nixos: Move colony VMs into subdirectory

2022-05-28 23:05:30 +01:00
parent e6e4a1d38e
commit 38e8827487
6 changed files with 72 additions and 67 deletions
--- a/nixos/boxes/colony/vms/estuary/dns.nix
+++ b/nixos/boxes/colony/vms/estuary/dns.nix
@@ -0,0 +1,135 @@
+{ lib, pkgs, config, assignments, allAssignments, ... }:
+let
+  inherit (builtins) attrNames;
+  inherit (lib) concatStringsSep concatMapStringsSep mapAttrsToList filterAttrs genAttrs optional;
+
+  ptrDots = 2;
+  reverseZone = "100.10.in-addr.arpa";
+  ptrDots6 = 17;
+  reverseZone6 = "b.b.b.0.d.4.0.0.c.7.9.e.0.a.2.ip6.arpa";
+
+  authZones = attrNames config.my.pdns.auth.bind.zones;
+in
+{
+  config = {
+    services.pdns-recursor = {
+      enable = true;
+      dns = {
+        address = [
+          "127.0.0.1" "::1"
+          assignments.internal.ipv4.address assignments.internal.ipv6.address
+        ];
+        allowFrom = [
+          "127.0.0.0/8" "::1/128"
+          "10.100.0.0/16" "2a0e:97c0:4d1::/48"
+          # TODO: Remove when moving to proper net!
+          "2a0e:97c0:4d0::/48"
+        ];
+      };
+      forwardZones = genAttrs authZones (_: "127.0.0.1:5353");
+
+      settings = {
+        query-local-address = [ "0.0.0.0" "::" ];
+
+        # DNS NOTIFY messages override TTL
+        allow-notify-for = authZones;
+        allow-notify-from = [ "127.0.0.0/8" "::1/128" ];
+      };
+    };
+    # For rec_control
+    environment.systemPackages = with pkgs; [
+      pdns-recursor
+    ];
+
+    my.pdns.auth = {
+      enable = true;
+      settings = {
+        primary = true;
+        resolver = "127.0.0.1";
+        expand-alias = true;
+        local-address = [
+          "0.0.0.0:5353" "[::]:5353"
+        ];
+        also-notify = [ "127.0.0.1" ];
+      };
+
+      bind.zones =
+      let
+        genRecords = f:
+          concatStringsSep
+            "\n"
+            (mapAttrsToList
+              (_: as: f as.internal)
+              (filterAttrs (_: as: as ? "internal" && as.internal.visible) allAssignments));
+
+        intRecords =
+          genRecords (a: ''
+            ${a.name} IN A ${a.ipv4.address}
+            ${a.name} IN AAAA ${a.ipv6.address}
+            ${concatMapStringsSep "\n" (alt: "${alt} IN CNAME ${a.name}") a.altNames}
+          '');
+        intPtrRecords =
+          genRecords (a: ''@@PTR:${a.ipv4.address}:${toString ptrDots}@@ IN PTR ${a.name}.${config.networking.domain}.'');
+        intPtr6Records =
+          genRecords (a: ''@@PTR:${a.ipv6.address}:${toString ptrDots6}@@ IN PTR ${a.name}.${config.networking.domain}.'');
+      in
+      {
+        "${config.networking.domain}" = {
+          type = "master";
+          text = ''
+            $TTL 60
+            @ IN SOA ns.${config.networking.domain}. dev.nul.ie. (
+                @@SERIAL@@ ; serial
+                3h ; refresh
+                1h ; retry
+                1w ; expire
+                1h ; minimum
+              )
+
+            @ IN NS ns
+            ns IN A 188.141.14.6
+            ns IN AAAA 2a0e:97c0:4d0:bbbf::1
+
+            @ IN ALIAS ${config.networking.fqdn}.
+
+            ${intRecords}
+          '';
+        };
+        "${reverseZone}" = {
+          type = "master";
+          text = ''
+            $TTL 60
+            @ IN SOA ns.${config.networking.domain}. dev.nul.ie (
+                @@SERIAL@@ ; serial
+                3h ; refresh
+                1h ; retry
+                1w ; expire
+                1h ; minimum
+              )
+
+            @ IN NS ns.${config.networking.domain}.
+
+            ${intPtrRecords}
+          '';
+        };
+        "${reverseZone6}" = {
+          type = "master";
+          text = ''
+            $TTL 60
+            @ IN SOA ns.${config.networking.domain}. dev.nul.ie (
+                @@SERIAL@@ ; serial
+                3h ; refresh
+                1h ; retry
+                1w ; expire
+                1h ; minimum
+              )
+
+            @ IN NS ns.${config.networking.domain}.
+
+            ${intPtr6Records}
+          '';
+        };
+      };
+    };
+  };
+}