nix: update the dnscrypt-proxy module

nix/modules/dnscrypt.nix

@@ -4,33 +4,11 @@
   ...
 }: let
   usr = "dnscrypt-proxy";
-in {
+  listenAddresses = [
-  sops.secrets = {
-    dnscrypt-proxy-forwardingRules = {
-      sopsFile = ../secrets/dnscrypt-proxy.yaml;
-      owner = usr;
-      group = usr;
-    };
-  };
-
-  services.dnscrypt-proxy2 = {
-    enable = true;
-    # don't go from scratch.
-    upstreamDefaults = true;
-    settings = {
-      listen_addresses = [
     "127.0.0.1:53"
     "[::1]:53"
   ];
-      ipv4_servers = true;
+  disabledServerNames = [
-      ipv6_servers = false;
-      dnscrypt_servers = true;
-      doh_servers = true;
-      odoh_servers = false;
-      require_dnssec = true;
-      require_nolog = true;
-      require_nofilter = true;
-      disabled_server_names = [
     "google-ipv6"
     "cloudflare"
     "cloudflare-ipv6"
@@ -58,16 +36,9 @@ in {
     "acsacsar-ams-ipv4"
     "dnscrypt.uk-ipv4"
     "adguard-dns-unfiltered"
+    "dnscry.pt-vienna-ipv4"
   ];
-      http3 = true;
+  bootstrapResolvers = [
-      timeout = 1000;
-      keepalive = 30;
-      lb_strategy = "p7";
-      lb_estimator = true;
-      log_level = 2;
-      use_syslog = true;
-      cert_refresh_delay = 60;
-      bootstrap_resolvers = [
     "9.9.9.9:53"
     "84.200.69.80:53"
     "84.200.70.40:53"
@@ -77,6 +48,39 @@ in {
     # "[2001:67c:28a4::]:53"
     # "[2001:1608:10:25::1c04:b12f]:53"
   ];
+in {
+  sops.secrets = {
+    dnscrypt-proxy-forwardingRules = {
+      sopsFile = ../secrets/dnscrypt-proxy.yaml;
+      owner = usr;
+      group = usr;
+    };
+  };
+
+  services.dnscrypt-proxy2 = {
+    enable = true;
+    # don't go from scratch.
+    upstreamDefaults = true;
+    settings = {
+      listen_addresses = listenAddresses;
+      ipv4_servers = true;
+      ipv6_servers = false;
+      dnscrypt_servers = true;
+      doh_servers = true;
+      odoh_servers = false;
+      require_dnssec = true;
+      require_nolog = true;
+      require_nofilter = true;
+      disabled_server_names = disabledServerNames;
+      http3 = true;
+      timeout = 1000;
+      keepalive = 30;
+      lb_strategy = "p7";
+      lb_estimator = true;
+      log_level = 2;
+      use_syslog = true;
+      cert_refresh_delay = 60;
+      bootstrap_resolvers = bootstrapResolvers;
       ignore_system_dns = true;
       # never timeout;
       netprobe_timeout = -1;
@@ -123,7 +127,10 @@ in {
     };
   };
 
-  systemd.services.dnscrypt-proxy2.serviceConfig = {
+  systemd.services.dnscrypt-proxy2 = {
+    after = ["sops-nix.service"];
+    wants = ["coredns.service"];
+    serviceConfig = {
       StateDirectory = usr;
       WorkingDirectory = "/";
       # StartLimitIntervalSec = 5;
@@ -133,6 +140,7 @@ in {
       User = usr;
       Group = usr;
     };
+  };
 
   users.users.dnscrypt-proxy = {
     group = usr;