DNS-over-HTTPS module for NixOS

default.nix

{ pkgs, ... }:
let
  doh-proxy = pkgs.callPackage ./doh-proxy.nix {};
in {
  systemd.sockets.doh-stub = {
    wantedBy = [ "sockets.target" ];
    socketConfig.Service = "doh-stub.service";
    socketConfig.ListenDatagram = "[::1]:53";
  };
  systemd.services.doh-stub = {
    unitConfig.Requires = [ "doh-stub.socket" ];
    serviceConfig.ExecStart = "${doh-proxy}/bin/doh-stub --level INFO --domain 1.1.1.1";
  };
  networking.extraResolvconfConf = ''
    name_servers='::1'
  '';
}

doh-proxy.nix

{ fetchurl, python3Packages, doh-proxy }:
let
  socketfromfd = python3Packages.buildPythonPackage {
    name = "socketfromfd-0.2.0";
    src = fetchurl {
      url = mirror://pypi/s/socketfromfd/socketfromfd-0.2.0.tar.gz;
      sha256 = "0lvx0plycgqm20nql31ir9wsnv0ld1cywz37h0fbscbqkhla397h";
    };
    patches = [ ./libc.patch ];
    doCheck = false;
  };
in doh-proxy.overrideDerivation (drv: {
  patches = (drv.patches or []) ++ [ ./socket-activation.patch ];
  propagatedBuildInputs = drv.propagatedBuildInputs ++ [ socketfromfd ];
})

libc.patch

diff -ru socketfromfd-0.2.0.orig/socketfromfd.py socketfromfd-0.2.0/socketfromfd.py
--- socketfromfd-0.2.0.orig/socketfromfd.py	2017-01-21 23:14:20.000000000 +0000
+++ socketfromfd-0.2.0/socketfromfd.py	2018-10-29 13:45:10.739080347 +0000
@@ -7,7 +7,6 @@
 import os
 import socket
 import sys
-from ctypes.util import find_library
 
 __all__ = ('fromfd',)
 
@@ -16,12 +15,7 @@
 SO_PROTOCOL = getattr(socket, 'SO_PROTOCOL', 38)
 
 
-_libc_name = find_library('c')
-if _libc_name is not None:
-    libc = ctypes.CDLL(_libc_name, use_errno=True)
-else:
-    raise OSError('libc not found')
-
+libc = ctypes.CDLL('', use_errno=True)
 
 def _errcheck_errno(result, func, arguments):
     """Raise OSError by errno for -1

socket-activation.patch

diff -ru doh-proxy-0.0.8.orig/dohproxy/stub.py doh-proxy-0.0.8/dohproxy/stub.py
--- doh-proxy-0.0.8.orig/dohproxy/stub.py	2018-02-24 08:29:09.000000000 +0000
+++ doh-proxy-0.0.8/dohproxy/stub.py	2018-10-29 11:09:05.275152552 +0000
@@ -7,6 +7,7 @@
 # LICENSE file in the root directory of this source tree.
 #
 import asyncio
+import socketfromfd
 
 from dohproxy import client_protocol, utils
 
@@ -35,7 +36,7 @@
     # One protocol instance will be created to serve all client requests
     listen = loop.create_datagram_endpoint(
         lambda: client_protocol.StubServerProtocol(args, logger=logger),
-        local_addr=(args.listen_address, args.listen_port))
+        sock=socketfromfd.fromfd(3))
     transport, proto = loop.run_until_complete(listen)
     loop.run_until_complete(proto.setup_client())