nixos/applications/dns.nix

{ lib, pkgs, config, ... }:
let
  cfg = config.skynet_dns;

  # writes current date to a file
  current_date_path = pkgs.runCommand "current_date" {} "date '+%Y%m%d%S' > $out";
  # reads that date to a string
  current_date = (lib.readFile current_date_path);
in {
  options = {
    skynet_dns = {
      enable = lib.mkEnableOption {
        default = false;
        example = true;
        description = "Skynet DNS";
        type = lib.types.bool;
      };

      own = {
        nameserver = lib.mkOption {
          default = "ns1";
          type = lib.types.str;
          description = ''
            the hostname of this nameserver, eg ns1, ns2
          '';
        };

        external = lib.mkOption {
          default = [ ];
          type = lib.types.listOf lib.types.str;
          description = ''
            External records like: agentjones      A       193.1.99.72
          '';
        };

        cname = lib.mkOption {
          default = [ ];
          type = lib.types.listOf lib.types.str;
          description = ''
            External records like: ns1             CNAME   ns1
          '';
        };
      };


      records = {
        external = lib.mkOption {
          default = [ ];
          type = lib.types.listOf lib.types.str;
          description = ''
            External records like: agentjones      A       193.1.99.72
          '';
        };

        cname = lib.mkOption {
          default = [ ];
          type = lib.types.listOf lib.types.str;
          description = ''
            External records like: ns1             CNAME   ns1
          '';
        };
      };

    };
  };

  config = lib.mkIf cfg.enable {
    # secrets required
    age.secrets.dns_dnskeys = {
      file = ../secrets/dns_dnskeys.conf.age;
      owner = "named";
      group = "named";
    };

    networking.firewall = {
      allowedTCPPorts = [53];
      allowedUDPPorts = [53];
    };

    services.bind = {
      enable = true;

      ipv4Only = true;

      # need to take a look at https://nixos.org/manual/nixos/unstable/#module-security-acme-config-dns
      extraConfig = ''
        include "/run/agenix/dns_dnskeys";
      '';

      # piles of no valid RRSIG resolving 'com/DS/IN' errors
      #extraOptions = ''
      #  dnssec-validation auto;
      #'';

      # set the upstream dns servers
      # overrides the default dns servers
      forwarders = [
        # Cloudflare
        "1.1.1.1"
        # Google
        "8.8.8.8"
        # Quad9
        "9.9.9.9"
      ];

      cacheNetworks  = [
        # this server itself
        "127.0.0.0/24"
        # all of skynet can use this as a resolver
        "193.1.99.64/26"
      ];

      zones = {
        /*
        put any other zones above skynet and link to their files like so:

          example.ie = {
            extraConfig = "";
            file = ./dns/example;
            master = true;
            masters = [];
            slaves = [ ];
          };

        Skynet is handled a bit more dynamically since it is the key one we should focus on
        */

        "skynet.ie" = {
          extraConfig = "allow-update { key rfc2136key.skynet.ie.; };";
          # really wish teh nixos config didnt use master/slave
          master = true;
          slaves = [ ];
          # need to write this to a file
          file = "/etc/dns_custom/dns_zone_skynet";
          # no leading whitespace for first line

        };
      };
    };

    # creates a folder in /etc for the dns to use
    users.users.named = {
      createHome = true;
      home = "/etc/dns_custom";
    };

    environment.etc = {
      # Creates /etc/dns_custom/dns_zone_skynet

      "dns_custom/dns_zone_skynet" = {
        user = "named";
        group = "named";

        # The UNIX file mode bits
        mode = "0644";


        text =
          ''
          $TTL 60  ; 1 minute
          ; hostmaster@skynet.ie is an email address that recieves stuff related to dns
          @ IN SOA ${cfg.own.nameserver}.skynet.ie. hostmaster.skynet.ie. (
             ; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated
             ${current_date}
             600        ; Refresh (10 minutes)
             300        ; Retry   (5 minutes)
             604800     ; Expire  (1 week)
             3600       ; Minimum (1 hour)
            )
            NS  ns1.skynet.ie.
            NS  ns2.skynet.ie.
            ; @ stands for teh root domain so teh A record below is where skynet.ie points to
            A   193.1.99.76
            MX  5 mail.skynet.ie.

          ; can have multiple mailserves
          ;MX  20 mail2.skynet.ie.


          ; ------------------------------------------
          ; Server Names
          ; ------------------------------------------

          ; External addresses
          ; ------------------------------------------
          ${lib.strings.concatMapStrings (x: x + "\n") cfg.records.external}


          ; this is fixed for now
          wintermute      A       193.1.101.148


          ; internal addresses
          ; ------------------------------------------
          ; May come back to this idea in teh future
          ; agentjones.int  A       172.20.20.1


          ; cname's
          ; ------------------------------------------
          ${lib.strings.concatMapStrings (x: x + "\n") cfg.records.cname}

          '';
      };
    };
  };
}