nixos/applications/dns.nix

207 lines
No EOL
5.3 KiB
Nix

{ lib, pkgs, config, ... }:
let
cfg = config.skynet_dns;
# writes current date to a file
current_date_path = pkgs.runCommand "current_date" {} "date '+%Y%m%d%S' > $out";
# reads that date to a string
current_date = (lib.readFile current_date_path);
in {
options = {
skynet_dns = {
enable = lib.mkEnableOption {
default = false;
example = true;
description = "Skynet DNS";
type = lib.types.bool;
};
own = {
nameserver = lib.mkOption {
default = "ns1";
type = lib.types.str;
description = ''
the hostname of this nameserver, eg ns1, ns2
'';
};
external = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
External records like: agentjones A 193.1.99.72
'';
};
cname = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
External records like: ns1 CNAME ns1
'';
};
};
records = {
external = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
External records like: agentjones A 193.1.99.72
'';
};
cname = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
External records like: ns1 CNAME ns1
'';
};
};
};
};
config = lib.mkIf cfg.enable {
# secrets required
age.secrets.dns_dnskeys = {
file = ../secrets/dns_dnskeys.conf.age;
owner = "named";
group = "named";
};
networking.firewall = {
allowedTCPPorts = [53];
allowedUDPPorts = [53];
};
services.bind = {
enable = true;
ipv4Only = true;
# need to take a look at https://nixos.org/manual/nixos/unstable/#module-security-acme-config-dns
extraConfig = ''
include "/run/agenix/dns_dnskeys";
'';
# piles of no valid RRSIG resolving 'com/DS/IN' errors
#extraOptions = ''
# dnssec-validation auto;
#'';
# set the upstream dns servers
# overrides the default dns servers
forwarders = [
# Cloudflare
"1.1.1.1"
# Google
"8.8.8.8"
# Quad9
"9.9.9.9"
];
cacheNetworks = [
# this server itself
"127.0.0.0/24"
# all of skynet can use this as a resolver
"193.1.99.64/26"
];
zones = {
/*
put any other zones above skynet and link to their files like so:
example.ie = {
extraConfig = "";
file = ./dns/example;
master = true;
masters = [];
slaves = [ ];
};
Skynet is handled a bit more dynamically since it is the key one we should focus on
*/
"skynet.ie" = {
extraConfig = "allow-update { key rfc2136key.skynet.ie.; };";
# really wish teh nixos config didnt use master/slave
master = true;
slaves = [ ];
# need to write this to a file
file = "/etc/dns_custom/dns_zone_skynet";
# no leading whitespace for first line
};
};
};
# creates a folder in /etc for the dns to use
users.users.named = {
createHome = true;
home = "/etc/dns_custom";
};
environment.etc = {
# Creates /etc/dns_custom/dns_zone_skynet
"dns_custom/dns_zone_skynet" = {
user = "named";
group = "named";
# The UNIX file mode bits
mode = "0644";
text =
''
$TTL 60 ; 1 minute
; hostmaster@skynet.ie is an email address that recieves stuff related to dns
@ IN SOA ${cfg.own.nameserver}.skynet.ie. hostmaster.skynet.ie. (
; Serial (YYYYMMDDCC) this has to be updated for each time the record is updated
${current_date}
600 ; Refresh (10 minutes)
300 ; Retry (5 minutes)
604800 ; Expire (1 week)
3600 ; Minimum (1 hour)
)
NS ns1.skynet.ie.
NS ns2.skynet.ie.
; @ stands for teh root domain so teh A record below is where skynet.ie points to
A 193.1.99.76
MX 5 mail.skynet.ie.
; can have multiple mailserves
;MX 20 mail2.skynet.ie.
; ------------------------------------------
; Server Names
; ------------------------------------------
; External addresses
; ------------------------------------------
${lib.strings.concatMapStrings (x: x + "\n") cfg.records.external}
; this is fixed for now
wintermute A 193.1.101.148
; internal addresses
; ------------------------------------------
; May come back to this idea in teh future
; agentjones.int A 172.20.20.1
; cname's
; ------------------------------------------
${lib.strings.concatMapStrings (x: x + "\n") cfg.records.cname}
'';
};
};
};
}