From e5e608c580e9598d897485f66a14bce0e0740d1d Mon Sep 17 00:00:00 2001
From: Cilly Leang <mini@cilly.moe>
Date: Thu, 28 May 2026 21:56:34 +1000
Subject: [PATCH] services/unbound: allow access from tailscale

---
 modules/services/unbound.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/services/unbound.nix b/modules/services/unbound.nix
index a1b4ac4..8aae0fd 100644
--- a/modules/services/unbound.nix
+++ b/modules/services/unbound.nix
@@ -41,8 +41,10 @@ in {
         access-control = [
           "127.0.0.1/8      allow"
           "10.0.0.0/8       allow"
+          "100.64.0.0/10    allow"
           "192.168.100.0/24 allow"
-          "fd0d::/16 allow"
+          "fd0d::/16        allow"
+          "fd7a:115c:a1e0::/48 allow"
           "${gcSecrets.wireguard.ipv6Subnet}:/80 allow"
         ];
         domain-insecure = [ "\"local.lava.moe\"" ];