uncound/well-known-dns.conf: add DNS0 {Zero,Kids,Open}

conf/.gitignore

@@ -1,2 +1,3 @@
-librewolf.overrides.cfg
+librewolf.overrides.cfg.js
 wireplumber
+autostart

conf/autostart

@@ -0,0 +1 @@
+../etc/xdg/autostart

conf/librewolf.overrides.cfg

@@ -112,8 +112,8 @@ pref("reader.parse-on-load.force-enabled", true);
 //pref("network.trr.mode", 2);
 defaultPref("network.trr.mode", 3);
 pref("network.trr.early-AAAA", true);
-//defaultPref("network.trr.uri", "https://dns0.eu");
-defaultPref("network.trr.uri"), "https://dns11.quad9.net/dns-query");
+defaultPref("network.trr.uri", "https://dns0.eu/");
+//defaultPref("network.trr.uri"), "https://dns11.quad9.net/dns-query");
 //defaultPref("network.trr.uri", "https://dns.adguard-dns.com/dns-query");
 // NOTE: ECH requires TRR, so mode 2 may not use it.
 defaultPref("network.trr.disable-ECS", false);

etc/firefox/policies/policies.json

@@ -25,7 +25,7 @@
     "DNSOverHTTPS": {
       "Enabled": true,
       "Locked": false,
-      "ProviderURL": "https://dns11.quad9.net/dns-query"
+      "ProviderURL": "https://dns0.eu/"
     },
     "DisablePocket": false,
     "EnableTrackingProtection": {

etc/opt/chromium/policies/managed/doh-dns0-kids.json

@@ -0,0 +1,3 @@
+{
+  "DnsOverHttpsTemplates": "https://kids.dns0.eu/"
+}

etc/opt/chromium/policies/managed/doh-dns0-open.json

@@ -0,0 +1,3 @@
+{
+  "DnsOverHttpsTemplates": "https://open.dns0.eu/"
+}

etc/opt/chromium/policies/managed/doh-dns0-zero.json

@@ -0,0 +1,3 @@
+{
+  "DnsOverHttpsTemplates": "https://zero.dns0.eu/"
+}

etc/opt/chromium/policies/managed/doh-dns0.json

@@ -1,3 +1,3 @@
 {
-  "DnsOverHttpsTemplates": "https://dns0.eu"
+  "DnsOverHttpsTemplates": "https://dns0.eu/"
 }

etc/sudoers.d/nordvpnd

@@ -10,3 +10,5 @@
 # used in my scripts of disconnecting from nordvpn and restoring IPv6
 %nordvpn ALL=NOPASSWD: /bin/systemctl restart iwd.service
 %nordvpn ALL=NOPASSWD: /bin/systemctl restart systemd-networkd.service
+# Tells Chrony we are connected and thus maybe connects to IPv6 NTP servers
+%nordvpn ALL=NOPASSWD: /usr/bin/chronyc online

etc/systemd/resolved.conf.d/dot-quad9.conf

@@ -1,10 +1,10 @@
 [Resolve]
 # Secure
-#DNS=2620:fe::9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 9.9.9.9#dns.quad9.net
+DNS=2620:fe::9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 9.9.9.9#dns.quad9.net
 # No Threat Blocking
 #DNS=2620:fe::10#dns10.quad9.net 149.112.112.10#dns10.quad9.net 2620:fe::fe:10#dns10.quad9.net 9.9.9.10#dns10.quad9.net
 # Secure + ECS
-DNS=2620:fe::11#dns11.quad9.net 149.112.112.11#dns11.quad9.net 2620:fe::fe:11#dns11.quad9.net 9.9.9.11#dns11.quad9.net
+#DNS=2620:fe::11#dns11.quad9.net 149.112.112.11#dns11.quad9.net 2620:fe::fe:11#dns11.quad9.net 9.9.9.11#dns11.quad9.net
 # No Threat Blocking + ECS
 #DNS=9.9.9.12#dns12.quad9.net 149.112.112.12#dns12.quad9.net 2620:fe::12#dns12.quad9.net 2620:fe::fe:12#dns12.quad9.net
 # Uncomment for port 443 resolver

