unbound: updates

hosts/haru/services/blocky.nix

@@ -1,8 +1,4 @@
-{
-  pkgs,
-  config,
-  ...
-}: {
+{pkgs, ...}: {
   networking.firewall.allowedTCPPorts = [53 4000];
   networking.firewall.allowedUDPPorts = [53];
 
@@ -12,7 +8,7 @@
     enable = true;
     settings = {
       connectIPVersion = "v4";
-      upstreamTimeout = "30s";
+      upstreamTimeout = "5s";
       startVerifyUpstream = false;
       minTlsServeVersion = "1.2";
       log = {
@@ -23,12 +19,24 @@
         dns = 53;
         http = 4000;
         https = 443;
+        tls = 853;
+      };
+      upstreams = {
+        strategy = "strict";
+        timeout = "30s";
+        groups = {
+          default = [
+            "tcp+udp:127.0.0.1:5335"
+            "tcp-tls:dns.quad9.net"
+          ];
+        };
       };
-      upstream.default = ["tcp+udp:127.0.0.1:5335"];
       blocking = {
+        blockType = "nxDomain";
         loading = {
           strategy = "fast";
           concurrency = 8;
+          refreshPeriod = "4h";
         };
         blackLists = {
           ads = [
@@ -64,6 +72,9 @@
             "https://zerodot1.gitlab.io/CoinBlockerLists/hosts_browser"
             "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-only/hosts"
           ];
+          catchall = [
+            "https://big.oisd.nl/domainswild"
+          ];
         };
         whiteLists = {
           default = [
@@ -77,6 +88,7 @@
             "tracking"
             "malicious"
             "misc"
+            "catchall"
           ];
         };
       };
@@ -115,7 +127,7 @@
       redis = {
         address = "100.94.214.100:6381";
         password = "blocky";
-        database = 2;
+        database = 0;
         required = false;
         connectionAttempts = 10;
         connectionCooldown = "5s";
@@ -132,6 +144,9 @@
         enable = true;
         path = "/metrics";
       };
+      queryLog = {
+        type = "console";
+      };
     };
   };
 }

hosts/haru/services/unbound.nix

@@ -1,8 +1,8 @@
 _: {
   services.unbound = {
     enable = true;
-
     resolveLocalQueries = false;
+    enableRootTrustAnchor = true;
     settings = {
       server = {
         verbosity = 0;

hosts/sakura/services/grafana.nix

@@ -38,19 +38,19 @@ _: {
           {
             name = "Prometheus-kariru";
             type = "prometheus";
-            url = "http://192.168.1.54:9090";
+            url = "http://100.126.229.95:9090";
             orgId = 1;
           }
           {
             name = "Prometheus-yuki";
             type = "prometheus";
-            url = "http://192.168.1.36:9090";
+            url = "http://100.108.113.89:9090";
             orgId = 1;
           }
           {
             name = "Prometheus-arashi";
             type = "prometheus";
-            url = "http://192.168.1.211:9090";
+            url = "http://100.94.214.100:9090";
             orgId = 1;
           }
           {
@@ -59,6 +59,18 @@ _: {
             url = "http://100.104.42.96:9090";
             orgId = 1;
           }
+          {
+            name = "Prometheus-tsuru";
+            type = "prometheus";
+            url = "http://100.82.146.40:9090";
+            orgId = 1;
+          }
+          {
+            name = "Prometheus-kaze";
+            type = "prometheus";
+            url = "http://100.69.79.81:9090";
+            orgId = 1;
+          }
           {
             name = "Prometheus-haru";
             type = "prometheus";