7 files changed, 129 insertions, 79 deletions
diff --git a/modules/common/ark.nix b/modules/common/ark.nix
index ba3056b..007e209 100644
--- a/modules/common/ark.nix
+++ b/modules/common/ark.nix
@@ -10,11 +10,14 @@ in
 {
   imports = [
     inputs.impermanence.nixosModules.impermanence
-    (lib.mkAliasOptionModule [ "ark" ] [
-      "nixfiles"
-      "modules"
-      "ark"
-    ])
+    (lib.mkAliasOptionModule
+      [ "ark" ]
+      [
+        "nixfiles"
+        "modules"
+        "ark"
+      ]
+    )
   ];
 
   options.nixfiles.modules.ark =
diff --git a/modules/common/home-manager.nix b/modules/common/home-manager.nix
index f3e8143..118fc0e 100644
--- a/modules/common/home-manager.nix
+++ b/modules/common/home-manager.nix
@@ -7,11 +7,14 @@
 {
   imports = [
     inputs.home-manager.nixosModule
-    (lib.mkAliasOptionModule [ "hm" ] [
-      "home-manager"
-      "users"
-      lib.my.username
-    ])
+    (lib.mkAliasOptionModule
+      [ "hm" ]
+      [
+        "home-manager"
+        "users"
+        lib.my.username
+      ]
+    )
   ];
 
   hm = {
diff --git a/modules/common/networking.nix b/modules/common/networking.nix
index 468bd8b..2e9c218 100644
--- a/modules/common/networking.nix
+++ b/modules/common/networking.nix
@@ -7,9 +7,12 @@
 }:
 let
   cfg = config.nixfiles.modules.common.networking;
+
+  interface = "eth0"; # This assumes `usePredictableInterfaceNames` is false.
 in
 {
-  options.nixfiles.modules.common.networking.onlyDefault = lib.mkEnableOption "custom networking settings";
+  options.nixfiles.modules.common.networking.onlyDefault =
+    lib.mkEnableOption "custom networking settings";
 
   config = lib.mkIf (!cfg.onlyDefault) {
     ark.directories =
@@ -31,20 +34,6 @@ in
           "::1" = lib.mkForce [ ];
         };
 
-        # There's no way[1] to configure DNS server priority in
-        # systemd-resolved. The only solution for dealing with a broken VPN
-        # connection is to delete /etc/systemd/resolved.conf and restart the
-        # systemd-resolved service. Otherwise I'll just end up with a random
-        # server from the list most of the time because systemd-resolved
-        # "conveniently" will manage server priority for me...
-        #
-        # [1]: https://askubuntu.com/questions/1116732/how-do-i-list-dns-server-order-in-systemd-resolve
-        # [2]: https://github.com/systemd/systemd/issues/6076
-        nameservers = with lib.my.configurations.manwe.wireguard; [
-          ipv6.address
-          ipv4.address
-        ];
-
         useDHCP = false;
 
         nftables.enable = true;
@@ -62,45 +51,46 @@ in
           logRefusedUnicastsOnly = false;
           logReversePathDrops = false;
         };
+
+        usePredictableInterfaceNames = false;
       }
-      (
-        let
-          interface = "eth0"; # This assumes `usePredictableInterfaceNames` is false.
-        in
-        lib.mkIf (lib.hasAttr "ipv4" this && lib.hasAttr "ipv6" this) {
-          usePredictableInterfaceNames = false; # NOTE This can break something!
-          interfaces.${interface} = {
-            ipv4.addresses =
-              with this.ipv4;
-              lib.optional (lib.isString address && lib.isInt prefixLength) {
-                inherit address prefixLength;
-              };
-
-            ipv6.addresses =
-              with this.ipv6;
-              lib.optional (lib.isString address && lib.isInt prefixLength) {
-                inherit address prefixLength;
-              };
+      (lib.mkIf (lib.hasAttr "ipv4" this) {
+        interfaces.${interface}.ipv4.addresses =
+          with this.ipv4;
+          lib.optional (lib.isString address && lib.isInt prefixLength) {
+            inherit address prefixLength;
+          };
+        defaultGateway =
+          with this.ipv4;
+          lib.mkIf (lib.isString gatewayAddress) {
+            inherit interface;
+            address = gatewayAddress;
           };
-          defaultGateway =
-            with this.ipv4;
-            lib.mkIf (lib.isString gatewayAddress) {
-              inherit interface;
-              address = gatewayAddress;
-            };
-          defaultGateway6 =
-            with this.ipv6;
-            lib.mkIf (lib.isString gatewayAddress) {
-              inherit interface;
-              address = gatewayAddress;
-            };
-        }
-      )
+      })
+      (lib.mkIf (lib.hasAttr "ipv6" this) {
+        interfaces.${interface}.ipv6.addresses =
+          with this.ipv6;
+          lib.optional (lib.isString address && lib.isInt prefixLength) {
+            inherit address prefixLength;
+          };
+        defaultGateway6 =
+          with this.ipv6;
+          lib.mkIf (lib.isString gatewayAddress) {
+            inherit interface;
+            address = gatewayAddress;
+          };
+      })
+      (lib.mkIf this.isHeadless {
+        nameservers = with lib.my.configurations.manwe.wireguard; [
+          ipv6.address
+          ipv4.address
+        ];
+      })
       (lib.mkIf this.isHeadful {
         networkmanager = {
           enable = true;
-          plugins = lib.mkForce [ ];
           wifi.backend = "iwd";
+          dns = "none";
         };
 
         wireless = {
@@ -109,15 +99,49 @@ in
           userControlled.enable = true;
           allowAuxiliaryImperativeNetworks = true;
         };
+
+        resolvconf.extraConfig = ''
+          append_nameservers='127.0.0.1'
+        '';
       })
     ];
 
