nixos/pdns: Move file records into module

nixos/boxes/colony/vms/estuary/dns.nix

@@ -2,7 +2,7 @@
 let
   inherit (builtins) attrNames stringLength genList filter;
   inherit (lib)
-    concatStrings concatStringsSep concatMapStringsSep mapAttrsToList filterAttrs genAttrs optional optionalString;
+    concatStrings concatStringsSep concatMapStringsSep mapAttrsToList filterAttrs genAttrs optionalString;
 
   ptrDots = 2;
   reverseZone = "100.10.in-addr.arpa";
@@ -10,102 +10,9 @@ let
   reverseZone6 = "b.b.b.0.d.4.0.0.c.7.9.e.0.a.2.ip6.arpa";
 
   authZones = attrNames config.my.pdns.auth.bind.zones;
-
-  pdns-file-record = pkgs.writeShellApplication {
-    name = "pdns-file-record";
-    runtimeInputs = with pkgs; [ gnused moreutils pdns ];
-    text = ''
-      die() {
-        echo "$@" >&2
-        exit 1
-      }
-      usage() {
-        die "usage: $0 <zone> <add|del> <fqdn> [content]"
-      }
-
-      add() {
-        if [ $# -ne 2 ]; then
-          usage
-        fi
-
-        echo "$2" >> "$dir"/"$1"txt
-      }
-      del() {
-        if [ $# -lt 1 ]; then
-          usage
-        fi
-
-        file="$dir"/"$1"txt
-        if [ $# -eq 1 ]; then
-          rm "$file"
-        else
-          sed -i "/^""$2""$/!{q1}; /^""$2""$/d" "$file"
-          exit $?
-        fi
-      }
-
-      dir=/run/pdns/file-records
-      mkdir -p "$dir"
-
-      if [ $# -lt 2 ]; then
-        usage
-      fi
-      zone="$1"
-      shift
-      cmd="$1"
-      shift
-
-      case "$cmd" in
-      add)
-        add "$@";;
-      del)
-        del "$@";;
-      *)
-        usage;;
-      esac
-
-      # TODO: This feels pretty hacky?
-      zDat=/var/lib/pdns/bind-zones/"$zone".dat
-      # shellcheck disable=SC1090
-      source "$zDat"
-      ((serial++))
-      # Use sponge instead of `sed -i` because that actually uses a temporary file and clobbers ownership...
-      sed "s/^serial=.*$/serial=$serial/g" "$zDat" | sponge "$zDat"
-      sed "s/@@SERIAL@@/$serial/g" < /etc/pdns/bind-zones/"$zone".zone > /run/pdns/bind-zones/"$zone".zone
-      pdns_control bind-reload-now "$zone"
-    '';
-  };
 in
 {
   config = {
-    users = {
-      users = {
-        "pdns-file-records" =
-        let
-          script = pkgs.writeShellScript "pdns-file-records-ssh.sh" ''
-            read -r -a args <<< "$SSH_ORIGINAL_COMMAND"
-            exec ${pdns-file-record}/bin/pdns-file-record "''${args[@]}"
-          '';
-        in
-        {
-          group = "pdns";
-          isSystemUser = true;
-          shell = pkgs.bashInteractive;
-          openssh.authorizedKeys.keys = [
-            ''command="${script}" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBSvcgbEesOgvKJLt3FLXPaLOcCIuOUYtZXXtEv6k4Yd''
-          ];
-        };
-      };
-    };
-
-    systemd = {
-      services = {
-        pdns.preStart = ''
-          install -d -m 775 /run/pdns/file-records
-        '';
-      };
-    };
-
     services.pdns-recursor = {
       enable = true;
       dns = {
@@ -131,7 +38,6 @@ in
     # For rec_control
     environment.systemPackages = with pkgs; [
       pdns-recursor
-      pdns-file-record
     ];
 
     my.pdns.auth = {
@@ -150,6 +56,10 @@ in
         #log-dns-details = true;
       };
 
+      bind = {
+        file-records.sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBSvcgbEesOgvKJLt3FLXPaLOcCIuOUYtZXXtEv6k4Yd";
+      };
+
       bind.zones =
       let
         genRecords = f:
@@ -203,20 +113,6 @@ in
         wildcardPtr6' = n: root: ''*.${wildcardPtr6Zeroes n}${root} ${wildcardPtr6Def}'';
         wildcardPtr6 = n: root: concatStringsSep "\n" (genList (i: wildcardPtr6' i root) (n - 1));
         wildcardPtr6Z = wildcardPtr6 ptrDots6;
-
-        fileRecScript = pkgs.writeText "file-record.lua" ''
-          local path = "/run/pdns/file-records/" .. string.lower(qname:toStringNoDot()) .. ".txt"
-          if not os.execute("test -e " .. path) then
-            return {}
-          end
-
-          local values = {}
-          for line in io.lines(path) do
-            table.insert(values, line)
-          end
-          return values
-        '';
-        fileRecVal = ''"dofile('${fileRecScript}')"'';
       in
       {
         "${config.networking.domain}" = {
@@ -239,7 +135,7 @@ in
             http IN AAAA ${allAssignments.middleman.internal.ipv6.address}
 
             $TTL 3
-            _acme-challenge IN LUA TXT ${fileRecVal}
+            _acme-challenge IN LUA TXT @@FILE@@
 
             $TTL 60
             ${intRecords}