From 82a02be85a9dc451f1f127d88e168d816f5aeaca Mon Sep 17 00:00:00 2001 From: Sonny Bakker Date: Sat, 26 Apr 2025 17:11:03 +0200 Subject: [PATCH] Use DNS over TLS & enable DNSSEC --- host_vars/desktop/network.yml | 2 +- host_vars/xps/network.yml | 6 ++++-- playbook.yml | 3 ++- templates/personal/desktop/network/enp1s0.network.j2 | 6 ++++-- templates/personal/xps/network/wlan0-frans.network.j2 | 6 ++++-- templates/personal/xps/network/wlan0-local.network.j2 | 6 ++++-- templates/personal/xps/network/wlan0.network.j2 | 3 +++ 7 files changed, 22 insertions(+), 10 deletions(-) diff --git a/host_vars/desktop/network.yml b/host_vars/desktop/network.yml index 8470e20..25eaf55 100644 --- a/host_vars/desktop/network.yml +++ b/host_vars/desktop/network.yml @@ -2,7 +2,7 @@ lan_interface: enp1s0 lan_interface_mac: 00:d8:61:9f:52:65 local_network_address: 192.168.2.15/24 -local_network_dns: 192.168.2.254 +local_network_dns: 9.9.9.9 149.112.112.112 local_network_gateway: 192.168.2.254 hostname: desktop diff --git a/host_vars/xps/network.yml b/host_vars/xps/network.yml index dbfa8ae..3fd2f25 100644 --- a/host_vars/xps/network.yml +++ b/host_vars/xps/network.yml @@ -3,12 +3,14 @@ wireless_interface_mac: 98:2c:bc:e3:ff:bc local_network_ssid: KPNAE51C6 local_network_address: 192.168.2.9/24 -local_network_dns: 192.168.2.254 +local_network_dns: 9.9.9.9 149.112.112.112 local_network_gateway: 192.168.2.254 frans_network_ssid: KPNDD1056 frans_network_address: 192.168.2.9/24 -frans_network_dns: 192.168.2.254 +frans_network_dns: 9.9.9.9 149.112.112.112 frans_network_gateway: 192.168.2.254 +default_network_dns: 9.9.9.9 149.112.112.112 + hostname: xps diff --git a/playbook.yml b/playbook.yml index 60eba42..be8a56a 100644 --- a/playbook.yml +++ b/playbook.yml @@ -29,7 +29,8 @@ - name: Personal provisiong when: "'personal' in group_names" block: - # TODO: require (w)lan interfaces before configuring these + # Note: set `network.dns.native_https_query` in about:config to prevent + # DoH requests by default. See https://github.com/arkenfox/user.js/issues/1881 - name: Wireguard provisioning ansible.builtin.import_tasks: 'tasks/personal/all/wireguard.yml' tags: wireguard diff --git a/templates/personal/desktop/network/enp1s0.network.j2 b/templates/personal/desktop/network/enp1s0.network.j2 index 1bfb866..af57302 100644 --- a/templates/personal/desktop/network/enp1s0.network.j2 +++ b/templates/personal/desktop/network/enp1s0.network.j2 @@ -5,10 +5,12 @@ Name={{ lan_interface }} [Network] Address={{ local_network_address }} -DNS={{ local_network_dns }} Gateway={{ local_network_gateway }} -DHCP=no +DNS={{ local_network_dns }} MulticastDNS=yes +DNSOverTLS=yes +DNSSEC=yes +DHCP=no LinkLocalAddressing=no IPv6AcceptRA=no IPv6SendRA=no diff --git a/templates/personal/xps/network/wlan0-frans.network.j2 b/templates/personal/xps/network/wlan0-frans.network.j2 index fb19ae3..522ddc3 100644 --- a/templates/personal/xps/network/wlan0-frans.network.j2 +++ b/templates/personal/xps/network/wlan0-frans.network.j2 @@ -6,10 +6,12 @@ SSID={{ frans_network_ssid }} [Network] Address={{ frans_network_address }} -DNS={{ frans_network_dns }} Gateway={{ frans_network_gateway }} -DHCP=no +DNS={{ frans_network_dns }} MulticastDNS=yes +DNSOverTLS=yes +DNSSEC=yes +DHCP=no LinkLocalAddressing=no IPv6AcceptRA=no IPv6SendRA=no diff --git a/templates/personal/xps/network/wlan0-local.network.j2 b/templates/personal/xps/network/wlan0-local.network.j2 index c01faab..3d23390 100644 --- a/templates/personal/xps/network/wlan0-local.network.j2 +++ b/templates/personal/xps/network/wlan0-local.network.j2 @@ -6,10 +6,12 @@ SSID={{ local_network_ssid }} [Network] Address={{ local_network_address }} -DNS={{ local_network_dns }} Gateway={{ local_network_gateway }} -DHCP=no +DNS={{ local_network_dns }} MulticastDNS=yes +DNSOverTLS=yes +DNSSEC=yes +DHCP=no LinkLocalAddressing=no IPv6AcceptRA=no IPv6SendRA=no diff --git a/templates/personal/xps/network/wlan0.network.j2 b/templates/personal/xps/network/wlan0.network.j2 index a90c88e..ed8191f 100644 --- a/templates/personal/xps/network/wlan0.network.j2 +++ b/templates/personal/xps/network/wlan0.network.j2 @@ -2,6 +2,9 @@ MACAddress={{ wireless_interface_mac }} [Network] +DNS={{ default_network_dns }} +DNSOverTLS=yes +DNSSEC=yes DHCP=yes RequiredForOnline=routable IgnoreCarrierLoss=3s