From b4d3b524542516f521816ec91c9abf7e04f4979c Mon Sep 17 00:00:00 2001
From: Crony Akatsuki <crony@cronyakatsuki.xyz>
Date: Tue, 20 Jan 2026 16:09:47 +0100
Subject: [PATCH] fix: disable resolved dns stub listener.

---
 modules/servers/per-server/heimdall/services/wireguard.nix | 4 ++++
 modules/servers/per-server/tyr/services/wireguard.nix      | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/modules/servers/per-server/heimdall/services/wireguard.nix b/modules/servers/per-server/heimdall/services/wireguard.nix
index bd01782..79247bc 100644
--- a/modules/servers/per-server/heimdall/services/wireguard.nix
+++ b/modules/servers/per-server/heimdall/services/wireguard.nix
@@ -1,4 +1,8 @@
 {config, ...}: {
+  services.resolved.settings.Resolve = {
+    DNSStubListener = "no";
+  };
+
   networking = {
     nat = {
       enable = true;
diff --git a/modules/servers/per-server/tyr/services/wireguard.nix b/modules/servers/per-server/tyr/services/wireguard.nix
index 5dd8270..0d58945 100644
--- a/modules/servers/per-server/tyr/services/wireguard.nix
+++ b/modules/servers/per-server/tyr/services/wireguard.nix
@@ -1,4 +1,8 @@
 {config, ...}: {
+  services.resolved.settings.Resolve = {
+    DNSStubListener = "no";
+  };
+
   networking = {
     nat = {
       enable = true;