nix-configs/systems/orangepihole/configuration.nix

{ config, lib, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ../../modules/common.nix
      ../../modules/networkd-base.nix
    ];

  boot.initrd.supportedFilesystems = [ "btrfs" ];
  boot.loader.grub.enable = false;
  boot.loader.generic-extlinux-compatible.enable = true;
  boot.loader.timeout = 1;

  networking = {
    hostName = "orangepihole"; # Define your hostname.
  };
  systemd.network.networks."40-end0" = {
    matchConfig.Name = "end0";
    address = [ "10.42.69.2/24" "fd72:3dd5:21ae:3c97::2/64" ];
    dns = [ "10.42.69.2" "fd72:3dd5:21ae:3c97::2" ];
    domains = [ "icanttype.org" ];
    gateway = [ "10.42.69.1" ];
    networkConfig.DHCPServer = true;
    dhcpServerConfig = {
      PoolOffset = 150;
      EmitDNS = true;
      DNS = "10.42.69.2";
      EmitRouter = true;
      Router = "10.42.69.1";
      SendOption = [ "15:string:icanttype.org" "119:string:icanttype.org" ];
    };
    networkConfig.IPv6SendRA = true;
    ipv6SendRAConfig.RouterLifetimeSec = 0;
    ipv6SendRAConfig.EmitDNS = false;
    ipv6Prefixes = [ { ipv6PrefixConfig.Prefix = "fd72:3dd5:21ae:3c97::/64"; } ];
  };

  zramSwap.enable = true;
  swapDevices = [ {device="/swapfile"; size=1024;}];
  services.unbound = {
    enable = true;
    settings = {
      server = {
        qname-minimisation = "yes";
        interface = [ "end0" ];
        access-control = [ "10.0.0.0/8 allow" "fc::/7 allow" ];
      };
      include = [ "/etc/unbound/ads.conf" "/etc/unbound/local.conf" ];
    };
  };
  
  systemd = {
    services.adblock = {
      startAt = "daily";
      postStop = "systemctl reload unbound";
      path = with pkgs; [ gawk wget ];
      script = ''
	wget -O - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/light.blacklist.conf > /etc/unbound/new.conf
	wget -O - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/unbound/tif.blacklist.conf >> /etc/unbound/new.conf
	echo 'local-zone: "iogames.space." always_nxdomain' >> /etc/unbound/new.conf
	echo 'local-zone: "taming.io." always_nxdomain' >> /etc/unbound/new.conf
        awk '!seen[$0]++' /etc/unbound/new.conf > /etc/unbound/ads.conf
        rm /etc/unbound/new.conf
      '';
    };
  };


  environment.systemPackages = with pkgs; [
    btrfs-progs
    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
    wget
  ];

  networking.firewall = {
    allowedUDPPorts = [ 53 67 68 ];
    allowedTCPPorts = [ 53 ];
  };

  system.stateVersion = "23.11"; # Did you read the comment?
  nix.buildMachines = [ {
    hostName = "zeus";
    systems = [ "x86_64-linux" "aarch64-linux" ];
    protocol = "ssh-ng";
    sshKey = "/root/.ssh/nixremote";
    sshUser = "nixremote";
    supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
  }];
  nix.distributedBuilds = true;
  nix.settings.max-jobs = 0;
}