blob: d49e4643d91485e739875292717d118158203717 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
{
config,
lib,
...
}:
with lib; let
inherit (config.networking) domain;
cfg = config.local.ns.server;
acmeChallengeDomain = "acme-challenge.${domain}";
in {
options. local. ns. server = {
enable = mkEnableOption "nsd authoritative server";
tsigName = mkOption {
type = types.str;
default = "NOKEY";
};
acme = {
apiListen.v6 = mkOption {
type = types.str;
};
dnsListen.v6 = mkOption {
type = types.str;
};
};
};
config = mkIf cfg.enable {
assertions = [
{
assertion = cfg.tsigName == "NOKEY" || config.services.nsd.keys ? "${cfg.tsigName}";
message = "TSIG key '${cfg.tsigName}' not defined";
}
];
networking.firewall = let
inherit (config.services.nsd) port;
in {
allowedTCPPorts = [port];
allowedUDPPorts = [port];
};
services = {
acme-dns = {
enable = true;
settings = {
api = {
ip = "[${cfg.acme.apiListen.v6}]";
port = 80;
};
general = {
domain = acmeChallengeDomain;
nsname = acmeChallengeDomain;
nsadmin = "hostmaster.${domain}";
listen = "[${cfg.acme.dnsListen.v6}]:53";
records = [
"${acmeChallengeDomain}. NS ${acmeChallengeDomain}."
"${acmeChallengeDomain}. AAAA ${cfg.acme.dnsListen.v6}"
];
};
};
};
nsd = {
enable = true;
ipFreebind = true;
bind8Stats = true;
statistics = 3600;
tcpCount = 128;
tcpTimeout = 30;
tcpQueryCount = 128;
zones = mapAttrs' (name: zone: nameValuePair "${name}." zone.nsdConfig) config.local.ns.zones;
};
};
};
}
|
