From ee02192290fbbf345440d65ef7d840478c2bbe02 Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Thu, 18 Apr 2024 19:49:10 +0200 Subject: [PATCH 1/4] wireguard: fix DNS search domains --- hosts/falkenstein/modules/networks/default.nix | 6 +++++- hosts/thinkpad/modules/networks/default.nix | 7 ++++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/hosts/falkenstein/modules/networks/default.nix b/hosts/falkenstein/modules/networks/default.nix index 2efbd03..33dc1d7 100644 --- a/hosts/falkenstein/modules/networks/default.nix +++ b/hosts/falkenstein/modules/networks/default.nix @@ -90,7 +90,11 @@ networkConfig = { Address = "192.168.43.4/32"; DNS = "192.168.43.1"; - Domains = "~vpn.rfive.de ~43.168.192.in-addr.arpa"; + Domains = [ + "~vpn.rfive.de" + "~42.168.192.in-addr.arpa" + "~43.168.192.in-addr.arpa" + ]; DNSSEC = false; BindCarrier = [ "ens3" ]; }; diff --git a/hosts/thinkpad/modules/networks/default.nix b/hosts/thinkpad/modules/networks/default.nix index c00bec5..adfaf20 100644 --- a/hosts/thinkpad/modules/networks/default.nix +++ b/hosts/thinkpad/modules/networks/default.nix @@ -25,6 +25,7 @@ nmap curlFull wireguard-tools + etherape ]; services.timesyncd.servers = lib.mkForce [ ]; services.resolved = { @@ -165,7 +166,11 @@ networkConfig = { Address = "192.168.43.3/32"; DNS = "192.168.43.1"; - Domains = "~vpn.rfive.de ~43.168.192.in-addr.arpa"; + Domains = [ + "~vpn.rfive.de" + "~42.168.192.in-addr.arpa" + "~43.168.192.in-addr.arpa" + ]; DNSSEC = false; }; }; From 43a4843551fb6773e1288c7ee1541e2411512d0d Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Thu, 18 Apr 2024 19:49:40 +0200 Subject: [PATCH 2/4] DNS: autogenerate CNAMES from nginx config --- hosts/falkenstein/modules/dns/default.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/hosts/falkenstein/modules/dns/default.nix b/hosts/falkenstein/modules/dns/default.nix index 520990e..6a3c289 100644 --- a/hosts/falkenstein/modules/dns/default.nix +++ b/hosts/falkenstein/modules/dns/default.nix @@ -2,7 +2,8 @@ let modulo = number: mod: (number - ((number / mod) * mod)); secondary = "185.181.104.96"; - zonefile = with dns.lib.combinators; pkgs.writeText "rfive.de.zone.txt" (dns.lib.toString "rfive.de" { + domain = config.networking.domain; + zonefile = with dns.lib.combinators; pkgs.writeText "rfive.de.zone.txt" (dns.lib.toString domain { TTL = 3600; SOA = { nameServer = "ns.rfive.de."; @@ -44,8 +45,8 @@ let _domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ]; } - (lib.attrsets.genAttrs [ "cache" "chat" "matrix" "seafile" "vault" ] (label: { CNAME = [ "nuc.rfive.de." ]; })) - (lib.attrsets.genAttrs [ "purge" "rspamd" "trucks" ] (label: { CNAME = [ "falkenstein.rfive.de." ]; })) + (lib.attrsets.genAttrs (map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations.nuc.config.services.nginx.virtualHosts)) (label: { CNAME = [ "nuc.rfive.de." ]; })) + (lib.attrsets.genAttrs (map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations.falkenstein.config.services.nginx.virtualHosts)) (label: { CNAME = [ "falkenstein.rfive.de." ]; })) ]; }); in From 8f0a5e1a8a5b462a1b2e7546673abe1f744e065d Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Thu, 18 Apr 2024 20:05:32 +0200 Subject: [PATCH 3/4] dns: keep things DRY --- flake.lock | 6 +-- hosts/falkenstein/modules/dns/default.nix | 62 +++++++++++++---------- 2 files changed, 38 insertions(+), 30 deletions(-) diff --git a/flake.lock b/flake.lock index f382057..e786722 100644 --- a/flake.lock +++ b/flake.lock @@ -216,11 +216,11 @@ ] }, "locked": { - "lastModified": 