rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-04-25 16:08:30 +02:00
Code Issues Projects Releases Packages Wiki Activity

ns: redo dnssec policy

Browse source
This commit is contained in:
Rouven Seifert 2024-03-11 12:40:23 +01:00
parent cb49b95c53
commit ba3929c399
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
2 changed files with 16 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
hosts/falkenstein/modules/dns/default.nix
View file

@ -6,7 +6,7 @@ let
$ORIGIN rfive.de.
rfive.de. 86400 IN SOA ns.rfive.de. hostmaster.rfive.de. (
2024031013 ; serial
2024031014 ; serial
10800 ; refresh
3600 ; retry
604800 ; expire
@ -59,6 +59,16 @@ in
services.bind = rec {
enable = true;
directory = "/var/lib/bind";
extraConfig = ''
dnssec-policy "split-keys" {
keys {
ksk lifetime unlimited algorithm ecdsap256sha256;
zsk lifetime 60d algorithm ecdsap256sha256;
};
publish-safety 1d;
retire-safety 1d;
};
'';
zones = {
"rfive.de" = {
master = true;
@ -67,7 +77,7 @@ in
];
extraConfig = ''
also-notify {${secondary};};
dnssec-policy default;
dnssec-policy split-keys;
inline-signing yes;
serial-update-method date;
'';
@ -83,4 +93,5 @@ in
ip saddr ${secondary}/32 tcp dport 53 accept comment "Allow DNS AXFR access from INWX Servers"
ip saddr ${secondary}/32 udp dport 53 accept comment "Allow DNS access from INWX Servers"
'';
environment.systemPackages = with pkgs; [ dig.out ];
}