rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2024-11-15 05:13:10 +01:00
Code Issues Packages Projects Releases Wiki Activity

ns: redo dnssec policy

Browse source
This commit is contained in:
Rouven Seifert 2024-03-11 12:40:23 +01:00
parent cb49b95c53
commit ba3929c399
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
2 changed files with 16 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
flake.lock
View file

@ -281,11 +281,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1710040110, "lastModified": 1710120787,
"narHash": "sha256-PNAV8VdZkNoSGQHGQWDefNarl0BtKjVMCCzu16+vsr4=", "narHash": "sha256-tlLuB73OCOKtU2j83bQzSYFyzjJo3rjpITZE5MoofG8=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nix-index-database", "repo": "nix-index-database",
"rev": "851fcfd130597c5c91071d46275111522d4fd595", "rev": "e76ff2df6bfd2abe06abd8e7b9f217df941c1b07",
"type": "github" "type": "github"
}, },
"original": { "original": {

15
hosts/falkenstein/modules/dns/default.nix
View file

@ -6,7 +6,7 @@ let
$ORIGIN rfive.de. $ORIGIN rfive.de.
rfive.de. 86400 IN SOA ns.rfive.de. hostmaster.rfive.de. ( rfive.de. 86400 IN SOA ns.rfive.de. hostmaster.rfive.de. (
2024031013 ; serial 2024031014 ; serial
10800 ; refresh 10800 ; refresh
3600 ; retry 3600 ; retry
604800 ; expire 604800 ; expire
@ -59,6 +59,16 @@ in
services.bind = rec { services.bind = rec {
enable = true; enable = true;
directory = "/var/lib/bind"; directory = "/var/lib/bind";
extraConfig = ''
dnssec-policy "split-keys" {
keys {
ksk lifetime unlimited algorithm ecdsap256sha256;
zsk lifetime 60d algorithm ecdsap256sha256;
};
publish-safety 1d;
retire-safety 1d;
};
'';
zones = { zones = {
"rfive.de" = { "rfive.de" = {
master = true; master = true;
@ -67,7 +77,7 @@ in
]; ];
extraConfig = '' extraConfig = ''
also-notify {${secondary};}; also-notify {${secondary};};
dnssec-policy default; dnssec-policy split-keys;
inline-signing yes; inline-signing yes;
serial-update-method date; serial-update-method date;
''; '';
@ -83,4 +93,5 @@ in
ip saddr ${secondary}/32 tcp dport 53 accept comment "Allow DNS AXFR access from INWX Servers" ip saddr ${secondary}/32 tcp dport 53 accept comment "Allow DNS AXFR access from INWX Servers"
ip saddr ${secondary}/32 udp dport 53 accept comment "Allow DNS access from INWX Servers" ip saddr ${secondary}/32 udp dport 53 accept comment "Allow DNS access from INWX Servers"
''; '';
environment.systemPackages = with pkgs; [ dig.out ];
} }