Skynet/nixos
6
1
Fork 0
Code Issues 43 Pull requests 1 Projects Releases Packages Wiki Activity Actions

dns: abstracted away much of the dns logic into teh dns config file

Browse source
This commit is contained in:
silver 2023-07-15 15:54:42 +01:00
parent 6412a53070
commit d683598060
4 changed files with 94 additions and 178 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

124
applications/dns.nix
View file

@ -1,4 +1,4 @@
{ lib, pkgs, config, ... }: { lib, pkgs, config, nodes, ... }:
let let
cfg = config.skynet_dns; cfg = config.skynet_dns;
@ -9,7 +9,7 @@ let
get_config_file = (domain: get_config_file = (domain:
''$TTL 60 ; 1 minute ''$TTL 60 ; 1 minute
; hostmaster@${domain} is an email address that recieves stuff related to dns ; hostmaster@${domain} is an email address that recieves stuff related to dns
@ IN SOA ${cfg.own.nameserver}.${domain}. hostmaster.${domain}. ( @ IN SOA ${nameserver}.${domain}. hostmaster.${domain}. (
; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated ; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated
${current_date} ${current_date}
600 ; Refresh (10 minutes) 600 ; Refresh (10 minutes)
@ -31,14 +31,7 @@ let
; ------------------------------------------ ; ------------------------------------------
; Server Names ; Server Names
; ------------------------------------------ ; ------------------------------------------
${lib.strings.concatMapStrings (x: x + "\n") records.external}
; External addresses
; ------------------------------------------
${lib.strings.concatMapStrings (x: x + "\n") cfg.records.external}
; this is fixed for now
wintermute A 193.1.101.148
; internal addresses ; internal addresses
@ -49,7 +42,7 @@ wintermute A 193.1.101.148
; cname's ; cname's
; ------------------------------------------ ; ------------------------------------------
${lib.strings.concatMapStrings (x: x + "\n") cfg.records.cname} ${lib.strings.concatMapStrings (x: x + "\n") records.cname}
'' ''
); );
@ -61,7 +54,7 @@ ${lib.strings.concatMapStrings (x: x + "\n") cfg.records.cname}
''$ORIGIN 99.1.193.in-addr.arpa. ''$ORIGIN 99.1.193.in-addr.arpa.
$TTL 60 ; 1 minute $TTL 60 ; 1 minute
; hostmaster@skynet.ie is an email address that recieves stuff related to dns ; hostmaster@skynet.ie is an email address that recieves stuff related to dns
@ IN SOA ${cfg.own.nameserver}.skynet.ie. hostmaster.skynet.ie. ( @ IN SOA ${nameserver}.skynet.ie. hostmaster.skynet.ie. (
; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated ; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated
${current_date} ${current_date}
600 ; Refresh (10 minutes) 600 ; Refresh (10 minutes)
@ -73,7 +66,7 @@ $TTL 60 ; 1 minute
@ NS ns1.skynet.ie. @ NS ns1.skynet.ie.
@ NS ns2.skynet.ie. @ NS ns2.skynet.ie.
${lib.strings.concatMapStrings (x: x + "\n") cfg.records.reverse} ${lib.strings.concatMapStrings (x: x + "\n") records.reverse}
'' ''
); );
@ -81,7 +74,7 @@ ${lib.strings.concatMapStrings (x: x + "\n") cfg.records.reverse}
get_config_file_old_domains = (domain: get_config_file_old_domains = (domain:
''$TTL 60 ; 1 minute ''$TTL 60 ; 1 minute
; hostmaster@skynet.ie is an email address that recieves stuff related to dns ; hostmaster@skynet.ie is an email address that recieves stuff related to dns
@ IN SOA ${cfg.own.nameserver}.skynet.ie. hostmaster.skynet.ie. ( @ IN SOA ${nameserver}.skynet.ie. hostmaster.skynet.ie. (
; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated ; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated
${current_date} ${current_date}
600 ; Refresh (10 minutes) 600 ; Refresh (10 minutes)
@ -100,18 +93,18 @@ ${lib.strings.concatMapStrings (x: x + "\n") cfg.records.reverse}
tmp1 = ["193.1.99.109"]; tmp1 = ["193.1.99.109"];
tmp2 = ["193.1.99.120"]; tmp2 = ["193.1.99.120"];
primaries = (if cfg.primary then primaries = (if cfg.server.primary then
# primary servers have no primaries (ones they listen to) # primary servers have no primaries (ones they listen to)
[] []
else else
