Featuring DNS over HTTPS and plausible MAC randomisation

networking.nix

{ pkgs, ... }:

{
  networking.networkmanager.enable = true;
  networking.networkmanager.ethernet.macAddress = "random";
  networking.networkmanager.wifi.macAddress = "random";
  networking.networkmanager.extraConfig = ''
    [connection-extra]
    ethernet.generate-mac-address-mask=FE:FF:FF:00:00:00
    wifi.generate-mac-address-mask=FE:FF:FF:00:00:00
  '';

  networking.nameservers = [ "::1" ];

  networking.networkmanager.dispatcherScripts = [
    { source = pkgs.writeText "doh-stub" ''
        if [ "$2" = up ]
        then systemctl start doh-stub.service
        fi
      '';
      type = "basic";
    }
  ];

  systemd.services.doh-stub = {
    script = ''
      exec ${pkgs.doh-proxy}/bin/doh-stub \
          --level INFO \
          --domain qyliss.net \
          --remote-address 85.119.82.108
    '';
  };
}