How to hide my DNS resolver from the config

Help
1

I currently use NextDNS and I have my DNS config like this:

nameservers = [
  "45.90.28.0#000000.dns.nextdns.io"
  "2a07:a8c0::#000000.dns.nextdns.io" 
  "45.90.30.0#000000.dns.nextdns.io"
  "2a07:a8c1::#000000.dns.nextdns.io"
];

(Of course changing the actual ID to 000000)

The problem is that I have my config on Github and would like to make it public, so I need to hide this ID. I already use sops-nix to hide passwords and other stuff, but I could not find a way to do this. Is there any other way?

2

This is a pretty frequent question. There are effectively two options, git-crypt, or you maintain a second configuration in a private repository that is imported by the public one to add the sensitive options. Flakes are usually used for the latter, but you can also achieve that in a traditional config with fetchFromGitHub.

This is assuming the values aren’t actually secret secret but just sensitive. If they are secrets, then this particular NixOS module does not support treating these values as secret and you would have to write your own that does permit reading the values from a file so you can use sops - or of course patch the upstream one and contribute so everyone can benefit :wink:

I don’t think that’s true for nextdns IDs (can DNS-over-TLS/HTTPS server URLs be intercepted by recursive DNS servers? I think so?) and that’d be an awfully small entropy if it were, so treating it as sensitive is probably fine, but I’ve never used the service myself.

1 Like
3

Hey, I don’t know about the interception thing, but I just don’t want my ID to be public. I found a solution with their own client, which has a config-file argument. So I’m using it like this:

services.nextdns = {
  enable = true;
  arguments = [
    "-config-file"
    "${config.sops.secrets.nextdnsID.path}"
  ];
};

networking.nameservers = [
  "127.0.0.1"
  "::1"
];

As you can see it was solved with sops-nix, which is quite neat as I already use it so I won’t have to use another tool for the job.

Thanks for the explanation!

1 Like