rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-05-13 07:41:08 +02:00
Code Issues Projects Releases Packages Wiki Activity

dns fuckery

Browse source
This commit is contained in:
Rouven Seifert 2025-05-10 20:17:40 +02:00
parent 5f43998de8
commit f8eee37e51
12 changed files with 62 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

33
flake.lock generated
View file

@ -39,11 +39,11 @@
"uv2nix": "uv2nix" "uv2nix": "uv2nix"
}, },
"locked": { "locked": {
"lastModified": 1746770624, "lastModified": 1746874492,
"narHash": "sha256-40c1p1EiveXd8P4MsG21+M4x/0QOCGQJP0ISyx9L1QE=", "narHash": "sha256-Gm2Eb5KBxAL6y9WJj7phRMXNAZzVkKlm9Dky9WDZHtQ=",
"owner": "nix-community", "owner": "nix-community",
"repo": "authentik-nix", "repo": "authentik-nix",
"rev": "0b5a36483867e2473a40610d0dcb7cb06260a6cf", "rev": "2ef24fac993808a1a57f367ef58ac0f5254c3489",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -85,6 +85,26 @@
"type": "github" "type": "github"
} }
}, },
"caddy-patched": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1746901403,
"narHash": "sha256-2tkRHeNEkaE1x0ayfi30+nrIQv4Nio/NeT8U3i3qeQA=",
"owner": "rouven0",
"repo": "nixos-caddy-patched",
"rev": "ad2df7623e62ee4595c8f523b30cf6914a2cb6bd",
"type": "github"
},
"original": {
"owner": "rouven0",
"repo": "nixos-caddy-patched",
"type": "github"
}
},
"crane": { "crane": {
"locked": { "locked": {
"lastModified": 1731098351, "lastModified": 1731098351,
@ -279,11 +299,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1746798521, "lastModified": 1746892839,
"narHash": "sha256-axfz/jBEH9XHpS7YSumstV7b2PrPf7L8bhWUtLBv3nA=", "narHash": "sha256-0b9us0bIOgA1j/s/6zlxVyP3m97yAh0U+YwKayJ6mmU=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "e95a7c5b6fa93304cd2fd78cf676c4f6d23c422c", "rev": "12e67385964d9c9304daa81d0ad5ba3b01fdd35e",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -616,6 +636,7 @@
"inputs": { "inputs": {
"agenix": "agenix", "agenix": "agenix",
"authentik": "authentik", "authentik": "authentik",
"caddy-patched": "caddy-patched",
"dns": "dns", "dns": "dns",
"home-manager": "home-manager", "home-manager": "home-manager",
"impermanence": "impermanence", "impermanence": "impermanence",

5
flake.nix
View file

@ -47,6 +47,10 @@
url = "github:nix-community/lanzaboote/v0.4.2"; url = "github:nix-community/lanzaboote/v0.4.2";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
caddy-patched = {
url = "github:rouven0/nixos-caddy-patched";
inputs.nixpkgs.follows = "nixpkgs";
};
}; };
outputs = outputs =
@ -62,6 +66,7 @@
, purge , purge
, trucksimulatorbot , trucksimulatorbot
, pfersel , pfersel
, caddy-patched
, ... , ...
}@attrs: { }@attrs: {
packages.x86_64-linux = { packages.x86_64-linux = {

2
hosts/falkenstein/modules/caddy/default.nix
View file

@ -1,4 +1,4 @@
{ config, ... }: { config, caddy-patched, ... }:
let let
# matrix homeserver discovery # matrix homeserver discovery
matrix_domain = "matrix.${config.networking.domain}"; matrix_domain = "matrix.${config.networking.domain}";

