rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-05-13 07:41:08 +02:00
Code Issues Projects Releases Packages Wiki Activity

dns fuckery

Browse source
This commit is contained in:
Rouven Seifert 2025-05-10 20:17:40 +02:00
parent 5f43998de8
commit f8eee37e51
12 changed files with 62 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

33
flake.lock generated
View file

@ -39,11 +39,11 @@
"uv2nix": "uv2nix"
},
"locked": {
"lastModified": 1746770624,
"narHash": "sha256-40c1p1EiveXd8P4MsG21+M4x/0QOCGQJP0ISyx9L1QE=",
"lastModified": 1746874492,
"narHash": "sha256-Gm2Eb5KBxAL6y9WJj7phRMXNAZzVkKlm9Dky9WDZHtQ=",
"owner": "nix-community",
"repo": "authentik-nix",
"rev": "0b5a36483867e2473a40610d0dcb7cb06260a6cf",
"rev": "2ef24fac993808a1a57f367ef58ac0f5254c3489",
"type": "github"
},
"original": {
@ -85,6 +85,26 @@
"type": "github"
}
},
"caddy-patched": {
"inputs": {
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1746901403,
"narHash": "sha256-2tkRHeNEkaE1x0ayfi30+nrIQv4Nio/NeT8U3i3qeQA=",
"owner": "rouven0",
"repo": "nixos-caddy-patched",
"rev": "ad2df7623e62ee4595c8f523b30cf6914a2cb6bd",
"type": "github"
},
"original": {
"owner": "rouven0",
"repo": "nixos-caddy-patched",
"type": "github"
}
},
"crane": {
"locked": {
"lastModified": 1731098351,
@ -279,11 +299,11 @@
]
},
"locked": {
"lastModified": 1746798521,
"narHash": "sha256-axfz/jBEH9XHpS7YSumstV7b2PrPf7L8bhWUtLBv3nA=",
"lastModified": 1746892839,
"narHash": "sha256-0b9us0bIOgA1j/s/6zlxVyP3m97yAh0U+YwKayJ6mmU=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "e95a7c5b6fa93304cd2fd78cf676c4f6d23c422c",
"rev": "12e67385964d9c9304daa81d0ad5ba3b01fdd35e",
"type": "github"
},
"original": {
@ -616,6 +636,7 @@
"inputs": {
"agenix": "agenix",
"authentik": "authentik",
"caddy-patched": "caddy-patched",
"dns": "dns",
"home-manager": "home-manager",
"impermanence": "impermanence",

5
flake.nix
View file

@ -47,6 +47,10 @@
url = "github:nix-community/lanzaboote/v0.4.2";
inputs.nixpkgs.follows = "nixpkgs";
};
caddy-patched = {
url = "github:rouven0/nixos-caddy-patched";
inputs.nixpkgs.follows = "nixpkgs";
};
};
outputs =
@ -62,6 +66,7 @@
, purge
, trucksimulatorbot
, pfersel
, caddy-patched
, ...
}@attrs: {
packages.x86_64-linux = {

2
hosts/falkenstein/modules/caddy/default.nix
View file

@ -1,4 +1,4 @@
{ config, ... }:
{ config, caddy-patched, ... }:
let
# matrix homeserver discovery
matrix_domain = "matrix.${config.networking.domain}";

23
hosts/falkenstein/modules/dns/default.nix
View file

@ -11,7 +11,8 @@ let
{
nameServer = "ns.rfive.de.";
adminEmail = "hostmaster@rfive.de";
serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864));
# serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864));
serial = 2025051079;
refresh = 10800;
retry = 3600;
expire = 604800;
@ -36,9 +37,14 @@ let
subdomains =
let
# fetches all VgetVirtualHosts from the caddy config
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts);
# generate CNAMES from caddy service to host
genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { CNAME = [ "${hostname}.${domain}." ]; });
# generate ACME challenge recorsd for every VirtualHost
genACMECNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { subdomains._acme-challenge.CNAME = [ "challenge.acme.${domain}." ]; });
# fuckery to merge the generated attribute lists
mergeRecords = recordList: lib.attrsets.mapAttrs (_host: records: lib.attrsets.mergeAttrsList records) (lib.attrsets.zipAttrs recordList);
in
lib.attrsets.mergeAttrsList [
rec {
@ -58,9 +64,15 @@ let
_domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ];
"*".subdomains."_acme-challenge".CNAME = [ "challenge.acme.rfive.de" ];
}
(builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ]))
(builtins.removeAttrs (genCNAMEs "falkenstein") [ "mail" ":2018" ])
(mergeRecords [
(builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ]))
])
(mergeRecords [
(builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
(builtins.removeAttrs (genACMECNAMEs "falkenstein") ([ ":2018" "mail" ]))
])
(builtins.removeAttrs (genACMECNAMEs "fujitsu") ([ ":2018" ]))
];
});
in
@ -89,6 +101,9 @@ in
dnssec-policy split-keys;
inline-signing yes;
serial-update-method date;
update-policy {
grant caddy. name challenge.acme.rfive.de. txt;
};
'';
file = "${directory}/rfive.de.zone.txt";
};

4
hosts/fujitsu/modules/jellyfin/default.nix
View file

@ -1,4 +1,4 @@
{ config, ... }:
{ ... }:
let
domain = "media.vpn.rfive.de";
in
@ -6,7 +6,7 @@ in
services.jellyfin = {
enable = true;
};
services.caddy.virtualHosts."http://${domain}".extraConfig = ''
services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:8096
'';
}

2
hosts/nuc/modules/adguard/default.nix
View file

@ -13,7 +13,7 @@ in
http.address = "127.0.0.1:${toString port}";
};
};
services.caddy.virtualHosts."http://${domain}".extraConfig = ''
services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString port}
'';
}

2
hosts/nuc/modules/atuin/default.nix
View file

@ -6,7 +6,7 @@ in
services.atuin = {
enable = true;
};
services.caddy.virtualHosts."http://${domain}".extraConfig = ''
services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.atuin.port}
'';
}

2
hosts/nuc/modules/indexing/prowlarr.nix
View file

@ -6,7 +6,7 @@ in
services.prowlarr = {
enable = true;
};
services.caddy.virtualHosts."http://${domain}".extraConfig = ''
services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.prowlarr.settings.server.port}
'';
}

2
hosts/nuc/modules/indexing/radarr.nix
View file

@ -6,7 +6,7 @@ in
services.radarr = {
enable = true;
};
services.caddy.virtualHosts."http://${domain}".extraConfig = ''
services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.radarr.settings.server.port}
'';
}

2
hosts/nuc/modules/indexing/sonarr.nix
View file

@ -6,7 +6,7 @@ in
services.sonarr = {
enable = true;
};
services.caddy.virtualHosts."http://${domain}".extraConfig = ''
services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.sonarr.settings.server.port}
'';
}

2
hosts/nuc/modules/torrent/default.nix
View file

@ -125,7 +125,7 @@ in
SystemCallFilter = "@system-service";
};
};
services.caddy.virtualHosts."http://${domain}".extraConfig = ''
services.caddy.virtualHosts."${domain}".extraConfig = ''
reverse_proxy 127.0.0.1:${toString cfg.port}
'';
systemd.tmpfiles.rules = [

3
shared/caddy/default.nix
View file

@ -1,7 +1,8 @@
{ config, ... }:
{ config, caddy-patched, ... }:
{
services.caddy = {
enable = true;
# package = caddy-patched.packages.x86_64-linux.default;
email = "ca@${config.networking.domain}";
logFormat = "format console";
globalConfig = ''