etc/unbound/unbound.conf.d/dot-dns0-quad9.conf

@@ -1,60 +0,0 @@
-# This is merging of dot-dns0.conf & dot-quad9.conf
-# Both are filtering DNS servers, so this brings risk of something being
-# blocked by only one of them. However both are non-profits and have servers
-# in Finland.
-# Another issue is DNS0 having private ECS, while Quad9 with ECS enabled is
-# not.
-
-server:
-	# Debian ca-certificates location
-	#tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
-	# Fedora
-	#tls-cert-bundle: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
-	# Use system certificates no matter where they are
-	tls-system-cert: yes
-	# Quad9 says pointless performance impact on forwarders.
-	# https://docs.quad9.net/Quad9_For_Organizations/DNS_Forwarder_Best_Practices/#disable-qname-minimization
-	qname-minimisation: no
-
-forward-zone:
-	name: "."
-	forward-tls-upstream: yes
-## DNS0.eu
-	# Default
-	forward-addr: 2a0f:fc80::@853#dns0.eu
-	forward-addr: 193.110.81.0@853#dns0.eu
-	forward-addr: 2a0f:fc81::@853#dns0.eu
-	forward-addr: 185.253.5.0@853#dns0.eu
-	## Unfiltered
-	#forward-addr: 193.110.81.254@853#open.dns0.eu
-	#forward-addr: 185.253.5.254@853#open.dns0.eu
-	#forward-addr: 2a0f:fc80::ffff@853#open.dns0.eu
-	#forward-addr: 2a0f:fc81::ffff@853#open.dns0.eu
-	## Heavier filtering
-	#forward-addr: 2a0f:fc80::9@853#zero.dns0.eu
-	#forward-addr: 193.110.81.9@853#zero.dns0.eu
-	#forward-addr: 2a0f:fc81::9@853#zero.dns0.eu
-	#forward-addr: 185.253.5.9@853#zero.dns0.eu
-## Quad9
-	## Secure
-	#forward-addr: 2620:fe::fe@853#dns.quad9.net
-	#forward-addr: 9.9.9.9@853#dns.quad9.net
-	#forward-addr: 2620:fe::9@853#dns.quad9.net
-	#forward-addr: 149.112.112.112@853#dns.quad9.net
-	## No Threat Blocking
-	#forward-addr: 2620:fe::fe:10@853#dns10.quad9.net
-	#forward-addr: 149.112.112.10@853#dns10.quad9.net
-	#forward-addr: 2620:fe::10@853#dns10.quad9.net
-	#forward-addr: 9.9.9.10@853#dns10.quad9.net
-	## Secure + ECS
-	forward-addr: 2620:fe::fe:11@853#dns11.quad9.net
-	forward-addr: 9.9.9.11@853#dns11.quad9.net
-	forward-addr: 2620:fe::11@853#dns11.quad9.net
-	forward-addr: 149.112.112.11@853#dns11.quad9.net
-	## No Threat Blocking + ECS
-	#forward-addr: 2620:fe::fe:12@853#dns12.quad9.net
-	#forward-addr: 9.9.9.12@853#dns12.quad9.net
-	#forward-addr: 2620:fe::12@853#dns12.quad9.net
-	#forward-addr: 149.112.112.12@853#dns12.quad9.net
-
-# vim: filetype=unbound.conf

etc/unbound/unbound.conf.d/dot-quad9.conf

@@ -13,20 +13,20 @@ forward-zone:
 	name: "."
 	forward-tls-upstream: yes
 	## Secure
-	#forward-addr: 2620:fe::fe@853#dns.quad9.net
-	#forward-addr: 9.9.9.9@853#dns.quad9.net
-	#forward-addr: 2620:fe::9@853#dns.quad9.net
-	#forward-addr: 149.112.112.112@853#dns.quad9.net
+	forward-addr: 2620:fe::fe@853#dns.quad9.net
+	forward-addr: 9.9.9.9@853#dns.quad9.net
+	forward-addr: 2620:fe::9@853#dns.quad9.net
+	forward-addr: 149.112.112.112@853#dns.quad9.net
 	## No Threat Blocking
 	#forward-addr: 2620:fe::fe:10@853#dns10.quad9.net
 	#forward-addr: 149.112.112.10@853#dns10.quad9.net
 	#forward-addr: 2620:fe::10@853#dns10.quad9.net
 	#forward-addr: 9.9.9.10@853#dns10.quad9.net
 	## Secure + ECS
-	forward-addr: 2620:fe::fe:11@853#dns11.quad9.net
-	forward-addr: 9.9.9.11@853#dns11.quad9.net
-	forward-addr: 2620:fe::11@853#dns11.quad9.net
-	forward-addr: 149.112.112.11@853#dns11.quad9.net
+	#forward-addr: 2620:fe::fe:11@853#dns11.quad9.net
+	#forward-addr: 9.9.9.11@853#dns11.quad9.net
+	#forward-addr: 2620:fe::11@853#dns11.quad9.net
+	#forward-addr: 149.112.112.11@853#dns11.quad9.net
 	## No Threat Blocking + ECS
 	#forward-addr: 2620:fe::fe:12@853#dns12.quad9.net
 	#forward-addr: 9.9.9.12@853#dns12.quad9.net

etc/unbound/unbound.conf.d/well-known-dns.conf

@@ -26,6 +26,21 @@ server:
 	local-data: "dns0.eu. A 185.253.5.0"
 	local-data: "dns0.eu. AAAA 2a0f:fc80::"
 	local-data: "dns0.eu. AAAA 2a0f:fc81::"
+# DNS0 Zero
+	local-data: "zero.dns0.eu. A 193.110.81.9"
+	local-data: "zero.dns0.eu. A 185.253.5.9"
+	local-data: "zero.dns0.eu. AAAA 2a0f:fc80::9"
+	local-data: "zero.dns0.eu. AAAA 2a0f:fc81::9"
+# DNS0 Kids
+	local-data: "kids.dns0.eu. A 193.110.81.1"
+	local-data: "kids.dns0.eu. A 185.253.5.1"
+	local-data: "kids.dns0.eu. AAAA 2a0f:fc80::1"
+	local-data: "kids.dns0.eu. AAAA 2a0f:fc81::1"
+# DNS0 Open
+	local-data: "open.dns0.eu. A 193.110.81.254"
+	local-data: "open.dns0.eu. A 185.253.5.254"
+	local-data: "open.dns0.eu. AAAA 2a0f:fc80::ffff"
+	local-data: "open.dns0.eu. AAAA 2a0f:fc81::ffff"
 # Cloudflare
 	local-data: "cloudflare-dns.com. A 1.1.1.1"
 	local-data: "cloudflare-dns.com. A 1.0.0.1"

