wdzjaKOetIV3oXH2TEW1IAGK+w1sfeq
TLdCDDASymkB5/lDvOR8zteH2ZeJYNvcULl0z4WjgzWuiEvF/iZ5PtJIHpeI1Zyl
0HLTmT9AUIj5VHJ209ggJxcO+EvGr9WdmkEtVPH6dCoCDvKK9OwkWXMEC5hoZNx0
CIMUJA8Jv2FyOIZZfLYdAupTQjy7cNBnVOfv4V9hurwBA86ZFjDllfDrPn0Fs7Et
tKsJunBJwLgppMcpEShfJWDvH4hxdgVpupq20a1V8DvojB+5mRc+bobi8XEGmo68
04P5D/aDocuVVTZApivGpiDg7tBkSYSsDP+lU3oSHyCCfDevCKiFRgcsQMLtbx1x
oZ65us8MXXWuRTrhAcFDCt91HKD+gTddxzX6Yn413nUXMNi9al0KnEn18zETuazU
FDwki40zyaZrvMYZTIWqLkqfkjmdHA+WlNNXUYZL0RiMbrmGXl8A4OYHX4HEa3jM
0C/8GmmDYwx1BQ3Tqu13DF45/TiybCWTtSvArApujvWI1KG8ek/LsVw42mkzju8J
itR1+SdCDtY5OOtluwlrx1yBQMKbEW/1jqol/qGqTXgKyzcEGeoPcKTtSNQcXoYY
IkpCh9u7AHEL9Tdpyk9oIMnzfnBDDJaU5hK2Myek0GdH49jUPaDTnSqY0zN6aKi4
CPmxvedHybEwMrPLEVUFpYT8EEXbJXPvC3qDN9iH4U8fEgkG0QP/bvb+iEAbgx3u
+CGCZtcp08dv0+cn5Bh7S8623vz10jt/txj23TvRlli/mt1UH7Vq9H9RroIMEd2I
etYUc/lNHKmCd8ekIOuq2oxk9j2uEqQv4s5jQKbIWfJ88VgNRMzlRNRTlkUpYI5C
7aANIfr8nbLdMqJ3f68=
U2FsdGVkX19Beh+m1FJMvUT8YVRn9/SaJTpPC7OlZt/wPuLTZACeborU3sKPkV6/
qIhjM4zLrN3+2ILD9aHP0cqTrY6WAJZDHwqgRXz5v4M7x5LGP1FUXQ/Sm1IjQ7HG
k9tVZFMcQ02EnxBiYR9P8GJDfjJ+iBu2CodzxcCIRJqvLtFh90UP7Atk9EIN+Wqr
k22RW2mS8pFqnnHtYupnrs6wPs2VDV7qk5jsdwUKX3nN3mqF1OWnlCnqsWpTnKKQ
TAfQBKIyTdzh8Q05OIEoI3eN1QvBtKmMHrjtvVPjlnjh38hf/2G51cRJDri1u+Xj
bwz10u0mqKLqpFcW6TMIYBiixBHZfClrZ7ZqWKvaaM2EwSD/4jWU5mi51kdyvovJ
Fued7ng7LFMP1asVBDJBZvyH3xGblRltUs7VyoCRhltq/DAQ3DJbn8JfUUDNr1AN
93dw4KTzEHZll4QqLkoP/QNAeDqLb+nV+ZDv8/comTOJIJfA/De8k9ZPSIIWicqO
CTGgzWW4xaJp4itIeTyYKcjiYO5P+pPBVmACO49BETds3uYQ/RNHhydoh6Mu1lXQ
xWrodYGhDbBfZ2SEH8H2Z9zNsMh6P1hDMRUOlywZSUqQI7JeKl3WrqUbUn/1KsiI
0VLkODthjaOaXf3j7hG9dCFurNO8Gy9qlhECiyOzms4BkNZTaCNaz0NB2vMnqCG5
iqTLNiOY2I8UjrXhNFqDgim0fv1g11foZKKh2jUX0iHSo+jZ2QEJjGIjBRxTDK0v
l3hLqe8twHnJuczj2MeZvkjPho+Mj40pKXSwngRfhbaRzwfMKqogFG8UOV3NZahp
