1{
 2  den.aspects.services.proxy.mihomo.dns = {
 3    nixos = {host, ...}: let
 4      cfg = host.settings.services.proxy.mihomo;
 5    in {
 6      services.mihomo = {
 7        config = {
 8          hosts = {
 9            "dns.alidns.com" = ["223.5.5.5" "223.6.6.6" "2400:3200::1" "2400:3200:baba::1"];
10            "doh.pub" = ["1.12.12.12" "1.12.12.21" "120.53.53.53"];
11            "dns.google" = ["8.8.8.8" "8.8.4.4" "2001:4860:4860::8888" "2001:4860:4860::8844"];
12            "cloudflare-dns.com" = ["1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001"];
13          };
14          dns = {
15            enable = true;
16            listen = ":${toString cfg.ports.dns}";
17            prefer-h3 = false;
18            ipv6 = false;
19            enhanced-mode = "redir-host";
20            respect-rules = true;
21            nameserver = [
22              "https://dns.google/dns-query#disable-qtype-64=true&disable-qtype-65=true"
23              "https://cloudflare-dns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
24            ];
25            proxy-server-nameserver = [
26              "https://dns.alidns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
27              "https://doh.pub/dns-query#disable-qtype-64=true&disable-qtype-65=true"
28            ];
29            direct-nameserver = [
30              "https://dns.alidns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
31              "https://doh.pub/dns-query#disable-qtype-64=true&disable-qtype-65=true"
32            ];
33            nameserver-policy = {
34              # Tailscale
35              "+.net.trin.one" = "100.100.100.100";
36              ".ts.net" = "100.100.100.100";
37
38              "geosite:cn,private" = [
39                "https://dns.alidns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
40                "https://doh.pub/dns-query#disable-qtype-64=true&disable-qtype-65=true"
41              ];
42              "geosite:geolocation-!cn" = [
43                "https://dns.google/dns-query#disable-qtype-64=true&disable-qtype-65=true"
44                "https://cloudflare-dns.com/dns-query#disable-qtype-64=true&disable-qtype-65=true"
45              ];
46            };
47            fake-ip-range = "198.18.0.1/16";
48            fake-ip-filter-mode = "blacklist";
49            fake-ip-filter = [
50              "+.+m2m"
51              "+.$injections.adguard.org"
52              "+.$local.adguard.org"
53              "+.+bogon"
54              "+.+lan"
55              "+.+local"
56              "+.+localdomain"
57              "+.home.arpa"
58              "dns.msftncsi.com"
59              "*.srv.nintendo.net"
60              "*.stun.playstation.net"
61              "xbox.*.microsoft.com"
62              "*.xboxlive.com"
63              "*.turn.twilio.com"
64              "*.stun.twilio.com"
65              "stun.syncthing.net"
66              "stun.*"
67              "*.sslip.io"
68              "*.nip.io"
69              "gate.trin.one"
70            ];
71          };
72        };
73      };
74    };
75  };
76}