modules/network: let dns traffic passthrough dae

machines/calcite/network.nix

@@ -24,10 +24,9 @@ in
     };
   };
 
-  # Enable Tailscale
   services.tailscale = {
     enable = true;
-    extraUpFlags = [ "--accept-dns=false" ];
+    extraUpFlags = [ "--accept-routes" ];
   };
   # services.tailscale.useRoutingFeatures = "both";
 

modules/nixos/common-settings/mainland.nix

@@ -102,7 +102,7 @@ in
 
           upstream {
         	    globaldns: 'tls://dns.quad9.net'
-        	    cndns: 'h3://dns.alidns.com:443'
+        	    cndns: 'quic://dns.alidns.com:853'
         	    tsdns: 'udp://100.100.100.100'
         	    localdns: 'udp://127.0.0.1:53' 
           }
@@ -133,6 +133,11 @@ in
             filter: name(regex: '^(fra)[0-9]+') [add_latency: -150ms]
             policy: min_moving_avg
           }
+
+          clean_ip {
+            filter: name(regex: '^(fra)[0-9]+') [add_latency: -150ms]
+            policy: fixed(0)
+          }
         }
 
         # See https://github.com/daeuniverse/dae/blob/main/docs/en/configuration/routing.md for full examples.
@@ -156,9 +161,13 @@ in
 
           # === Force Proxy ===
           domain(geosite:linkedin) -> default_group
+          domain(full: sourceware.org) -> clean_ip
 
           # === Custom direct rules ===
           domain(geosite:cn) -> direct
+          domain(geosite:steam@cn) -> direct
+          domain(suffix:steamserver.net) -> direct
+          domain(suffix:test.steampowered.com) -> direct
 
           dip(geoip:cn) -> direct
 

modules/nixos/common-settings/network.nix

@@ -22,7 +22,9 @@ in
     networking.resolvconf = mkIf cfg.localdns.enable {
       enable = true;
       dnsExtensionMechanism = false;
-      useLocalResolver = true;
+      # We should disable local resolver if dae is enabled
+      # to let dns traffic go through dae
+      useLocalResolver = !config.commonSettings.network.enableProxy;
     };
 
     services.resolved.enable = mkIf cfg.localdns.enable false;
@@ -88,9 +90,13 @@ in
           '';
         in
         globalSettings
-        + (if config.services.dae.enable then proxySettings else "")
         + (if config.services.tailscale.enable then tsSettings else "")
-        + (if config.inMainland then mainlandSettings else overseaSettings);
+        + (
+          if config.commonSettings.network.enableProxy then
+            proxySettings + mainlandSettings
+          else
+            overseaSettings
+        );
     };
   };
 }

scripts/update-china-list.sh

@@ -2,3 +2,10 @@ output_file="modules/nixos/common-settings/china-domains.txt"
 curl "https://raw.githubusercontent.com/peeweep/dnsmasq-china-list-raw/refs/heads/master/accelerated-domains.china.raw.txt" > "$output_file"
 curl "https://raw.githubusercontent.com/peeweep/dnsmasq-china-list-raw/refs/heads/master/apple.china.raw.txt" >> "$output_file"
 curl "https://raw.githubusercontent.com/peeweep/dnsmasq-china-list-raw/refs/heads/master/google.china.raw.txt" >> "$output_file"
+# extra rules
+cat >> $output_file <<- EOM
+test.steampowered.com
+steamserver.net
+api.steampowered.com
+EOM
+