pMAgabdLOSOqg4F8Z9ROu6C2+U4LLRyXBJTC4i04FDDtsZxeI3BN2LkGs6Ial498
nrCMrFR39RVoeIceDbs7cHcFgEcMsbPaQb8lkFiYiG3+ozuOmsphNEWlGWP9ZKvz
nUV+ig+feqInOHHWgzcb8UNH5Q5CFXiXMnIXVh6Syaqat59s577GTy5wZ1eGiJoe
8GSWzBZwRAc0E4p3YQeJX6CFoZInK7KSGSu6eqihsJht7NRRqrmyXJ20Qisy4f8a
TEatxQHGXk6a7GNfgnoBpb2srVaAvI6IX2UOv6E2+jm+MpDZylM4/U4q4VATaM5I
QshQtLrkG3QuZ7xGapS2O0HGY8j5jtH0gTPt+i4OITbPOBlOqfDlBixCjdloD3/5
RyNSAjngs5kZziOSATYVA2iSxzsELBUJGmN2lmfAqC17ulXNFV9kZDYSnNSmTUnm
C423wvX3U/OBW10inQgLmnwtT+D8nHXW2P/hGovjNxYvTqSCPYYBPf7gXCpkhxcg
I0/jDkD7sO30hIT4sf22cpDiEQ63kr686klDL+xQXOeZhimNSuUEhxga5OZJFkXm
so8R/i0Xrbma7Ddv51vasYpZ/RNIvo5Bk8t3MKt9yJTXoS9MhQPPz4+oubLQFVJY
CY6g4sGlB97Pw6aLJKAwFVzBxbNPYItM46hqPKxrujxEaTcjpFf7QguHFgO4ioNm
Duod11BEmJytElOuH0AXRmpxT+h3+LYmqoONgw3Y8g8eXRTd06sPXgReniUAggP5
iv+HrKoSUTC2rpXpoRiU2ciAu7PqaOV8ivZJEpACeCph8rrRe8JZlofEAHKbD3Bm
/kyBKRoRxg/uTq6Im2ED36oyFDdTvbwxuVpE7jiUtlDp2JDSyIdH6KNHRMpfpFVs
2xuPCK+fwX0r3Kx+xnhDYrnbdy8dzZXqOeM1wiZGC+x0C7At9alP+mwMgEm2HZG0
ItqrLc30KShcfbfcPH27U+Q92hTSlz7QuDENzlI1wPi4h4MU4wewWG2qEy7tfJNQ
37reHdt7u/gy3KZfXhLUpg5cYzSFzuSbtgLSoCia62ZyZkoVhyFbH42/jV7kD7Po
vLa6Fu/vUN+jzqjEeaJgY/UN1MauZkC6V9LjXTMcRVYqjUiJ3qrB5iGaZO9HiZ8V
8KGDFcicf172wucUkW3elpSHw8MwwmD9+hucdNPFDooaGP2qmct0SXpazJpcXdq0
zilNLYmhi8qGce3OVbZtbpadKYmj62kx1fG7jPF5Mry6YAm/DK0SAwSyY6wvYGbZ
r/WL0T3oj0H9m2L+KjgxDrhnbG5eA90dPcnUOnNRGkmrT8+BUR8zrtpJzfMU3lMK
WcOgC1+ahutSH7cPTjoTsS3/4qK2bQo+LZsXDj7LCayivacaDKe0ktTtvjobjRyK
h6RUcWe60g0lLGA0gu1/BdtenszGTSmitPF91373PBiLaF1rRR0MMxyRqdEWdGL4
kXMV+Yedc1rayjvjxzGIxz2Gjjiax8g48SWI5G1SgHHsnz812L1eSRvdWXicumfm
XViJs7OnCVp0gL6fyyQIAiiQmx5C56POsBmM9rmsdWLEiht72K2wr5ZyAInRumPU
sWprhYHsExWRZ0spaoYLFoHiXM1FdSSzUrD7E5WlOoOV1J9K+ansFFTF1OsX2/io
F11n/7wNjOq3Z/Fq4+bcbdh6wGnrw1zIM3IhDHlycWm63y5uRuQapLYrt2ZihZx9
