444 current 2025-06-28 01:55:23 25.05.20250424.f771eb4 6.12.24 *

system/services/dnsmasq/default.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  services.dnsmasq = {
+    enable = true;
+    resolveLocalQueries = true;
+    settings = {
+      listen-address = "127.0.0.1";
+      port = 53535; # anything that’s free
+    };
+  };
+}

system/services/resolved/default.nix

@@ -6,6 +6,9 @@
   networking.nameservers = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
 
   services.resolved = {
+    extraConfig = ''
+      DNS=127.0.0.1:53535           # resolved → dnsmasq, non-standard port OK
+    '';
     enable = true;
     dnssec = "true";
     domains = ["~."];

system/services/services.nix

@@ -8,5 +8,6 @@
     ./tailscale/default.nix
     ./syncthing/default.nix
     ./resolved/default.nix
+    ./dnsmasq/default.nix
   ];
 }