1{
  2  den,
  3  lib,
  4  ...
  5}: let
  6  inherit (import ../direct-dns/_lib.nix {inherit lib;}) mkDirectEntries;
  7
  8  templateName = domain: "mihomo-hosts-${lib.replaceStrings ["." ":"] ["-" "-"] domain}";
  9in {
 10  den.aspects.services.mihomo.dns = {
 11    nixos = {
 12      host,
 13      reverseProxy,
 14      config,
 15      ...
 16    }: let
 17      cfg = host.settings.services.mihomo;
 18
 19      directEntries = mkDirectEntries reverseProxy;
 20
 21      directV4Clear = lib.listToAttrs (lib.concatMap (e:
 22        lib.optional (e.v4 != null && e.v4.kind == "clear") {
 23          name = e.domain;
 24          value = [e.v4.value];
 25        })
 26      directEntries);
 27
 28      directV4Secret = lib.listToAttrs (lib.concatMap (e:
 29        lib.optional (e.v4 != null && e.v4.kind == "secret") {
 30          name = e.domain;
 31          value = {
 32            _secret = config.vaultix.templates.${templateName e.domain}.path;
 33            quote = false;
 34          };
 35        })
 36      directEntries);
 37
 38      secretEntries = lib.filter (e: e.v4 != null && e.v4.kind == "secret") directEntries;
 39    in {
 40      vaultix.secrets = lib.listToAttrs (map (e: {
 41          name = e.v4.name;
 42          value.file = e.v4.file;
 43        })
 44        secretEntries);
 45      vaultix.templates = lib.listToAttrs (map (e: {
 46          name = templateName e.domain;
 47          value = {
 48            content = builtins.toJSON [config.vaultix.placeholder.${e.v4.name}];
 49            owner = "mihomo";
 50            group = "mihomo";
 51            mode = "0400";
 52          };
 53        })
 54        secretEntries);
 55
 56      services.mihomo = {
 57        config = {
 58          hosts =
 59            {
 60              "dns.alidns.com" = ["223.5.5.5" "223.6.6.6" "2400:3200::1" "2400:3200:baba::1"];
 61              "doh.pub" = ["1.12.12.12" "1.12.12.21" "120.53.53.53"];
 62              "dns.google" = ["8.8.8.8" "8.8.4.4" "2001:4860:4860::8888" "2001:4860:4860::8844"];
 63              "cloudflare-dns.com" = ["1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001"];
 64            }
 65            // directV4Clear // directV4Secret;
 66          dns = {
 67            enable = true;
 68            listen = ":${toString cfg.ports.dns}";
 69            prefer-h3 = false;
 70            ipv6 = false;
 71            enhanced-mode = "redir-host";
 72            respect-rules = true;
 73            nameserver = [
 74              "https://dns.google/dns-query#disable-qtype-64=true&disable-qtype-65=true"
 75              "https://cloudflare-dns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
 76            ];
 77            proxy-server-nameserver = [
 78              "https://dns.alidns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
 79              "https://doh.pub/dns-query#disable-qtype-64=true&disable-qtype-65=true"
 80            ];
 81            direct-nameserver = [
 82              "https://dns.alidns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
 83              "https://doh.pub/dns-query#disable-qtype-64=true&disable-qtype-65=true"
 84            ];
 85            nameserver-policy = {
 86              # Tailscale
 87              "+.net.trin.one" = "100.100.100.100";
 88              ".ts.net" = "100.100.100.100";
 89
 90              "geosite:cn,private" = [
 91                "https://dns.alidns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
 92                "https://doh.pub/dns-query#disable-qtype-64=true&disable-qtype-65=true"
 93              ];
 94              "geosite:geolocation-!cn" = [
 95                "https://dns.google/dns-query#disable-qtype-64=true&disable-qtype-65=true"
 96                "https://cloudflare-dns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
 97              ];
 98            };
 99            fake-ip-range = "198.18.0.1/16";
100            fake-ip-filter-mode = "blacklist";
101            fake-ip-filter = [
102              "+.+m2m"
103              "+.$injections.adguard.org"
104              "+.$local.adguard.org"
105              "+.+bogon"
106              "+.+lan"
107              "+.+local"
108              "+.+localdomain"
109              "+.home.arpa"
110              "dns.msftncsi.com"
111              "*.srv.nintendo.net"
112              "*.stun.playstation.net"
113              "xbox.*.microsoft.com"
114              "*.xboxlive.com"
115              "*.turn.twilio.com"
116              "*.stun.twilio.com"
117              "stun.syncthing.net"
118              "stun.*"
119              "*.sslip.io"
120              "*.nip.io"
121              "gate.trin.one"
122            ];
123          };
124        };
125      };
126    };
127  };
128}