dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

nixos/estuary: Implement recursive DNS

Browse Source
This commit is contained in:
Jack O'Sullivan 2022-05-23 00:57:25 +01:00
parent 1789d11927
commit 98fbbbd1e2
5 changed files with 89 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
lib.nix
View File

@ -97,6 +97,10 @@ rec {
LLDP = true;
EmitLLDP = "customer-bridge";
};
ipv6AcceptRAConfig = {
UseDNS = true;
UseDomains = true;
};
};
deploy-rs =
@ -147,6 +151,15 @@ rec {
filterOpts = filterAttrsRecursive (_: v: v != null);
};
colonyDomain = "fra1.int.nul.ie";
# Shouldn't need this hopefully (IPv6 RA)
colonyDNS = {
domains = [ colonyDomain ];
dns = [
"10.100.0.1"
"2a0e:97c0:4d1:0::1"
];
};
sshKeyFiles = {
me = .keys/me.pub;
deploy = .keys/deploy.pub;

5
nixos/modules/common.nix
View File

@ -77,6 +77,11 @@ in
boot = {
# Use latest LTS release by default
kernelPackages = mkDefault pkgs.linuxKernel.packages.linux_5_15;
kernel = {
sysctl = {
"net.ipv6.route.max_size" = mkDefault 16384;
};
};
loader = {
efi = {
efiSysMountPoint = mkDefault "/boot";

8
nixos/modules/network.nix
View File

@ -12,7 +12,13 @@ in
useNetworkd = mkDefault true;
};
services.resolved.domains = [ config.networking.domain ];
services.resolved = {
domains = [ config.networking.domain ];
# Explicitly unset fallback DNS (Nix module will not allow for a blank config)
extraConfig = ''
FallbackDNS=
'';
};
}
(mkIf config.my.build.isDevVM {

13
nixos/vms/estuary/default.nix
View File

@ -24,7 +24,7 @@
config = mkMerge [
{
networking.domain = "fra1.int.nul.ie";
networking.domain = lib.my.colonyDomain;
boot.kernelParams = [ "console=ttyS0,115200n8" ];
fileSystems = {
@ -72,16 +72,25 @@
"80-wan" = {
matchConfig.Name = "wan";
DHCP = "ipv4";
dhcpV4Config = {
UseDNS = false;
UseHostname = false;
};
};
"80-base" = mkMerge [
(networkdAssignment "base" assignments.internal)
{
dns = [ "127.0.0.1" "::1" ];
domains = [ config.networking.domain ];
networkConfig = {
IPv6AcceptRA = mkForce false;
IPv6SendRA = true;
IPMasquerade = "both";
};
ipv6SendRAConfig.DNS = [ assignments.internal.ipv6.address ];
ipv6SendRAConfig = {
DNS = [ assignments.internal.ipv6.address ];
Domains = [ config.networking.domain ];
};
ipv6Prefixes = [
{
ipv6PrefixConfig.Prefix = "2a0e:97c0:4d1:0::/64";

63
nixos/vms/estuary/dns.nix
View File

@ -1,18 +1,54 @@
{ lib, config, allAssignments, ... }:
{ lib, pkgs, config, assignments, allAssignments, ... }:
let
inherit (lib) concatStringsSep concatMapStringsSep mapAttrsToList filterAttrs optional;
inherit (builtins) attrNames;
inherit (lib) concatStringsSep concatMapStringsSep mapAttrsToList filterAttrs genAttrs optional;
ptrDots = 2;
reverseZone = "100.10.in-addr.arpa";
ptrDots6 = 20;
reverseZone6 = "1.d.4.0.0.c.7.9.e.0.a.2.ip6.arpa";
authZones = attrNames config.my.pdns.auth.bind.zones;
in
{
config = {
networking.domain = "fra1.int.nul.ie";
services.pdns-recursor = {
enable = true;
dns = {
address = [
"127.0.0.1" "::1"
assignments.internal.ipv4.address assignments.internal.ipv6.address
];
allowFrom = [
"127.0.0.0/8" "::1/128"
"10.100.0.0/16" "2a0e:97c0:4d1::/48"
];
};
forwardZones = genAttrs authZones (_: "127.0.0.1:5353");
settings = {
query-local-address = [ "0.0.0.0" "::" ];
# DNS NOTIFY messages override TTL
allow-notify-for = authZones;
allow-notify-from = [ "127.0.0.0/8" "::1/128" ];
};
};
# For rec_control
environment.systemPackages = with pkgs; [
pdns-recursor
];
my.pdns.auth = {
enable = true;
settings = {
primary = true;
resolver = "127.0.0.1";
expand-alias = true;
local-address = [
"127.0.0.1:5353" "[::]:5353"
] ++ (optional (!config.my.build.isDevVM) "192.168.122.126");
also-notify = [ "127.0.0.1" ];
};
bind.zones =
@ -31,16 +67,16 @@ in
${concatMapStringsSep "\n" (alt: "${alt} IN CNAME ${a.name}") a.altNames}
'');
intPtrRecords =
genRecords (a: ''@@PTR:${a.ipv4.address}:2@@ IN PTR ${a.name}.${config.networking.domain}.'');
genRecords (a: ''@@PTR:${a.ipv4.address}:${toString ptrDots}@@ IN PTR ${a.name}.${config.networking.domain}.'');
intPtr6Records =
genRecords (a: ''@@PTR:${a.ipv6.address}:20@@ IN PTR ${a.name}.${config.networking.domain}.'');
genRecords (a: ''@@PTR:${a.ipv6.address}:${toString ptrDots6}@@ IN PTR ${a.name}.${config.networking.domain}.'');
in
{
"${config.networking.domain}" = {
type = "master";
text = ''
$TTL 60
@ IN SOA ns.${config.networking.domain}. hostmaster.${config.networking.domain}. (
@ IN SOA ns.${config.networking.domain}. dev.nul.ie. (
@@SERIAL@@ ; serial
3h ; refresh
1h ; retry
@ -48,16 +84,19 @@ in
1h ; minimum
)
@ IN NS ns
ns IN ALIAS ${config.networking.fqdn}.
@ IN ALIAS ${config.networking.fqdn}.
${intRecords}
'';
};
"100.10.in-addr.arpa" = {
"${reverseZone}" = {
type = "master";
text = ''
$TTL 60
@ IN SOA ns.${config.networking.domain}. hostmaster.${config.networking.domain}. (
@ IN SOA ns.${config.networking.domain}. dev.nul.ie (
@@SERIAL@@ ; serial
3h ; refresh
1h ; retry
@ -65,14 +104,16 @@ in
1h ; minimum
)
@ IN NS ns.${config.networking.domain}.
${intPtrRecords}
'';
};
"1.d.4.0.0.c.7.9.e.0.a.2.ip6.arpa" = {
"${reverseZone6}" = {
type = "master";
text = ''
$TTL 60
@ IN SOA ns.${config.networking.domain}. hostmaster.${config.networking.domain}. (
@ IN SOA ns.${config.networking.domain}. dev.nul.ie (
@@SERIAL@@ ; serial
3h ; refresh
1h ; retry
@ -80,6 +121,8 @@ in
1h ; minimum
)
@ IN NS ns.${config.networking.domain}.
${intPtr6Records}
'';
};