fmt: move the dns into its own folder
This commit is contained in:
parent
b1bd6ca40a
commit
cb0cfbaf4a
GPG key ID:
54E2C71918E93B74
2 changed files with 5 additions and 5 deletions
443
applications/dns/dns.nix
Normal file
443
applications/dns/dns.nix
Normal file
|
|
@ -0,0 +1,443 @@
|
|||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
nodes,
|
||||
...
|
||||
}: let
|
||||
name = "dns";
|
||||
cfg = config.services.skynet."${name}";
|
||||
|
||||
# reads that date to a string (will need to be fixed in 2038)
|
||||
current_date = lib.readFile "${pkgs.runCommand "timestamp" {} "echo -n `date +%s` > $out"}";
|
||||
|
||||
# gets a list of records that match this type
|
||||
filter_records_type = r_type: builtins.filter (x: x.r_type == r_type) records;
|
||||
filter_records_server = builtins.filter (x: builtins.hasAttr "server" x && x.server) (filter_records_type "A");
|
||||
filter_records_a = builtins.filter (x: builtins.hasAttr "server" x && !x.server) (filter_records_type "A");
|
||||
|
||||
process_ptr = records: lib.lists.forEach records (x: process_ptr_sub x);
|
||||
process_ptr_sub = record: {
|
||||
record = builtins.substring 9 3 record.record;
|
||||
r_type = "PTR";
|
||||
value = record.value;
|
||||
};
|
||||
ip_ptr_to_int = ip: lib.strings.toInt (builtins.substring 9 3 ip);
|
||||
|
||||
sort_records_server = builtins.sort (a: b: a.record < b.record) filter_records_server;
|
||||
sort_records_a = builtins.sort (a: b: (ip_ptr_to_int a.value) < (ip_ptr_to_int b.value)) filter_records_a;
|
||||
sort_records_cname = builtins.sort (a: b: a.value < b.value) (filter_records_type "CNAME");
|
||||
sort_records_ptr = builtins.sort (a: b: (lib.strings.toInt a.record) < (lib.strings.toInt b.record)) (process_ptr (filter_records_type "PTR"));
|
||||
sort_records_srv = builtins.sort (a: b: a.record < b.record) (filter_records_type "SRV");
|
||||
|
||||
format_records = records: offset: lib.strings.concatMapStrings (x: "${padString x.record offset} IN ${padString x.r_type 5} ${x.value}\n") records;
|
||||
|
||||
# small function to trim it down a tad
|
||||
padString = text: length: fixedWidthString_post length " " text;
|
||||
|
||||
# like lib.strings.fixedWidthString but postfix
|
||||
fixedWidthString_post = width: filler: str: let
|
||||
strw = lib.stringLength str;
|
||||
reqWidth = width - (lib.stringLength filler);
|
||||
in
|
||||
assert lib.assertMsg (strw <= width) "fixedWidthString_post: requested string length (${toString width}) must not be shorter than actual length (${toString strw})";
|
||||
if strw == width
|
||||
then str
|
||||
else (fixedWidthString_post reqWidth filler str) + filler;
|
||||
|
||||
# base config for domains we own (skynet.ie, csn.ul.ie, ulcompsoc.ie)
|
||||
get_config_file = (
|
||||
domain: ''
|
||||
$TTL 60 ; 1 minute
|
||||
; hostmaster@${domain} is an email address that recieves stuff related to dns
|
||||
@ IN SOA ${nameserver}.${domain}. hostmaster.${domain}. (
|
||||
; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated
|
||||
${current_date}
|
||||
600 ; Refresh (10 minutes)
|
||||
300 ; Retry (5 minutes)
|
||||
604800 ; Expire (1 week)
|
||||
3600 ; Minimum (1 hour)
|
||||
)
|
||||
|
||||
@ NS ns1.${domain}.
|
||||
@ NS ns2.${domain}.
|
||||
; @ stands for teh root domain so teh A record below is where ${domain} points to
|
||||
;@ A 193.1.99.76
|
||||
;@ MX 5 ${domain}.
|
||||
|
||||
; can have multiple mailserves
|
||||
@ MX 10 mail.${domain}.
