dns: Disable forwarding and resolve all requests yourself

modules/system/services/dns.nix

@@ -16,41 +16,29 @@ in
       unbound = {
         enable = true;
 
-        settings = {
+        settings.server = {
-          server = {
+          interface = [ netCfg.overlay.interface ];
-            interface = [ netCfg.overlay.interface ];
+          access-control = [ "${toString netCfg.overlay.networkCidr} allow" ];
-            access-control = [
-              "${toString netCfg.overlay.networkCidr} allow"
-            ];
 
-            local-zone = "\"${netCfg.overlay.domain}.\" static";
+          local-zone = "\"${netCfg.overlay.domain}.\" static";
-            local-data =
+          local-data =
-              let
+            let
-                nodeRecords =
+              nodeRecords =
-                  netCfg.nodes
+                netCfg.nodes
-                  |> lib.map (node: "\"${node.hostName}.${node.overlay.domain}. A ${node.overlay.address}\"");
+                |> lib.map (node: "\"${node.hostName}.${node.overlay.domain}. A ${node.overlay.address}\"");
-                serviceRecords =
+              serviceRecords =
-                  self.nixosConfigurations
+                self.nixosConfigurations
+                |> lib.attrValues
+                |> lib.concatMap (
+                  host:
+                  host.config.custom.services.caddy.virtualHosts
                   |> lib.attrValues
-                  |> lib.concatMap (
+                  |> lib.map (vHost: vHost.domain)
-                    host:
+                  |> lib.filter (domain: self.lib.isPrivateDomain domain)
-                    host.config.custom.services.caddy.virtualHosts
+                  |> lib.map (domain: "\"${domain}. A ${host.config.custom.networking.overlay.address}\"")
-                    |> lib.attrValues
+                );
-                    |> lib.map (vHost: vHost.domain)
+            in
-                    |> lib.filter (domain: self.lib.isPrivateDomain domain)
+            nodeRecords ++ serviceRecords;
-                    |> lib.map (domain: "\"${domain}. A ${host.config.custom.networking.overlay.address}\"")
-                  );
-              in
-              nodeRecords ++ serviceRecords;
-          };
-
-          forward-zone = lib.singleton {
-            name = ".";
-            forward-addr = [
-              "1.1.1.1"
-              "8.8.8.8"
-            ];
-          };
         };
       };
 

modules/system/services/nebula/default.nix

@@ -108,7 +108,10 @@ in
       matchConfig.Name = netCfg.overlay.interface;
       address = [ netCfg.overlay.cidr ];
       dns = netCfg.overlay.dnsServers;
-      domains = [ netCfg.overlay.domain ];
+      domains = [
+        netCfg.overlay.domain
+        "~." # Route all DNS traffic to this interface first
+      ];
     };
   };
 }