Block ads via dnscrypt-proxy

modules/monitoring.nix

@@ -53,38 +53,20 @@ with pkgs;
         enabledCollectors = [ "systemd" ];
         port = 9002;
       };
-      zfs.enable = true;
-      wireguard.enable = true;
       postgres.enable = true;
       smartctl.enable = true;
-      dnsmasq.enable = true;
-      nginx = {
-        enable = true;
-        scrapeUri = "http://localhost:8282/nginx_status";
-      };
     };
     scrapeConfigs = [{
       job_name = "zion";
       static_configs = [{
         targets = [
           "localhost:${toString config.services.prometheus.exporters.node.port}"
-          "localhost:${toString config.services.prometheus.exporters.zfs.port}"
-          "localhost:${
-            toString config.services.prometheus.exporters.wireguard.port
-          }"
           "localhost:${
             toString config.services.prometheus.exporters.postgres.port
           }"
           "localhost:${
             toString config.services.prometheus.exporters.smartctl.port
           }"
-          "localhost:${
-            toString config.services.prometheus.exporters.dnsmasq.port
-          }"
-          "localhost:${
-            toString config.services.prometheus.exporters.nginx.port
-          }"
-          "localhost:9641"
         ];
       }];
     }];

modules/networking.nix

@@ -108,7 +108,7 @@ in {
       local-ttl = 300;
 
       conf-file = "${pkgs.dnsmasq}/share/dnsmasq/trust-anchors.conf";
-      dnssec = true;
+      dnssec = false;
 
       address = "/coolneng.duckdns.org/192.168.13.2";
     };
@@ -129,6 +129,8 @@ in {
         minisign_key =
           "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
       };
+      blocked_names.blocked_names_file =
+        "/var/lib/dnscrypt-proxy/blocklist.txt";
     };
   };
 

modules/periodic.nix

@@ -1,8 +1,8 @@
 { config, lib, pkgs, ... }:
 
 let
-  stateDir = "/var/lib/dnsmasq";
-  blocklist = "${stateDir}/dnsmasq.blacklist.txt";
+  stateDir = "/var/lib/dnscrypt-proxy";
+  blocklist = "${stateDir}/blocklist.txt";
 
 in {
   # PostgreSQL daily backups
@@ -20,13 +20,9 @@ in {
     wantedBy = [ "default.target" ];
     path = with pkgs; [ curl coreutils ];
     script = ''
-      curl -L https://github.com/notracking/hosts-blocklists/raw/master/dnsmasq/dnsmasq.blacklist.txt -o ${blocklist}
-      sed "/cainiao/d" -i ${blocklist}
+      curl -L https://download.dnscrypt.info/blacklists/domains/mybase.txt -o ${blocklist}
     '';
     serviceConfig.Type = "oneshot";
-    postStop = ''
-      chown -R dnsmasq ${stateDir}
-    '';
     startAt = "02:00:00";
   };
 

modules/webstack.nix

@@ -159,18 +159,6 @@
           proxyWebsockets = true;
         };
       };
-      "/nginx_status/" = {
-        listen = [{
-          addr = "127.0.0.1";
-          port = 8282;
-        }];
-        extraConfig = ''
-          stub_status on;
-          access_log   off;
-          allow 127.0.0.1;
-          deny all;
-        '';
-      };
       "nightscout.coolneng.duckdns.org" = {
         enableACME = true;
         forceSSL = true;