Use DNS over TLS & enable DNSSEC

playbook.yml

@@ -29,7 +29,8 @@
     - name: Personal provisiong
       when: "'personal' in group_names"
       block:
-        # TODO: require (w)lan interfaces before configuring these
+        # Note: set `network.dns.native_https_query` in about:config to prevent
+        # DoH requests by default. See https://github.com/arkenfox/user.js/issues/1881
         - name: Wireguard provisioning
           ansible.builtin.import_tasks: 'tasks/personal/all/wireguard.yml'
           tags: wireguard