nixy/dnscrypt2: add separate service for wg netns

nixy/configuration.nix

@@ -243,6 +243,58 @@
         };
       };
 
+      "dnscrypt-proxy2_proton" = {
+        description = "DNSCrypt-proxy client proton";
+        wants = [
+          "network-online.target"
+          "nss-lookup.target"
+        ];
+        before = [
+          "nss-lookup.target"
+        ];
+        after = ["wg_proton.service"];
+        bindsTo = ["netns@wg.service"];
+        serviceConfig = {
+          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+          CacheDirectory = "dnscrypt-proxy";
+          DynamicUser = true;
+          ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy -config ${config.services.dnscrypt-proxy2.configFile}";
+          LockPersonality = true;
+          LogsDirectory = "dnscrypt-proxy";
+          MemoryDenyWriteExecute = true;
+          NetworkNamespacePath = "/var/run/netns/wg";
+          NonBlocking = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          Restart = "always";
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RuntimeDirectory = "dnscrypt-proxy";
+          StateDirectory = "dnscrypt-proxy";
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "@chown"
+            "~@aio"
+            "~@keyring"
+            "~@memlock"
+            "~@setuid"
+            "~@timer"
+          ];
+        };
+      };
     };
 
     extraConfig = ''