|
||||
|
||||
|
||||
; ------------------------------------------
|
||||
; Server Names (A Records)
|
||||
; ------------------------------------------
|
||||
${format_records sort_records_server 31}
|
||||
|
||||
; ------------------------------------------
|
||||
; A (non server names
|
||||
; ------------------------------------------
|
||||
${format_records sort_records_a 31}
|
||||
|
||||
; ------------------------------------------
|
||||
; CNAMES
|
||||
; ------------------------------------------
|
||||
${format_records sort_records_cname 31}
|
||||
|
||||
; ------------------------------------------
|
||||
; TXT
|
||||
; ------------------------------------------
|
||||
${format_records (filter_records_type "TXT") 31}
|
||||
|
||||
; ------------------------------------------
|
||||
; MX
|
||||
; ------------------------------------------
|
||||
${format_records (filter_records_type "MX") 31}
|
||||
|
||||
; ------------------------------------------
|
||||
; SRV
|
||||
; ------------------------------------------
|
||||
${format_records sort_records_srv 65}
|
||||
|
||||
|
||||
''
|
||||
);
|
||||
|
||||
# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/4/html/reference_guide/s2-bind-configuration-zone-reverse
|
||||
# config for our reverse dnspointers (not properly working)
|
||||
get_config_file_rev = (
|
||||
domain: ''
|
||||
$ORIGIN 64-64.99.1.193.in-addr.arpa.
|
||||
$TTL 60 ; 1 minute
|
||||
; hostmaster@skynet.ie is an email address that recieves stuff related to dns
|
||||
@ IN SOA ${nameserver}.skynet.ie. hostmaster.skynet.ie. (
|
||||
; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated
|
||||
${current_date}
|
||||
600 ; Refresh (10 minutes)
|
||||
300 ; Retry (5 minutes)
|
||||
604800 ; Expire (1 week)
|
||||
3600 ; Minimum (1 hour)
|
||||
)
|
||||
|
||||
@ NS ns1.skynet.ie.
|
||||
@ NS ns2.skynet.ie.
|
||||
|
||||
; ------------------------------------------
|
||||
; PTR
|
||||
; ------------------------------------------
|
||||
${format_records sort_records_ptr 3}
|
||||
''
|
||||
);
|
||||
|
||||
# domains we dont have proper ownship over, only here to ensure the logs dont get cluttered.
|
||||
get_config_file_old_domains = (
|
||||
domain: ''
|
||||
$TTL 60 ; 1 minute
|
||||
; hostmaster@skynet.ie is an email address that recieves stuff related to dns
|
||||
@ IN SOA ${nameserver}.skynet.ie. hostmaster.skynet.ie. (
|
||||
; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated
|
||||
${current_date}
|
||||
600 ; Refresh (10 minutes)
|
||||
300 ; Retry (5 minutes)
|
||||
604800 ; Expire (1 week)
|
||||
3600 ; Minimum (1 hour)
|
||||
)
|
||||
|
||||
@ NS ns1.skynet.ie.
|
||||
@ NS ns2.skynet.ie.
|
||||
|
||||
''
|
||||
);
|
||||
|
||||
# arrys of teh two nameservers
|
||||
tmp1 = ["193.1.99.109"];
|
||||
tmp2 = ["193.1.99.120"];
|
||||
|
||||
primaries = (
|
||||
if cfg.server.primary
|
||||
then
|
||||
# primary servers have no primaries (ones they listen to)
|
||||
[]
|
||||
else if builtins.elem cfg.server.ip tmp1
|
||||
then tmp2
|
||||
else tmp1
|
||||
);
|
||||
|
||||
secondaries = (
|
||||
if cfg.server.primary
|
||||
then
|
||||
if builtins.elem cfg.server.ip tmp1
|
||||
then tmp2
|
||||
else tmp1
|
||||
else []
|
||||
);
|
||||
|
||||
# small function to tidy up the spam of the cache networks, would use teh subnet except all external traffic has the ip of teh router
|
||||
create_cache_networks = map (x: "193.1.99.${toString x}/32") (lib.lists.range 71 126);
|
||||
|
||||
# standard function to create the etc file, pass in the text and domain and it makes it
|
