nixos: services.doh-server

nixos/modules/module-list.nix

@@ -1055,6 +1055,7 @@
   ./services/networking/dnsmasq.nix
   ./services/networking/dnsproxy.nix
   ./services/networking/doh-proxy-rust.nix
+  ./services/networking/doh-server.nix
   ./services/networking/ejabberd.nix
   ./services/networking/envoy.nix
   ./services/networking/epmd.nix

nixos/modules/services/networking/doh-server.nix

@@ -0,0 +1,153 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.doh-server;
+  configFile =
+    let quoteList = (l: concatStringsSep ", " (map (x: ''"${x}"'') l));
+    in pkgs.writeText "doh-server.conf" ''
+      listen = [${quoteList cfg.listen}]
+      local_addr = "${cfg.localAddr}"
+      cert = "${cfg.cert}"
+      key = "${cfg.key}"
+      path = "${cfg.path}"
+      upstream = [${quoteList cfg.upstream}]
+      timeout = ${toString cfg.timeout}
+      tries = ${toString cfg.tries}
+      verbose = ${boolToString cfg.verbose}
+      log_guessed_client_ip = ${boolToString cfg.logGuessedClientIP}
+      ecs_allow_non_global_ip = ${boolToString cfg.ecsAllowNonGlobalIP}
+      ecs_use_precise_ip = ${boolToString cfg.ecsUsePreciseIP}
+    '';
+in {
+  options.services.doh-server = {
+    enable = mkEnableOption "DNS-over-HTTPS server";
+
+    package = lib.mkPackageOption pkgs "dns-over-https" { };
+
+    listen = mkOption {
+      type = types.listOf types.str;
+      default = [ "127.0.0.1:8053" "[::1]:8053" ];
+      description = "HTTP listen port";
+    };
+
+    localAddr = mkOption {
+      type = types.str;
+      default = "";
+      description = ''
+        Local address and port for upstream DNS.
+        If left empty, a local address is automatically chosen.
+      '';
+    };
+
+    cert = mkOption {
+      type = types.str;
+      default = "";
+      description = ''
+        TLS certification file.
+        If left empty, plain-text HTTP will be used.
+        You are recommended to leave empty and to use a server load balancer (e.g. Caddy, Nginx) and set up TLS there, because this program does not do OCSP Stapling, which is necessary for client bootstrapping in a network environment with completely no traditional DNS service.
+      '';
+    };
+
+    key = mkOption {
+      type = types.str;
+      default = "";
+      description = "TLS private key file";
+    };
+
+    path = mkOption {
+      type = types.str;
+      default = "/dns-query";
+      description = "HTTP path for resolve application";
+    };
+
+    upstream = mkOption {
+      type = types.listOf types.str;
+      default =
+        [ "udp:1.1.1.1:53" "udp:1.0.0.1:53" "udp:8.8.8.8:53" "udp:8.8.4.4:53" ];
+      description = ''
+        Upstream DNS resolver.
+        If multiple servers are specified, a random one will be chosen each time.
+        You can use "udp", "tcp" or "tcp-tls" for the type prefix.
+        For "udp", UDP will first be used, and switch to TCP when the server asks to or the response is too large.
+        For "tcp", only TCP will be used.
+        For "tcp-tls", DNS-over-TLS (RFC 7858) will be used to secure the upstream connection.
+      '';
+    };
+
+    timeout = mkOption {
+      type = types.int;
+      default = 10;
+      description = "Upstream timeout";
+    };
+
+    tries = mkOption {
+      type = types.int;
+      default = 3;
+      description = "Number of tries if upstream DNS fails";
+    };
+
+    verbose = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable logging";
+    };
+
+    logGuessedClientIP = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable log IP from HTTPS-reverse proxy header: X-Forwarded-For or X-Real-IP
+        Note: http uri/useragent log cannot be controlled by this config
+      '';
+    };
+
+    ecsAllowNonGlobalIP = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        By default, non global IP addresses are never forwarded to upstream servers.
+        This is to prevent two things from happening:
+          1. the upstream server knowing your private LAN addresses;
+          2. the upstream server unable to provide geographically near results,
+            or even fail to provide any result.
+        However, if you are deploying a split tunnel corporation network environment, or for any other reason you want to inhibit this behavior and allow local (eg RFC1918) address to be forwarded, change the following option to "true".
+      '';
+    };
+
+    ecsUsePreciseIP = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        If ECS is added to the request, let the full IP address or cap it to 24 or 128 mask. This option is to be used only on private networks where knowledge of the terminal endpoint may be required for security purposes (eg. DNS Firewalling). Not a good option on the internet where IP address may be used to identify the user and not only the approximate location.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = "Extra contents appended to doh-server.conf";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.doh-server = {
+      description = "DNS-over-HTTPS Server";
+      documentation = [ "https://github.com/m13253/dns-over-https" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        ExecStart = "${cfg.package}/bin/doh-server -conf ${configFile}";
+        LimitNOFILE = 1048576;
+        Restart = "always";
+        RestartSec = 3;
+        Type = "simple";
+        DynamicUser = true;
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ DictXiong ];
+}