nixos/estuary: Implement recursive DNS

lib.nix

@@ -97,6 +97,10 @@ rec {
       LLDP = true;
       EmitLLDP = "customer-bridge";
     };
+    ipv6AcceptRAConfig = {
+      UseDNS = true;
+      UseDomains = true;
+    };
   };
 
   deploy-rs =
@@ -147,6 +151,15 @@ rec {
     filterOpts = filterAttrsRecursive (_: v: v != null);
   };
 
+  colonyDomain = "fra1.int.nul.ie";
+  # Shouldn't need this hopefully (IPv6 RA)
+  colonyDNS = {
+    domains = [ colonyDomain ];
+    dns = [
+      "10.100.0.1"
+      "2a0e:97c0:4d1:0::1"
+    ];
+  };
   sshKeyFiles = {
     me = .keys/me.pub;
     deploy = .keys/deploy.pub;

nixos/modules/common.nix

@@ -77,6 +77,11 @@ in
       boot = {
         # Use latest LTS release by default
         kernelPackages = mkDefault pkgs.linuxKernel.packages.linux_5_15;
+        kernel = {
+          sysctl = {
+            "net.ipv6.route.max_size" = mkDefault 16384;
+          };
+        };
         loader = {
           efi = {
             efiSysMountPoint = mkDefault "/boot";

nixos/modules/network.nix

@@ -12,7 +12,13 @@ in
         useNetworkd = mkDefault true;
       };
 
-      services.resolved.domains = [ config.networking.domain ];
+      services.resolved = {
+        domains = [ config.networking.domain ];
+        # Explicitly unset fallback DNS (Nix module will not allow for a blank config)
+        extraConfig = ''
+          FallbackDNS=
+        '';
+      };
     }
 
     (mkIf config.my.build.isDevVM {

nixos/vms/estuary/default.nix

@@ -24,7 +24,7 @@
 
         config = mkMerge [
           {
-            networking.domain = "fra1.int.nul.ie";
+            networking.domain = lib.my.colonyDomain;
 
             boot.kernelParams = [ "console=ttyS0,115200n8" ];
             fileSystems = {
@@ -72,16 +72,25 @@
                 "80-wan" = {
                   matchConfig.Name = "wan";
                   DHCP = "ipv4";
+                  dhcpV4Config = {
+                    UseDNS = false;
+                    UseHostname = false;
+                  };
                 };
                 "80-base" = mkMerge [
                   (networkdAssignment "base" assignments.internal)
                   {
+                    dns = [ "127.0.0.1" "::1" ];
+                    domains = [ config.networking.domain ];
                     networkConfig = {
                       IPv6AcceptRA = mkForce false;
                       IPv6SendRA = true;
                       IPMasquerade = "both";
                     };
-                    ipv6SendRAConfig.DNS = [ assignments.internal.ipv6.address ];
+                    ipv6SendRAConfig = {
+                      DNS = [ assignments.internal.ipv6.address ];
+                      Domains = [ config.networking.domain ];
+                    };
                     ipv6Prefixes = [
                       {
                         ipv6PrefixConfig.Prefix = "2a0e:97c0:4d1:0::/64";