||||
create_entry_etc_sub = domain: text: {
|
||||
# Creates /etc/skynet/dns/domain
|
||||
"skynet/dns/${domain}" = {
|
||||
user = "named";
|
||||
group = "named";
|
||||
|
||||
# The UNIX file mode bits
|
||||
mode = "0664";
|
||||
|
||||
text = text;
|
||||
};
|
||||
};
|
||||
# (text.owned "csn.ul.ie")
|
||||
|
||||
# standard function to create the etc file, pass in the text and domain and it makes it
|
||||
create_entry_etc = domain: type:
|
||||
if type == "owned"
|
||||
then create_entry_etc_sub domain (text.owned domain)
|
||||
else if type == "reverse"
|
||||
then create_entry_etc_sub domain (text.reverse domain)
|
||||
else if type == "old"
|
||||
then create_entry_etc_sub domain (text.old domain)
|
||||
else {};
|
||||
|
||||
create_entry_zone = domain: extraConfig: {
|
||||
"${domain}" = {
|
||||
extraConfig = ''
|
||||
${extraConfig}
|
||||
// for bumping the config
|
||||
// ${current_date}
|
||||
'';
|
||||
# really wish teh nixos config didnt use master/slave
|
||||
master = cfg.server.primary;
|
||||
masters = primaries;
|
||||
slaves = secondaries;
|
||||
# need to write this to a file
|
||||
# using the date in it so it will trigger a restart
|
||||
file = "/etc/skynet/dns/${domain}";
|
||||
# no leading whitespace for first line
|
||||
};
|
||||
};
|
||||
|
||||
text = {
|
||||
owned = domain: get_config_file domain;
|
||||
reverse = domain: get_config_file_rev domain;
|
||||
old = domain: get_config_file_old_domains domain;
|
||||
};
|
||||
|
||||
extraConfig = {
|
||||
owned =
|
||||
if cfg.server.primary
|
||||
then ''
|
||||
allow-update { key rfc2136key.skynet.ie.; };
|
||||
|
||||
dnssec-policy default;
|
||||
inline-signing yes;
|
||||
''
|
||||
else "";
|
||||
|
||||
# no extra config for reverse
|
||||
reverse = "";
|
||||
|
||||
old = "";
|
||||
};
|
||||
|
||||
records =
|
||||
config.skynet.records
|
||||
++ builtins.concatLists (
|
||||
lib.attrsets.mapAttrsToList (
|
||||
key: value: let
|
||||
details_server = value.config.services.skynet."${name}".server;
|
||||
details_records = value.config.services.skynet."${name}".records;
|
||||
in
|
||||
if builtins.hasAttr "dns" value.config.services.skynet
|
||||
then
|
||||
(
|
||||
# got to handle habing a dns record for the dns serves themselves.
|
||||
if details_server.enable
|
||||
then
|
||||
(
|
||||
if details_server.primary
|
||||
then
|
||||
details_records
|
||||
++ [
|
||||
{
|
||||
record = "ns1";
|
||||
r_type = "A";
|
||||
value = details_server.ip;
|
||||
server = false;
|
||||
}
|
||||
]
|
||||
else
|
||||
details_records
|
||||
++ [
|
||||
{
|
||||
record = "ns2";
|
||||
r_type = "A";
|
||||
value = details_server.ip;
|
||||
server = false;
|
||||
}
|
||||
]
|
||||
)
|
||||
else details_records
|
||||
)
|
||||
else []
|
||||
)
|
||||
nodes
|
||||
);
|
||||
|
||||
nameserver =
|
||||
if cfg.server.primary
|
||||
then "ns1"
|
||||
else "ns2";
|
||||
in {
|
||||
imports = [
|
||||
../firewall.nix
|
||||
../../config/dns.nix
|
||||
];
|
||||
|
||||
options.services.skynet."${name}" = {
|
||||
server = {
|
||||
enable = lib.mkEnableOption {
|
||||
default = false;
|
||||
description = "Skynet DNS server";
|
||||
type = lib.types.bool;
|
||||
};
|
||||
|
||||
primary = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
};
|
||||
|
||||
ip = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
ip of this server
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
records = lib.mkOption {
|
||||
description = "Records, sorted based on therir type";
|
||||
type = lib.types.listOf (lib.types.submodule (import ./options-records.nix {
