nixos/sing-box: use remote dns, cleanup

hosts/dust/default.nix

@@ -253,33 +253,12 @@
     };
   };
 
-  services.sing-box.settings = {
+  services.sing-box.settings.experimental.clash_api = rec {
-    outbounds = [
+    external_controller = "127.0.0.1:9090";
-      {
+    external_ui = pkgs.metacubexd;
-        type = "selector";
+    secret = "hunter2";
-        tag = "select";
+    # https://www.v2ex.com/t/1076579
-        outbounds = [
+    access_control_allow_origin = [ "http://${external_controller}" ];
-          "tyo0"
-          "sin0"
-          "direct"
-        ];
-        default = "tyo0";
-      }
-    ];
-
-    route = {
-      final = "select";
-    };
-
-    experimental = {
-      clash_api = rec {
-        external_controller = "127.0.0.1:9090";
-        external_ui = pkgs.metacubexd;
-        secret = "hunter2";
-        # https://www.v2ex.com/t/1076579
-        access_control_allow_origin = [ "http://${external_controller}" ];
-      };
-    };
   };
 
   services.restic.backups.persist.exclude = [ "/persist/home/guanranwang/.local/share/Steam" ];

nixos/profiles/sing-box/default.nix

@@ -5,6 +5,9 @@
   nodes,
   ...
 }:
+let
+  proxyServers = lib.filterAttrs (_name: value: lib.elem "proxy" value.tags) nodes;
+in
 {
   services.sing-box = {
     enable = true;
@@ -13,6 +16,33 @@
         level = "info";
       };
 
+      dns = {
+        servers = [
+          {
+            tag = "cloudflare";
+            address = "https://[2606:4700:4700::1111]/dns-query";
+            strategy = "prefer_ipv6";
+          }
+          {
+            tag = "local";
+            address = "local";
+            strategy = "prefer_ipv4";
+          }
+        ];
+        rules = lib.singleton {
+          rule_set = [
+            "geoip-cn"
+            "geosite-cn"
+            "geosite-private"
+          ];
+          # avoid querying proxy server's dns from proxy server
+          domain = lib.mapAttrsToList (_name: node: node.fqdn) proxyServers;
+          ip_is_private = true;
+          server = "local";
+        };
+        final = "cloudflare";
+      };
+
       inbounds = lib.singleton {
         type = "http";
         tag = "inbound";
@@ -31,28 +61,35 @@
           uuid._secret = config.sops.secrets."sing-box/uuid".path;
           flow = "xtls-rprx-vision";
           tls.enabled = true;
-        }) (lib.filterAttrs (_name: value: lib.elem "proxy" value.tags) nodes)
+        }) proxyServers
-        ++ lib.singleton {
+        ++ [
-          type = "direct";
-          tag = "direct";
-        };
-
-      route = {
-        rules = [
           {
-            rule_set = [
+            type = "selector";
-              "geoip-cn"
+            tag = "select";
-              "geosite-cn"
+            outbounds = [
+              "tyo0"
+              "sin0"
+              "direct"
             ];
-            outbound = "direct";
+            default = "tyo0";
           }
           {
-            rule_set = [ "geosite-private" ];
+            type = "direct";
-            ip_is_private = true;
+            tag = "direct";
-            outbound = "direct";
           }
         ];
 
+      route = {
+        rules = lib.singleton {
+          rule_set = [
+            "geoip-cn"
+            "geosite-cn"
+            "geosite-private"
+          ];
+          ip_is_private = true;
+          outbound = "direct";
+        };
+
         rule_set = [
           {
             tag = "geoip-cn";
@@ -74,7 +111,7 @@
           }
         ];
 
-        final = lib.mkDefault "tyo0";
+        final = "select";
       };
     };
   };