if builtins.elem cfg.own.ip tmp1 then if builtins.elem cfg.server.ip tmp1 then
tmp2 tmp2
else else
tmp1 tmp1
); );
secondaries = (if cfg.primary then secondaries = (if cfg.server.primary then
if builtins.elem cfg.own.ip tmp1 then if builtins.elem cfg.server.ip tmp1 then
tmp2 tmp2
else else
tmp1 tmp1
@ -158,7 +151,7 @@ ${extraConfig}
// ${current_date} // ${current_date}
''; '';
# really wish teh nixos config didnt use master/slave # really wish teh nixos config didnt use master/slave
master = cfg.primary; master = cfg.server.primary;
masters = primaries; masters = primaries;
slaves = secondaries; slaves = secondaries;
# need to write this to a file # need to write this to a file
@ -176,7 +169,7 @@ ${extraConfig}
extraConfig = { extraConfig = {
owned = owned =
if cfg.primary then if cfg.server.primary then
'' ''
allow-update { key rfc2136key.skynet.ie.; }; allow-update { key rfc2136key.skynet.ie.; };
@ -192,6 +185,53 @@ inline-signing yes;
old = ""; old = "";
}; };
records = {
# using the same logic as the firewall, comments there
external = builtins.concatLists (
lib.attrsets.mapAttrsToList (key: value:
let
details_server = value.config.skynet_dns.server;
details_records = value.config.skynet_dns.records;
in
if builtins.hasAttr "skynet_dns" value.config
then (
if details_server.enable
then (
if details_server.primary
then details_records.external ++ ["ns1 A ${details_server.ip}"]
else details_records.external ++ ["ns2 A ${details_server.ip}"]
)
else details_records.external
)
else []
) nodes
);
cname = builtins.concatLists (
lib.attrsets.mapAttrsToList (key: value:
let
details_records = value.config.skynet_dns.records;
in
if builtins.hasAttr "skynet_dns" value.config
then details_records.cname
else []
) nodes
);
reverse = builtins.concatLists (
lib.attrsets.mapAttrsToList (key: value:
let
details_records = value.config.skynet_dns.records;
in
if builtins.hasAttr "skynet_dns" value.config
then details_records.reverse
else []
) nodes
);
};
nameserver = if cfg.server.primary then "ns1" else "ns2";
in { in {
imports = [ imports = [
@ -200,10 +240,10 @@ in {
options = { options = {
skynet_dns = { skynet_dns = {
server = {
enable = lib.mkEnableOption { enable = lib.mkEnableOption {
default = false; default = false;
example = true; description = "Skynet DNS server";
description = "Skynet DNS";
type = lib.types.bool; type = lib.types.bool;
}; };
@ -212,48 +252,14 @@ in {
default = false; default = false;
}; };
own = {
ip = lib.mkOption { ip = lib.mkOption {
type = lib.types.str; type = lib.types.str;
description = '' description = ''
ip of this server ip of this server
''; '';
}; };
nameserver = lib.mkOption {
default = "ns1";
type = lib.types.str;
description = ''
the hostname of this nameserver, eg ns1, ns2
'';
}; };
external = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
External records like: agentjones A 193.1.99.72
'';
};
cname = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
External records like: ns1 CNAME ns1
'';
};
reverse = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
External records like: 20 IN PTR vigil
'';
};
};
records = { records = {
external = lib.mkOption { external = lib.mkOption {
default = [ ]; default = [ ];
@ -283,12 +289,12 @@ in {
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.server.enable {
# open the firewall for this # open the firewall for this
skynet_firewall.forward = [ skynet_firewall.forward = [
"ip daddr ${cfg.own.ip} tcp dport 53 counter packets 0 bytes 0 accept" "ip daddr ${cfg.server.ip} tcp dport 53 counter packets 0 bytes 0 accept"
"ip daddr ${cfg.own.ip} udp dport 53 counter packets 0 bytes 0 accept" "ip daddr ${cfg.server.ip} udp dport 53 counter packets 0 bytes 0 accept"
]; ];
services.bind.zones = services.bind.zones =

2
flake.nix
View file

@ -59,7 +59,7 @@
# ns1 # ns1
vendetta = import ./machines/vendetta.nix; vendetta = import ./machines/vendetta.nix;
# ns1 # ns2
vigil = import ./machines/vigil.nix; vigil = import ./machines/vigil.nix;
# icecast - ULFM # icecast - ULFM

