rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-04-19 13:16:19 +02:00
Code Issues Projects Releases Packages Wiki Activity

Compare commits

base: rouven.seifert:ba3929c39914509923be1db6ebf884f7eedf276f
Branches Tags
rouven.seifert:main
rouven.seifert:push-vxnoqsltyuxy
..
compare: rouven.seifert:5dbab41a2e18c787be0b8b63639eb8be1bdc5b90
Branches Tags
rouven.seifert:main
rouven.seifert:push-vxnoqsltyuxy

No commits in common. "ba3929c39914509923be1db6ebf884f7eedf276f" and "5dbab41a2e18c787be0b8b63639eb8be1bdc5b90" have entirely different histories.
ba3929c399 ... 5dbab41a2e

5 changed files with 11 additions and 31 deletions
Show stats Expand all files Collapse all files

6
flake.lock generated
View file

@ -281,11 +281,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1710120787, "lastModified": 1710040110,
"narHash": "sha256-tlLuB73OCOKtU2j83bQzSYFyzjJo3rjpITZE5MoofG8=", "narHash": "sha256-PNAV8VdZkNoSGQHGQWDefNarl0BtKjVMCCzu16+vsr4=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nix-index-database", "repo": "nix-index-database",
"rev": "e76ff2df6bfd2abe06abd8e7b9f217df941c1b07", "rev": "851fcfd130597c5c91071d46275111522d4fd595",
"type": "github" "type": "github"
}, },
"original": { "original": {

15
hosts/falkenstein/modules/dns/default.nix
View file

@ -6,7 +6,7 @@ let
$ORIGIN rfive.de. $ORIGIN rfive.de.
rfive.de. 86400 IN SOA ns.rfive.de. hostmaster.rfive.de. ( rfive.de. 86400 IN SOA ns.rfive.de. hostmaster.rfive.de. (
2024031014 ; serial 2024031013 ; serial
10800 ; refresh 10800 ; refresh
3600 ; retry 3600 ; retry
604800 ; expire 604800 ; expire
@ -59,16 +59,6 @@ in
services.bind = rec { services.bind = rec {
enable = true; enable = true;
directory = "/var/lib/bind"; directory = "/var/lib/bind";
extraConfig = ''
dnssec-policy "split-keys" {
keys {
ksk lifetime unlimited algorithm ecdsap256sha256;
zsk lifetime 60d algorithm ecdsap256sha256;
};
publish-safety 1d;
retire-safety 1d;
};
'';
zones = { zones = {
"rfive.de" = { "rfive.de" = {
master = true; master = true;
@ -77,7 +67,7 @@ in
]; ];
extraConfig = '' extraConfig = ''
also-notify {${secondary};}; also-notify {${secondary};};
dnssec-policy split-keys; dnssec-policy default;
inline-signing yes; inline-signing yes;
serial-update-method date; serial-update-method date;
''; '';
@ -93,5 +83,4 @@ in
ip saddr ${secondary}/32 tcp dport 53 accept comment "Allow DNS AXFR access from INWX Servers" ip saddr ${secondary}/32 tcp dport 53 accept comment "Allow DNS AXFR access from INWX Servers"
ip saddr ${secondary}/32 udp dport 53 accept comment "Allow DNS access from INWX Servers" ip saddr ${secondary}/32 udp dport 53 accept comment "Allow DNS access from INWX Servers"
''; '';
environment.systemPackages = with pkgs; [ dig.out ];
} }

1
hosts/nuc/default.nix
View file

@ -5,7 +5,6 @@
# Include the results of the hardware scan. # Include the results of the hardware scan.
./hardware-configuration.nix ./hardware-configuration.nix
./modules/networks ./modules/networks
./modules/adguard
./modules/backup ./modules/backup
./modules/cache ./modules/cache
./modules/matrix ./modules/matrix

10
hosts/nuc/modules/adguard/default.nix
View file

@ -1,10 +0,0 @@
{ ... }:
{
networking.firewall.allowedTCPPorts = [ 53 ];
networking.firewall.allowedUDPPorts = [ 53 ];
services.adguardhome = {
enable = true;
openFirewall = true;
settings.bind_port = 3000;
};
}

10
hosts/nuc/modules/networks/default.nix
View file

@ -21,10 +21,12 @@
"2620:fe::fe" "2620:fe::fe"
"2620:fe::9" "2620:fe::9"
]; ];
extraConfig = '' # make room for the adguard dns
[Resolve] # extraConfig = ''
DNSStubListener=no # [Resolve]
''; # DNS=127.0.0.1
# DNSStubListener=no
# '';
}; };
systemd.network = { systemd.network = {
enable = true; enable = true;