# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page

# Help is available in the configuration.nix(5) man page

  boot.blacklistedKernelModules = [ ];       # ask.fedora

    # kernelParams = [ "nomodeset" ];        # the GPU was stuck at boot
    # boot.kernelPackages = pkgs.linuxPackages_latest;

    # wireless.userControlled.enable = true;
    wireless.extraConfig = "";

    useDHCP = false;        # deprecated; use per-interface

    # Open ports in the firewall.
    # Or disable the firewall altogether.
    # networking.firewall.enable = false;
    # iptables -t nat -A OUTPUT -o lo -d 127.192.0.0/10 -p tcp -j REDIRECT --to-ports 8118

    firewall = {
      enable = true;
      extraCommands = "
iptables -A INPUT -p tcp --dport 9040 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -d 127.192.0.0/10 -j REDIRECT --to-port 9040
iptables -t nat -A OUTPUT -p tcp -d 127.192.0.0/10 -j REDIRECT --to-port 9040";
      allowedTCPPorts = [ 30000 22 80 8080 ];
      allowedUDPPorts = [ 30000 22 80 8080 ];
    };

    jagga = {
      isNormalUser = true;
      uid = 1313;
    };

  };
  services.privoxy = {
    enable = true;
    extraConfig = "
accept-intercepted-requests 1
forward .i2p 127.0.0.1:4444
";
  };
  networking.firewall = {
    enable = true;
    extraCommands = "
iptables -t nat -A OUTPUT -o lo -d 127.192.0.0/10 -p tcp -j REDIRECT --to-ports 9040
ip6tables -t nat -A OUTPUT -o lo -d FE80::/10 -p tcp -j REDIRECT --to-ports 9040
";
    allowedTCPPorts = [ 30000 22 80 8080 ];
    allowedUDPPorts = [ 30000 22 80 8080 ];

  services.unbound = {
    enable = true;
    extraConfig = "
server:
  interface: 0.0.0.0
  interface: ::0
  Access-control: 127.0.0.0/8 allow
  access-control: 192.168.0.0/24 allow
  access-control: 192.168.1.0/24 allow
domain-insecure: \"onion\"
private-domain: \"onion\"
do-not-query-localhost: no
local-zone: \"onion.\" nodefault
forward-zone:
  name: \".\"
  forward-addr: 208.67.222.222
  forward-addr: 208.67.220.220
forward-zone:
  name: \"onion\"
  forward-addr: 127.0.0.1@5300
";
  };

    dnsmasq = {
      enable = false;
      extraConfig = "
local-service
server=192.168.1.1
server=/onion/127.0.0.1@5300
";
    };

DNSPort 0.0.0.0:5300

DNSPort 5353

    unbound = {
      enable = true;
      extraConfig = "
domain-insecure: \"onion\"
private-domain: \"onion\"
do-not-query-localhost: no
local-zone: \"onion.\" nodefault
forward-zone:
  name: \"onion\"
  forward-addr: 127.0.0.1@5353
  forward-first: no
";
    };

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.