etc/xdg/.gitignore

@@ -1 +0,0 @@
-autostart

etc/xdg/autostart

@@ -1 +0,0 @@
-../../local/share/applications

etc/xdg/autostart/.gitignore

@@ -0,0 +1 @@
+org.telegram.desktop

etc/xdg/autostart/README.md

@@ -0,0 +1,3 @@
+# Autostart files for graphical desktop environments
+
+This mostly caters for my family.

etc/xdg/autostart/easyeffects-service.desktop

@@ -1,5 +1,5 @@
 [Desktop Entry]
-Name=PulseEffects
+Name=EasyEffects
 Exec=/usr/bin/flatpak run com.github.wwmm.easyeffects --gapplication-service
 Type=Application
 Icon=com.github.wwmm.easyeffects

etc/xdg/autostart/org.telegram.desktop

@@ -0,0 +1 @@
+/var/lib/flatpak/exports/bin/org.telegram.desktop

etc/xdg/autostart/wlsunset-kotka.desktop

@@ -0,0 +1,5 @@
+[Desktop Entry]
+Type=Application
+Exec=wlsunset -l 60.46742 -L 26.94508 -t 1000
+Name=wlsunset @ Kotka
+Icon=wlsunset

local/share/applications/README.md

@@ -1,21 +1,36 @@
-# `.desktop` entries
+# Custom app menu entries
 
-These can be used for many things such as
+These can be used for either `~/.local/share/applications` or
+`/usr/local/share/applications` which are read by graphical desktop
+environments for their app menus and default applications selections.
 
-- `~/.local/share/applications` (graphical desktop environments populate app
-  menu from here)
-- `~/.config/autostart` (graphical desktop environments read user autostarts
-  here)
-- `/usr/local/share/applications` (global version of above)
-- `/etc/xdg/autostart` (global version of the above)
+Additionally `~/.config/autostart` or `/etc/xdg/autostart` could symlink here
+so graphical desktop environments started the apps on login.
+
+<!-- editorconfig-checker-disable -->
+<!-- prettier-ignore-start -->
+
+<!-- START doctoc generated TOC please keep comment here to allow auto update -->
+<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
+
+- [`a-*.desktop`](#a-desktop)
+- [Refreshing the menus](#refreshing-the-menus)
+
+<!-- END doctoc generated TOC please keep comment here to allow auto update -->
+
+<!-- prettier-ignore-end -->
+<!-- editorconfig-checker-enable -->
 
 ## `a-*.desktop`
 
 These files are companions to my script repos `bash/usr-local-bin/*` belonging
 to `/usr/local/share/applications` and are named so to
 avoid masking package manager. They have clearly different names such as using
-all caps. To refresh them:
+all caps.
+
+## Refreshing the menus
 
 ```bash
+update-desktop-database -v ~/.local/share/applications
 sudo update-desktop-database -v /usr/local/share/applications
 ```

local/share/applications/a-brave-beta.desktop

@@ -1,7 +1,7 @@
 [Desktop Entry]
 Version=1.0
 Type=Application
-Name=BRAVE BETA
+Name=BETA BRAVE
 Exec=/usr/local/bin/brave-beta %U
 StartupNotify=true
 Terminal=false

local/share/applications/a-brave-nightly.desktop

@@ -1,8 +1,8 @@
 [Desktop Entry]
 Version=1.0
 Type=Application
-Name=BRAVE NIGHTLY
-Name[fi]=BRAVE EPÄVAKAIN
+Name=NIGHTLY BRAVE
+Name[fi]=EPÄVAKAIN BRAVE
 Exec=/usr/local/bin/brave-nightly %U
 StartupNotify=true
 Terminal=false

local/share/applications/a-jami.desktop

@@ -1,5 +0,0 @@
-[Desktop Entry]
-Name=JAMI
-Exec=flatpak run --env=TZ=UTC net.jami.Jami
-Icon=net.jami.Jami
-Type=Application

local/share/applications/a-syncplay.desktop

@@ -1,6 +1,7 @@
 [Desktop Entry]
 Name=SYNCPLAY
 Exec=/usr/local/bin/syncplay %u
+Terminal=true
 Type=Application
 Icon=syncplay
 Categories=AudioVideo;Audio;Video;

local/share/applications/a-telegram.desktop

@@ -1,5 +0,0 @@
-[Desktop Entry]
-Name=TELEGRAM
-Exec=/usr/local/bin/telegram-desktop
-Icon=telegram
-Type=Application