57
machines/vendetta.nix
View file

@ -17,9 +17,6 @@ let
ip_pub = "193.1.99.120"; ip_pub = "193.1.99.120";
ip_priv = "172.20.20.3"; ip_priv = "172.20.20.3";
hostname = "${name}.skynet.ie"; hostname = "${name}.skynet.ie";
# sets which nameserver it is
ns = "ns1";
in { in {
imports = [ imports = [
./hardware/_base.nix ./hardware/_base.nix
@ -56,65 +53,21 @@ in {
}; };
skynet_dns = { skynet_dns = {
server = {
enable = true; enable = true;
# primary dns server (ns1)
# primary dns server
primary = true; primary = true;
# this server will have to have dns records
own = {
nameserver = ns;
ip = ip_pub; ip = ip_pub;
};
records = {
external = [ external = [
"${name} A ${ip_pub}" "${name} A ${ip_pub}"
"${ns} A ${ip_pub}"
];
cname = [
#"misc CNAME vendetta"
]; ];
reverse = [ reverse = [
"${builtins.substring 9 3 ip_pub} IN PTR ${hostname}." "${builtins.substring 9 3 ip_pub} IN PTR ${hostname}."
]; ];
}; };
records = {
# using the same logic as the firewall, comments there
external = builtins.concatLists (
lib.attrsets.mapAttrsToList (key: value:
if builtins.hasAttr "skynet_dns" value.config
then (
if value.config.skynet_dns.enable
then value.config.skynet_dns.own.external
else value.config.skynet_dns.records.external
)
else []
) nodes
);
cname = builtins.concatLists (
lib.attrsets.mapAttrsToList (key: value:
if builtins.hasAttr "skynet_dns" value.config
then (
if value.config.skynet_dns.enable
then value.config.skynet_dns.own.cname
else value.config.skynet_dns.records.cname
)
else []
) nodes
);
reverse = builtins.concatLists (
lib.attrsets.mapAttrsToList (key: value:
if builtins.hasAttr "skynet_dns" value.config
then (
if value.config.skynet_dns.enable
then value.config.skynet_dns.own.reverse
else value.config.skynet_dns.records.reverse
)
else []
) nodes
);
};
}; };
} }

55
machines/vigil.nix
View file

@ -16,9 +16,6 @@ let
ip_pub = "193.1.99.109"; ip_pub = "193.1.99.109";
ip_priv = "172.20.20.4"; ip_priv = "172.20.20.4";
hostname = "${name}.skynet.ie"; hostname = "${name}.skynet.ie";
# sets which nameserver it is
ns = "ns2";
in { in {
imports = [ imports = [
@ -40,62 +37,22 @@ in {
}; };
skynet_dns = { skynet_dns = {
server = {
enable = true; enable = true;
# secondary dns server (ns2)
primary = false;
ip = ip_pub;
};
# this server will have to have dns records # this server will have to have dns records
own = { records = {
nameserver = ns;
ip = ip_pub;
external = [ external = [
"${name} A ${ip_pub}" "${name} A ${ip_pub}"
"${ns} A ${ip_pub}"
];
cname = [
#"misc CNAME vendetta"
]; ];
reverse = [ reverse = [
"${builtins.substring 9 3 ip_pub} IN PTR ${hostname}." "${builtins.substring 9 3 ip_pub} IN PTR ${hostname}."
]; ];
}; };
records = {
# using the same logic as the firewall, comments there
external = builtins.concatLists (
lib.attrsets.mapAttrsToList (key: value:
if builtins.hasAttr "skynet_dns" value.config
then (
if value.config.skynet_dns.enable
then value.config.skynet_dns.own.external
else value.config.skynet_dns.records.external
)
else []
) nodes
);
cname = builtins.concatLists (
lib.attrsets.mapAttrsToList (key: value:
if builtins.hasAttr "skynet_dns" value.config
then (
if value.config.skynet_dns.enable
then value.config.skynet_dns.own.cname
else value.config.skynet_dns.records.cname
)
else []
) nodes
);
reverse = builtins.concatLists (
lib.attrsets.mapAttrsToList (key: value:
if builtins.hasAttr "skynet_dns" value.config
then (
if value.config.skynet_dns.enable
then value.config.skynet_dns.own.reverse
else value.config.skynet_dns.records.reverse
)
else []
) nodes
);
};
}; };
} }