|
||||
inherit lib;
|
||||
}));
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.server.enable {
|
||||
# logging
|
||||
services.prometheus.exporters.bind = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
# services.skynet.backup.normal.backups = ["/etc/skynet/dns"];
|
||||
|
||||
# open the firewall for this
|
||||
skynet_firewall.forward = [
|
||||
"ip daddr ${cfg.server.ip} tcp dport 53 counter packets 0 bytes 0 accept"
|
||||
"ip daddr ${cfg.server.ip} udp dport 53 counter packets 0 bytes 0 accept"
|
||||
];
|
||||
|
||||
services.bind.zones =
|
||||
(create_entry_zone "csn.ul.ie" extraConfig.owned)
|
||||
// (create_entry_zone "skynet.ie" extraConfig.owned)
|
||||
// (create_entry_zone "ulcompsoc.ie" extraConfig.owned)
|
||||
// (create_entry_zone "64-64.99.1.193.in-addr.arpa" extraConfig.reverse)
|
||||
// (create_entry_zone "conradcollins.net" extraConfig.old)
|
||||
// (create_entry_zone "edelharty.net" extraConfig.old);
|
||||
|
||||
environment.etc =
|
||||
(create_entry_etc "csn.ul.ie" "owned")
|
||||
// (create_entry_etc "skynet.ie" "owned")
|
||||
// (create_entry_etc "ulcompsoc.ie" "owned")
|
||||
// (create_entry_etc "64-64.99.1.193.in-addr.arpa" "reverse")
|
||||
// (create_entry_etc "conradcollins.net" "old")
|
||||
// (create_entry_etc "edelharty.net" "old");
|
||||
|
||||
# secrets required
|
||||
age.secrets.dns_dnskeys = {
|
||||
file = ../../secrets/dns_dnskeys.conf.age;
|
||||
owner = "named";
|
||||
group = "named";
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [53];
|
||||
allowedUDPPorts = [53];
|
||||
};
|
||||
|
||||
services.bind = {
|
||||
enable = true;
|
||||
|
||||
ipv4Only = true;
|
||||
|
||||
# need to take a look at https://nixos.org/manual/nixos/unstable/#module-security-acme-config-dns
|
||||
extraConfig = ''
|
||||
include "/run/agenix/dns_dnskeys";
|
||||
|
||||
statistics-channels {
|
||||
inet 127.0.0.1 port 8053 allow { 127.0.0.1; };
|
||||
};
|
||||
'';
|
||||
|
||||
# piles of no valid RRSIG resolving 'com/DS/IN' errors
|
||||
extraOptions = ''
|
||||
dnssec-validation yes;
|
||||
'';
|
||||
|
||||
# set the upstream dns servers
|
||||
# overrides the default dns servers
|
||||
forwarders = [
|
||||
# Cloudflare
|
||||
"1.1.1.1"
|
||||
# Google
|
||||
"8.8.8.8"
|
||||
# Quad9
|
||||
"9.9.9.9"
|
||||
];
|
||||
|
||||
cacheNetworks =
|
||||
[
|
||||
# this server itself
|
||||
"127.0.0.0/24"
|
||||
|
||||
# skynet server in the dmz
|
||||
"193.1.96.165/32"
|
||||
# all of skynet can use this as a resolver
|
||||
/*
|
||||
Origianl idea, however all external traffic had the ip of the router
|
||||
"193.1.99.64/26"
|
||||
|
||||
So to fix this we need to allow smaller ranges? - Didnt work
|
||||
Fallback is explisitly listing each ip we have
|
||||
|
||||
Now have a function for it
|
||||
*/
|
||||
]
|
||||
++ create_cache_networks;
|
||||
};
|
||||
|
||||
systemd.services.bind = {
|
||||
# deletes teh journal files evey start so it no longer stalls out
|
||||
preStart = ''
|
||||
rm -vf /etc/skynet/dns/*.jnl
|
||||
rm -vf /etc/skynet/dns/*.jbk
|
||||
'';
|
||||
restartTriggers = [
|
||||
"${config.environment.etc."skynet/dns/skynet.ie".source}"
|
||||
];
|
||||
};
|
||||
|
||||
# creates a folder in /etc for the dns to use
|
||||
users.groups.named = {};
|
||||
|
||||
users.users.named = {
|
||||
createHome = true;
|
||||
home = "/etc/skynet/dns";
|
||||
group = "named";
|
||||
# X11 is to ensure the directory can be traversed
|
||||
homeMode = "711";
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue