dns: Disable forwarding and resolve all requests yourself

modules/system/services/dns.nix

@@ -16,12 +16,9 @@ in
       unbound = {
         enable = true;
 
-        settings = {
+        settings.server = {
-          server = {
           interface = [ netCfg.overlay.interface ];
-            access-control = [
+          access-control = [ "${toString netCfg.overlay.networkCidr} allow" ];
-              "${toString netCfg.overlay.networkCidr} allow"
-            ];
 
           local-zone = "\"${netCfg.overlay.domain}.\" static";
           local-data =
@@ -43,15 +40,6 @@ in
             in
             nodeRecords ++ serviceRecords;
         };
-
-          forward-zone = lib.singleton {
-            name = ".";
-            forward-addr = [
-              "1.1.1.1"
-              "8.8.8.8"
-            ];
-          };
-        };
       };
 
       nebula.networks.mesh.firewall.inbound = lib.singleton {

modules/system/services/nebula/default.nix

@@ -108,7 +108,10 @@ in
       matchConfig.Name = netCfg.overlay.interface;
       address = [ netCfg.overlay.cidr ];
       dns = netCfg.overlay.dnsServers;
-      domains = [ netCfg.overlay.domain ];
+      domains = [
+        netCfg.overlay.domain
+        "~." # Route all DNS traffic to this interface first
+      ];
     };
   };
 }