qKyQF5mOmqITN7u2OjCJVJhH5g6iGqu/6txz2YW4IUQRl87TbRAzfsOVoP+/742/
tFgsarO5ybBVOg6YmubkKhYryPFmTR+2HE3cUK9EUEsN+Nww76oDgj7KdomNraSa
I3i2owfP/4VOB9NHhczNBkRkVEGitYMcrvwe4iPGfKsED7C0K2Q7rkaMjmDDgbdi
qfxnMrVqiJlEJ6okAxUIqySZlHsbD0aGbDNtIHRaYSL7K6w3hET4uvVMoDlpFTN8
uOdFqt9XOda+hNPNHjOZeTl37wjJY3wIQWRuyndDjaHUoAzUudKKk6+tx/c9TMvB
x/ymY4aZOvautyUlrzecNBsYxDuP96H+qGXhS9utlrnrnp3Rl0kJMZxECYUzXBYz
PlPxcyRZyG1YhxlQnXccl+jUAfGQUEQ7cYSHTbR8IZY37N84bCwVML3/k7QfAJDK
U+/ruq8G3uY44vLAIZqAIblel5I69s+LyLFvFXOsRtdgyIUOLW9O6HPG99ppG2E/
pkIord8sXGj439WA1/TIlQFbsdr/eI6lrqeP99wQ22ZUyZ59IY7IoDrhCYbJ1Qk9
z61jgYB+2acwUdWCyvmhkGpes1RaMnvmTrXrio8X70I8iREUjnCp5gtLANezS8cu
dHPYfRsU1mmIrVqfvDGBkROS7lC+JbBbDXLkJxoQhxBBhXjru1HJsflwYDgl+cDG
d3uWPgVJfe6e5Wy8LdpwIQvHZY1ct9/hUsAM5Gsybihyh3AN80gv29vPEkk1/HIs
5Q2qrfE4NSaRZR4NERrziFvV2U5xLYfaXhfnkseVtUXCobUFpivlpRiP9ed+tNOg
FU86B0Xa1LKVotTDFm/Rel7AWSXzYHfrUukgiYr7FmQ6+D/zVOupEIv/RHT3c8vg
gHXTQxhyp3BuWqclbrMPN12xb/8MsxlXL5kMZpw2NnO/2EPEYb2l/noKg8ISFMPs
4RnRx3ETR/tFUjZtiRdRUsBhI0/DlUgLUPRLRlq+52sfdgpCOJ8+2DOgEBuNioYZ
JjGRb242dddT69dWh04qvjUWAI20fU9yrytnF/ziKiQ1xQe/dXAPbXnycSW+IhH4
seqs0bignE0fI1wzREfw9Xr5rb8QbaSjf5P4BuHLSFPHIT6xQdfZijlWw2vpshxa
l1w5WE12vzNdQNzrveI+T55PI47QtcHlrFJ1554Z1xyTyndjpDRL5gbbyyo9JGas
wvZyIaNcfbugEem0cuz75oQ14UAKMxfwIAOxXhT8QKNYHR3aPdsFNB5VjGHYjzsT
I4clRA+b61Lu2o7GR4gT97+niiFKc+pMzg+L/7a4GTAFRlzun8m6xJs6BhX4UzOg
XHntFyCU5EVsW8k3FLJmJNMJQcMdS7vehnLNNFsnc3iltpbNknXg7Z0ZvUePlwF7
wQD66lPzA96sc5rfSGvUZcAg0d3GfX6gcb9EPE0egu2sqqz624ZkhconcQ02ldef
rPPURbVrgYuVHKDff2n36bc=

View File

@ -1 +0,0 @@
U2FsdGVkX19BEmmTgg2xvmlXY68UW/HM4hzhrFSMp/m/6R4gICH9vYcjhOtX0OI9

View File

@ -1,2 +0,0 @@
U2FsdGVkX1/VnjxajHAC1EY3kK5t+Ukk7nGg1HpCu1vasPgeslltagLIpZPWCVZB
Q2pgMIb4xT7JZf5W/YHVlsk7btYR9bf9tI+RMCULwdE=