-    services.resolved = {
-      llmnr = "false";
-      dnsovertls = "opportunistic";
-      dnssec = "allow-downgrade";
-      fallbackDns = lib.dns.mkDoT lib.dns.const.quad9.ecs;
-    };
+    services = lib.mkMerge [
+      (lib.mkIf this.isHeadless {
+        resolved = {
+          enable = true;
+          llmnr = "false";
+          dnsovertls = "opportunistic";
+          dnssec = "allow-downgrade";
+          fallbackDns = lib.dns.mkDoT lib.dns.const.quad9.ecs;
+        };
+      })
+      (lib.mkIf this.isHeadful {
+        resolved.enable = false;
+
+        dnscrypt-proxy2 = {
+          enable = true;
+          settings = {
+            ipv4_servers = true;
+            ipv6_servers = false;
+            dnscrypt_servers = true;
+            doh_servers = true;
+            odoh_servers = false;
+            require_dnssec = true;
+            require_nolog = true;
+            require_nofilter = true;
+
+            disabled_server_names = [
+              "cloudflare"
+              "cloudflare-ipv6"
+            ];
+
+            cache = true;
+            cache_size = lib.pow 2 13;
+          };
+        };
+      })
+    ];
 
     environment = {
       shellAliases = lib.listToAttrs (
diff --git a/modules/common/nix.nix b/modules/common/nix.nix
index 09d57ed..2054185 100644
--- a/modules/common/nix.nix
+++ b/modules/common/nix.nix
@@ -72,6 +72,11 @@ in
 
           keep-going = true;
 
+          experimental-features = [
+            "fetch-tree"
+            "pipe-operators"
+          ];
+
           trusted-users = [ my.username ];
 
           substituters = [
@@ -83,6 +88,9 @@ in
           trusted-public-keys = [
             "cache.tvl.su:kjc6KOMupXc1vHVufJUoDUYeLzbwSr9abcAKdn/U1Jk="
           ];
+
+          # https://github.com/NixOS/nix/issues/6901
+          fallback = true;
         };
       };
 
diff --git a/modules/common/secrets.nix b/modules/common/secrets.nix
index 03a2eeb..77dee44 100644
--- a/modules/common/secrets.nix
+++ b/modules/common/secrets.nix
@@ -10,10 +10,13 @@ with lib;
 {
   imports = [
     inputs.agenix.nixosModules.default
-    (mkAliasOptionModule [ "secrets" ] [
-      "age"
-      "secrets"
-    ])
+    (mkAliasOptionModule
+      [ "secrets" ]
+      [
+        "age"
+        "secrets"
+      ]
+    )
   ];
 
   config = {
@@ -23,7 +26,10 @@ with lib;
       else
         map (attr: attr.path) (filter (attr: attr.type == my.ssh.type) config.services.openssh.hostKeys);
 
-    environment.systemPackages = with pkgs; [ agenix ];
+    environment.systemPackages = with pkgs; [
+      age
+      agenix
+    ];
 
     nixpkgs.overlays = [ inputs.agenix.overlays.default ];
   };
diff --git a/modules/common/stylix.nix b/modules/common/stylix.nix
index f1e0417..f17cb4c 100644
--- a/modules/common/stylix.nix
+++ b/modules/common/stylix.nix
@@ -10,11 +10,14 @@ with lib;
 {
   imports = [
     inputs.stylix.nixosModules.stylix
-    (mkAliasOptionModule [ "colors" ] [
-      "lib"
-      "stylix"
-      "colors"
-    ])
+    (mkAliasOptionModule
+      [ "colors" ]
+      [
+        "lib"
+        "stylix"
+        "colors"
+      ]
+    )
   ];
 
   options.nixfiles.modules.common.stylix.fonts.extraPackages = mkOption {
diff --git a/modules/common/users.nix b/modules/common/users.nix
index b8aca28..e0811b7 100644
--- a/modules/common/users.nix
+++ b/modules/common/users.nix
@@ -5,11 +5,14 @@ let
 in
 {
   imports = [
-    (mkAliasOptionModule [ "my" ] [
-      "users"
-      "users"
-      my.username
-    ])
+    (mkAliasOptionModule
+      [ "my" ]
+      [
+        "users"
+        "users"
+        my.username
+      ]
+    )
   ];
 
   ark.directories = [ home ];