1713294767, - "narHash": "sha256-LmaabaQZdx52MPGKPRt9Opoc9Gd9RbwvCdysUUYQoXI=", + "lastModified": 1713453913, + "narHash": "sha256-vbXq52VRlL1defMHrwhsoeHm95O3mFefsSSJyNEghbA=", "owner": "nix-community", "repo": "home-manager", - "rev": "fa8c16e2452bf092ac76f09ee1fb1e9f7d0796e7", + "rev": "178e26895b3aef028a00a32fb7e7ed0fc660645c", "type": "github" }, "original": { diff --git a/hosts/falkenstein/modules/dns/default.nix b/hosts/falkenstein/modules/dns/default.nix index 6a3c289..4467a00 100644 --- a/hosts/falkenstein/modules/dns/default.nix +++ b/hosts/falkenstein/modules/dns/default.nix @@ -1,19 +1,22 @@ { self, pkgs, lib, config, dns, ... }: let - modulo = number: mod: (number - ((number / mod) * mod)); secondary = "185.181.104.96"; domain = config.networking.domain; zonefile = with dns.lib.combinators; pkgs.writeText "rfive.de.zone.txt" (dns.lib.toString domain { TTL = 3600; - SOA = { - nameServer = "ns.rfive.de."; - adminEmail = "hostmaster@rfive.de"; - serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864)); - refresh = 10800; - retry = 3600; - expire = 604800; - minimum = 3600; - }; + SOA = + let + modulo = number: mod: (number - ((number / mod) * mod)); + in + { + nameServer = "ns.rfive.de."; + adminEmail = "hostmaster@rfive.de"; + serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864)); + refresh = 10800; + retry = 3600; + expire = 604800; + minimum = 3600; + }; NS = [ "ns.inwx.de." "ns2.inwx.de." @@ -30,24 +33,29 @@ let (spf.soft [ "mx" ]) ]; - subdomains = lib.attrsets.mergeAttrsList [ - rec { - nuc = { - A = [ "141.30.227.6" ]; - }; - falkenstein = { - A = [ "23.88.121.184" ]; - AAAA = [ "2a01:4f8:c012:49de::1" ]; - }; - ns = falkenstein; - mail = falkenstein; - _dmarc.TXT = [ "v=DMARC1; p=none; adkim=s; fo=1; rua=mailto:dmarc@rfive.de; ruf=mailto:dmarc@rfive.de" ]; - _domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ]; + subdomains = + let + getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.nginx.virtualHosts); + genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (label: { CNAME = [ "${hostname}.${domain}." ]; }); + in + lib.attrsets.mergeAttrsList [ + rec { + nuc = { + A = [ "141.30.227.6" ]; + }; + falkenstein = { + A = [ "23.88.121.184" ]; + AAAA = [ "2a01:4f8:c012:49de::1" ]; + }; + ns = falkenstein; + mail = falkenstein; + _dmarc.TXT = [ "v=DMARC1; p=none; adkim=s; fo=1; rua=mailto:dmarc@rfive.de; ruf=mailto:dmarc@rfive.de" ]; + _domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ]; - } - (lib.attrsets.genAttrs (map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations.nuc.config.services.nginx.virtualHosts)) (label: { CNAME = [ "nuc.rfive.de." ]; })) - (lib.attrsets.genAttrs (map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations.falkenstein.config.services.nginx.virtualHosts)) (label: { CNAME = [ "falkenstein.rfive.de." ]; })) - ]; + } + (genCNAMEs "nuc") + (genCNAMEs "falkenstein") + ]; }); in { From 1821fe37c8c62f1773e4843bafbe6f1115d78bc1 Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Thu, 18 Apr 2024 20:58:13 +0200 Subject: [PATCH 4/4] dns: fix exclude for mail.rfive.de --- hosts/falkenstein/modules/dns/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/falkenstein/modules/dns/default.nix b/hosts/falkenstein/modules/dns/default.nix index 4467a00..0447cf2 100644 --- a/hosts/falkenstein/modules/dns/default.nix +++ b/hosts/falkenstein/modules/dns/default.nix @@ -54,7 +54,7 @@ let } (genCNAMEs "nuc") - (genCNAMEs "falkenstein") + (builtins.removeAttrs (genCNAMEs "falkenstein") [ "mail" ]) ]; }); in