{ config, lib, ... }: with lib; { options = { preDNS = { enable = mkOption { description = "Enable DNSSEC"; default = true; example = true; type = lib.types.bool; }; }; }; config = mkIf config.preDNS.enable { services = { openntpd.enable = true; resolved = { enable = true; dnssec = "allow-downgrade"; # TODO: Enable a toggle for ipv6 fallbackDns = [ "9.9.9.9" "2620:fe::fe" "149.112.112.112" "2620:fe::9" ]; extraConfig = '' [Resolve] DNS=45.90.28.0#8436c6.dns1.nextdns.io DNS=2a07:a8c0::#8436c6.dns1.nextdns.io DNS=45.90.30.0#8436c6.dns2.nextdns.io DNS=2a07:a8c1::#8436c6.dns2.nextdns.io DNSOverTLS=yes ''; }; }; }; # tailscale and what not have no preDNS }