rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-04-24 23:56:20 +02:00
Code Issues Projects Releases Packages Wiki Activity

falkenstein: enable dnssec

Browse source
This commit is contained in:
Rouven Seifert 2024-03-09 23:22:02 +01:00
parent be70c4119a
commit 9f0712d2ca
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
1 changed files with 60 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
hosts/falkenstein/modules/dns/default.nix
View file

@ -1,21 +1,10 @@
{ pkgs, ... }:
{
services.bind = {
enable = true;
zones = {
"rfive.de" = {
master = true;
slaves = [
"185.181.104.96"
];
extraConfig = ''
also-notify {185.181.104.96;};
'';
file = pkgs.writeText "rfive.de_zone.txt" ''
{ pkgs, config, ... }:
let
zonefile = pkgs.writeText "rfive.de.zone.txt" ''
$TTL 3600
$ORIGIN rfive.de.
rfive.de. 86400 IN SOA ns.rfive.de. hostmaster.rfive.de. 2024030836 10800 3600 604800 3600
rfive.de. 86400 IN SOA ns.rfive.de. hostmaster.rfive.de. 2024030838 10800 3600 604800 3600
@ NS ns0.rfive.de.
@ NS ns.inwx.de.
@ NS ns2.inwx.de.
@ -59,9 +48,30 @@
trucks CNAME falkenstein.rfive.de.
vault CNAME nuc.rfive.de.
'';
in
{
services.bind = rec {
enable = true;
directory = "/var/lib/bind";
zones = {
"rfive.de" = {
master = true;
slaves = [
"185.181.104.96"
];
extraConfig = ''
also-notify {185.181.104.96;};
dnssec-policy default;
inline-signing yes;
'';
file = "${directory}/rfive.de.zone.txt";
};
};
};
systemd.services.bind.preStart = ''
# copy the file manually to its destination since signing requires a writable directory
${pkgs.coreutils}/bin/cp ${zonefile} ${config.services.bind.directory}/rfive.de.zone.txt
'';
networking.firewall.allowedUDPPorts = [ 53 ];
networking.firewall.allowedTCPPorts = [ 53 ];
}