19
hosts/falkenstein/modules/dns/default.nix
View file

@ -11,7 +11,8 @@ let
{ {
nameServer = "ns.rfive.de."; nameServer = "ns.rfive.de.";
adminEmail = "hostmaster@rfive.de"; adminEmail = "hostmaster@rfive.de";
serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864)); # serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864));
serial = 2025051079;
refresh = 10800; refresh = 10800;
retry = 3600; retry = 3600;
expire = 604800; expire = 604800;
@ -36,9 +37,14 @@ let
subdomains = subdomains =
let let
# fetches all VgetVirtualHosts from the caddy config
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts); getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts);
# generate CNAMES from caddy service to host
genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { CNAME = [ "${hostname}.${domain}." ]; }); genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { CNAME = [ "${hostname}.${domain}." ]; });
# generate ACME challenge recorsd for every VirtualHost
genACMECNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { subdomains._acme-challenge.CNAME = [ "challenge.acme.${domain}." ]; }); genACMECNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { subdomains._acme-challenge.CNAME = [ "challenge.acme.${domain}." ]; });
# fuckery to merge the generated attribute lists
mergeRecords = recordList: lib.attrsets.mapAttrs (_host: records: lib.attrsets.mergeAttrsList records) (lib.attrsets.zipAttrs recordList);
in in
lib.attrsets.mergeAttrsList [ lib.attrsets.mergeAttrsList [
rec { rec {
@ -58,9 +64,15 @@ let
_domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ]; _domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ];
"*".subdomains."_acme-challenge".CNAME = [ "challenge.acme.rfive.de" ]; "*".subdomains."_acme-challenge".CNAME = [ "challenge.acme.rfive.de" ];
} }
(mergeRecords [
(builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc")))) (builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ])) (builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ]))
(builtins.removeAttrs (genCNAMEs "falkenstein") [ "mail" ":2018" ]) ])
(mergeRecords [
(builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
(builtins.removeAttrs (genACMECNAMEs "falkenstein") ([ ":2018" "mail" ]))
])
(builtins.removeAttrs (genACMECNAMEs "fujitsu") ([ ":2018" ]))
]; ];
}); });
in in
@ -89,6 +101,9 @@ in
dnssec-policy split-keys; dnssec-policy split-keys;
inline-signing yes; inline-signing yes;
serial-update-method date; serial-update-method date;
update-policy {
grant caddy. name challenge.acme.rfive.de. txt;
};
''; '';
file = "${directory}/rfive.de.zone.txt"; file = "${directory}/rfive.de.zone.txt";
}; };

4
hosts/fujitsu/modules/jellyfin/default.nix
View file

@ -1,4 +1,4 @@
{ config, ... }: { ... }:
let let
domain = "media.vpn.rfive.de"; domain = "media.vpn.rfive.de";
in in
@ -6,7 +6,7 @@ in
services.jellyfin = { services.jellyfin = {
enable = true; enable = true;
}; };
services.caddy.virtualHosts."http://${domain}".extraConfig = '' services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:8096 reverse_proxy 127.0.0.1:8096
''; '';
} }

2
hosts/nuc/modules/adguard/default.nix
View file

@ -13,7 +13,7 @@ in
http.address = "127.0.0.1:${toString port}"; http.address = "127.0.0.1:${toString port}";
}; };
}; };
services.caddy.virtualHosts."http://${domain}".extraConfig = '' services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString port} reverse_proxy 127.0.0.1:${toString port}
''; '';
} }

2
hosts/nuc/modules/atuin/default.nix
View file

@ -6,7 +6,7 @@ in
services.atuin = { services.atuin = {
enable = true; enable = true;
}; };
services.caddy.virtualHosts."http://${domain}".extraConfig = '' services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.atuin.port} reverse_proxy 127.0.0.1:${toString config.services.atuin.port}
''; '';
} }

2
hosts/nuc/modules/indexing/prowlarr.nix
View file

@ -6,7 +6,7 @@ in
services.prowlarr = { services.prowlarr = {
enable = true; enable = true;
}; };
services.caddy.virtualHosts."http://${domain}".extraConfig = '' services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.prowlarr.settings.server.port} reverse_proxy 127.0.0.1:${toString config.services.prowlarr.settings.server.port}
''; '';
} }

2
hosts/nuc/modules/indexing/radarr.nix
View file

@ -6,7 +6,7 @@ in
services.radarr = { services.radarr = {
enable = true; enable = true;
}; };
services.caddy.virtualHosts."http://${domain}".extraConfig = '' services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.radarr.settings.server.port} reverse_proxy 127.0.0.1:${toString config.services.radarr.settings.server.port}
''; '';
} }

2
hosts/nuc/modules/indexing/sonarr.nix
View file

@ -6,7 +6,7 @@ in
services.sonarr = { services.sonarr = {
enable = true; enable = true;
}; };
services.caddy.virtualHosts."http://${domain}".extraConfig = '' services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.sonarr.settings.server.port} reverse_proxy 127.0.0.1:${toString config.services.sonarr.settings.server.port}
''; '';
} }

2
hosts/nuc/modules/torrent/default.nix
View file

@ -125,7 +125,7 @@ in
SystemCallFilter = "@system-service"; SystemCallFilter = "@system-service";
}; };
}; };
services.caddy.virtualHosts."http://${domain}".extraConfig = '' services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString cfg.port} reverse_proxy 127.0.0.1:${toString cfg.port}
''; '';
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [

3
shared/caddy/default.nix
View file

@ -1,7 +1,8 @@
{ config, ... }: { config, caddy-patched, ... }:
{ {
services.caddy = { services.caddy = {
enable = true; enable = true;
# package = caddy-patched.packages.x86_64-linux.default;
email = "ca@${config.networking.domain}"; email = "ca@${config.networking.domain}";
logFormat = "format console"; logFormat = "format console";
globalConfig = '' globalConfig = ''