modules/system/services/dns.nix

@@ -16,9 +16,12 @@ in
       unbound = {
         enable = true;
 
-        settings.server = {
+        settings = {
+          server = {
             interface = [ netCfg.overlay.interface ];
-          access-control = [ "${toString netCfg.overlay.networkCidr} allow" ];
+            access-control = [
+              "${toString netCfg.overlay.networkCidr} allow"
+            ];
 
             local-zone = "\"${netCfg.overlay.domain}.\" static";
             local-data =
@@ -40,6 +43,15 @@ in
               in
               nodeRecords ++ serviceRecords;
           };
+
+          forward-zone = lib.singleton {
+            name = ".";
+            forward-addr = [
+              "1.1.1.1"
+              "8.8.8.8"
+            ];
+          };
+        };
       };
 
       nebula.networks.mesh.firewall.inbound = lib.singleton {

modules/system/services/nebula/default.nix

@@ -108,10 +108,7 @@ in
       matchConfig.Name = netCfg.overlay.interface;
       address = [ netCfg.overlay.cidr ];
       dns = netCfg.overlay.dnsServers;
-      domains = [
+      domains = [ netCfg.overlay.domain ];
-        netCfg.overlay.domain
-        "~." # Route all DNS traffic to this interface first
-      ];
     };
   };
 }