kekl

hosts/kepler/mod/freedom/default.nix

@@ -0,0 +1,9 @@
+_:
+{
+  imports = [
+    ./invidious.nix
+    ./nitter.nix
+    ./tor.nix
+    ./unbound.nix
+  ];
+}

hosts/kepler/mod/freedom/invidious.nix

@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+{
+  services = {
+    invidious = {
+      enable = true;
+      port = 3001;
+    };
+  };
+}

hosts/kepler/mod/freedom/nitter.nix

@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+{
+  services = {
+    nitter = {
+      enable = true;
+
+      server = {
+        https = true;
+        port = 3002;
+        hostname = "nitter twitter";
+      };
+    };
+  };
+}

hosts/kepler/mod/freedom/tor.nix

@@ -0,0 +1,15 @@
+_:
+{
+  services.tor = {
+    enable = true;
+    enableGeoIP = true;
+    client = {
+      enable = true;
+      socksListenAddress = { 
+        IsolateDestAddr = true; 
+        addr = "10.11.0.10"; 
+        port = 9050;
+      };
+    };
+  };
+}

hosts/kepler/mod/freedom/unbound.nix

@@ -0,0 +1,28 @@
+_:
+{
+  services.unbound = {
+    enable = true;
+    enableRootTrustAnchor = true;
+    settings = {
+      server = {
+        interface = [ "127.0.0.1" "10.11.0.10" ];
+
+        access-control = [
+          "127.0.0.0/8 allow"
+          "10.11.0.0/24 allow"
+        ];
+        
+        prefetch = true;
+        prefetch-key = true;
+        qname-minimisation = true;
+
+        hide-identity = true;
+        hide-version = true;
+
+        harden-glue = true;
+        harden-below-nxdomain = true;
+        harden-dnssec-stripped = true;
+      };
+    };
+  };
+}