nixos/vms/estuary/dns.nix

@@ -1,18 +1,54 @@
-{ lib, config, allAssignments, ... }:
+{ lib, pkgs, config, assignments, allAssignments, ... }:
 let
-  inherit (lib) concatStringsSep concatMapStringsSep mapAttrsToList filterAttrs optional;
+  inherit (builtins) attrNames;
+  inherit (lib) concatStringsSep concatMapStringsSep mapAttrsToList filterAttrs genAttrs optional;
+
+  ptrDots = 2;
+  reverseZone = "100.10.in-addr.arpa";
+  ptrDots6 = 20;
+  reverseZone6 = "1.d.4.0.0.c.7.9.e.0.a.2.ip6.arpa";
+
+  authZones = attrNames config.my.pdns.auth.bind.zones;
 in
 {
   config = {
-    networking.domain = "fra1.int.nul.ie";
+    services.pdns-recursor = {
+      enable = true;
+      dns = {
+        address = [
+          "127.0.0.1" "::1"
+          assignments.internal.ipv4.address assignments.internal.ipv6.address
+        ];
+        allowFrom = [
+          "127.0.0.0/8" "::1/128"
+          "10.100.0.0/16" "2a0e:97c0:4d1::/48"
+        ];
+      };
+      forwardZones = genAttrs authZones (_: "127.0.0.1:5353");
+
+      settings = {
+        query-local-address = [ "0.0.0.0" "::" ];
+
+        # DNS NOTIFY messages override TTL
+        allow-notify-for = authZones;
+        allow-notify-from = [ "127.0.0.0/8" "::1/128" ];
+      };
+    };
+    # For rec_control
+    environment.systemPackages = with pkgs; [
+      pdns-recursor
+    ];
+
     my.pdns.auth = {
       enable = true;
       settings = {
         primary = true;
+        resolver = "127.0.0.1";
         expand-alias = true;
         local-address = [
           "127.0.0.1:5353" "[::]:5353"
         ] ++ (optional (!config.my.build.isDevVM) "192.168.122.126");
+        also-notify = [ "127.0.0.1" ];
       };
 
       bind.zones =
@@ -31,16 +67,16 @@ in
             ${concatMapStringsSep "\n" (alt: "${alt} IN CNAME ${a.name}") a.altNames}
           '');
         intPtrRecords =
-          genRecords (a: ''@@PTR:${a.ipv4.address}:2@@ IN PTR ${a.name}.${config.networking.domain}.'');
+          genRecords (a: ''@@PTR:${a.ipv4.address}:${toString ptrDots}@@ IN PTR ${a.name}.${config.networking.domain}.'');
         intPtr6Records =
-          genRecords (a: ''@@PTR:${a.ipv6.address}:20@@ IN PTR ${a.name}.${config.networking.domain}.'');
+          genRecords (a: ''@@PTR:${a.ipv6.address}:${toString ptrDots6}@@ IN PTR ${a.name}.${config.networking.domain}.'');
       in
       {
         "${config.networking.domain}" = {
           type = "master";
           text = ''
             $TTL 60
-            @ IN SOA ns.${config.networking.domain}. hostmaster.${config.networking.domain}. (
+            @ IN SOA ns.${config.networking.domain}. dev.nul.ie. (
                 @@SERIAL@@ ; serial
                 3h ; refresh
                 1h ; retry
@@ -48,16 +84,19 @@ in
                 1h ; minimum
               )
 
+            @ IN NS ns
+            ns IN ALIAS ${config.networking.fqdn}.
+
             @ IN ALIAS ${config.networking.fqdn}.
 
             ${intRecords}
           '';
         };
-        "100.10.in-addr.arpa" = {
+        "${reverseZone}" = {
           type = "master";
           text = ''
             $TTL 60
-            @ IN SOA ns.${config.networking.domain}. hostmaster.${config.networking.domain}. (
+            @ IN SOA ns.${config.networking.domain}. dev.nul.ie (
                 @@SERIAL@@ ; serial
                 3h ; refresh
                 1h ; retry
@@ -65,14 +104,16 @@ in
                 1h ; minimum
               )
 
+            @ IN NS ns.${config.networking.domain}.
+
             ${intPtrRecords}
           '';
         };
-        "1.d.4.0.0.c.7.9.e.0.a.2.ip6.arpa" = {
+        "${reverseZone6}" = {
           type = "master";
           text = ''
             $TTL 60
-            @ IN SOA ns.${config.networking.domain}. hostmaster.${config.networking.domain}. (
+            @ IN SOA ns.${config.networking.domain}. dev.nul.ie (
                 @@SERIAL@@ ; serial
                 3h ; refresh
                 1h ; retry
@@ -80,6 +121,8 @@ in
                 1h ; minimum
               )
 
+            @ IN NS ns.${config.networking.domain}.
+
             ${intPtr6Records}
           '';
         };