snowflake/hosts/haru/services/blocky.nix

139 lines
4.9 KiB
Nix
Raw Normal View History

2023-11-30 23:15:59 -05:00
{pkgs, ...}: {
2023-11-30 22:27:58 -05:00
networking.firewall.allowedTCPPorts = [53 4000];
networking.firewall.allowedUDPPorts = [53];
2023-11-30 23:15:59 -05:00
environment.systemPackages = [pkgs.blocky];
2023-11-30 22:27:58 -05:00
services.blocky = {
enable = true;
settings = {
connectIPVersion = "v4";
upstreamTimeout = "30s";
startVerifyUpstream = false;
minTlsServeVersion = "1.2";
log = {
level = "debug";
privacy = true;
};
ports = {
dns = 53;
http = 4000;
https = 443;
};
upstream.default = [
"1.1.1.1"
"1.0.0.1"
"9.9.9.9"
"https://1.1.1.1/dns-query"
"https://dns.quad9.net/dns-query"
"https://dns-unfiltered.adguard.com/dns-query"
];
blocking = {
loading = {
strategy = "fast";
concurrency = 8;
};
blackLists = {
ads = [
"https://blocklistproject.github.io/Lists/ads.txt"
"https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
"https://adaway.org/hosts.txt"
"https://v.firebog.net/hosts/AdguardDNS.txt"
"https://v.firebog.net/hosts/Admiral.txt"
"https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt"
"https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt"
"https://v.firebog.net/hosts/Easylist.txt"
"https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext"
"https://raw.githubusercontent.com/FadeMind/hosts.extras/master/UncheckyAds/hosts"
"https://raw.githubusercontent.com/bigdargon/hostsVN/master/hosts"
];
tracking = [
"https://v.firebog.net/hosts/Easyprivacy.txt"
"https://v.firebog.net/hosts/Prigent-Ads.txt"
"https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.2o7Net/hosts"
"https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt"
"https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt"
];
malicious = [
"https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareHosts.txt"
"https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt"
"https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt"
"https://v.firebog.net/hosts/Prigent-Crypto.txt"
"https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Risk/hosts"
"https://v.firebog.net/hosts/RPiList-Phishing.txt"
"https://v.firebog.net/hosts/RPiList-Malware.txt"
];
misc = [
"https://zerodot1.gitlab.io/CoinBlockerLists/hosts_browser"
"https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts"
];
};
whiteLists = {
default = [
"https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/whitelist.txt"
2023-12-07 02:25:52 -05:00
"https://raw.githubusercontent.com/anudeepND/whitelist/master/domains/optional-list.txt"
2023-11-30 22:27:58 -05:00
];
};
clientGroupsBlock = {
default = [
"ads"
"tracking"
"malicious"
"misc"
];
};
};
customDNS = {
customTTL = "1h";
mapping = {
# infra
"truenas.internal.flake.sh" = "192.168.1.199";
"assistant.internal.flake.sh" = "192.168.1.189";
2023-12-07 06:09:55 -05:00
"dashboard.internal.flake.sh" = "192.168.1.98";
2023-11-30 22:27:58 -05:00
"udm.internal.flake.sh" = "192.168.1.1";
"pve.internal.flake.sh" = "192.168.1.37";
2023-12-06 00:40:24 -05:00
"pbs.internal.flake.sh" = "192.168.1.38";
2023-11-30 22:27:58 -05:00
# media
2023-12-07 06:09:55 -05:00
"jellyfin.internal.flake.sh" = "192.168.1.98";
"jellyseerr.internal.flake.sh" = "192.168.1.98";
2023-11-30 22:27:58 -05:00
"sonarr.internal.flake.sh" = "192.168.1.54";
"radarr.internal.flake.sh" = "192.168.1.54";
2023-12-13 11:22:07 -05:00
"readarr.internal.flake.sh" = "192.168.1.54";
"whisparr.internal.flake.sh" = "192.168.1.54";
2023-11-30 22:27:58 -05:00
"prowlarr.internal.flake.sh" = "192.168.1.54";
2023-12-07 06:09:55 -05:00
"stash.internal.flake.sh" = "192.168.1.98";
2023-12-06 00:40:24 -05:00
"nextcloud.internal.flake.sh" = "192.168.1.199";
2023-11-30 22:27:58 -05:00
# misc
2023-12-07 06:09:55 -05:00
"wallos.internal.flake.sh" = "192.168.1.98";
2023-12-06 21:11:25 -05:00
"synology.internal.flake.sh" = "192.168.1.71";
2023-11-30 22:27:58 -05:00
};
};
redis = {
address = "100.94.214.100:6381";
password = "blocky";
database = 2;
required = false;
connectionAttempts = 10;
connectionCooldown = "5s";
};
caching = {
minTime = "2h";
maxTime = "12h";
maxItemsCount = 0;
prefetching = true;
prefetchExpires = "2h";
prefetchThreshold = 5;
};
prometheus = {
enable = true;
path = "/metrics";
};
};
};
}