Add text library function (format-json-file)
This commit is contained in:
parent
f49233c0ac
commit
125d2d3d57
|
|
@ -0,0 +1,272 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
cfg = config.fudo.adguard-dns-proxy;
|
||||
|
||||
hostname = config.instance.hostname;
|
||||
|
||||
get-basename = filename:
|
||||
head (builtins.match "^[a-zA-Z0-9]+-(.+)$" (baseNameOf filename));
|
||||
|
||||
format-json-file = filename: pkgs.stdenv.mkDerivation {
|
||||
name = "formatted-${get-basename filename}";
|
||||
phases = [ "installPhase" ];
|
||||
buildInputs = with pkgs; [ python ];
|
||||
installPhase = "python -mjson.tool ${filename} > $out";
|
||||
};
|
||||
|
||||
|
||||
admin-passwd-file =
|
||||
pkgs.lib.passwd.stablerandom-passwd-file
|
||||
"adguard-dns-proxy-admin"
|
||||
config.instance.build-seed;
|
||||
|
||||
filterOpts = {
|
||||
options = with types; {
|
||||
enable = mkOption {
|
||||
type = bool;
|
||||
description = "Enable this filter on DNS traffic.";
|
||||
default = true;
|
||||
};
|
||||
name = mkOption {
|
||||
type = str;
|
||||
description = "Name of this filter.";
|
||||
};
|
||||
url = mkOption {
|
||||
type = str;
|
||||
description = "URL to the filter itself.";
|
||||
default = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
generate-config = { dns,
|
||||
http,
|
||||
filters,
|
||||
verbose,
|
||||
upstream-dns,
|
||||
bootstrap-dns,
|
||||
blocked-hosts,
|
||||
enable-dnssec,
|
||||
local-domain-name,
|
||||
... }: {
|
||||
bind_host = http.listen-ip;
|
||||
bind_port = http.listen-port;
|
||||
users = [
|
||||
{
|
||||
name = "admin";
|
||||
password = pkgs.lib.passwd.bcrypt-passwd
|
||||
"adguard-dns-proxy-admin"
|
||||
admin-passwd-file;
|
||||
}
|
||||
];
|
||||
auth_attempts = 5;
|
||||
block_auth_min = 30;
|
||||
web_session_ttl = 720;
|
||||
dns = {
|
||||
bind_hosts = dns.listen-ips;
|
||||
port = dns.listen-port;
|
||||
upstream_dns = upstream-dns;
|
||||
bootstrap_dns = bootstrap-dns;
|
||||
blocking_mode = "default";
|
||||
blocked_hosts = blocked-hosts;
|
||||
enable_dnssec = enable-dnssec;
|
||||
local_domain_name = local-domain-name;
|
||||
};
|
||||
tls.enabled = false;
|
||||
filters = imap1 (i: filter: {
|
||||
enabled = true;
|
||||
name = filter.name;
|
||||
url = filter.url;
|
||||
}) filters;
|
||||
dhcp.enabled = false;
|
||||
clients = [];
|
||||
verbose = verbose;
|
||||
schema_version = 10;
|
||||
};
|
||||
|
||||
generate-config-file = opts:
|
||||
format-json-file (pkgs.writeText "adguard-dns-proxy-config.yaml"
|
||||
(builtins.toJSON (generate-config opts)));
|
||||
|
||||
in {
|
||||
options.fudo.adguard-dns-proxy = with types; {
|
||||
enable = mkEnableOption "Enable AdGuardHome DNS proxy.";
|
||||
|
||||
dns = {
|
||||
listen-ips = mkOption {
|
||||
type = listOf str;
|
||||
description = "IP on which to listen for incoming DNS requests.";
|
||||
default = [ "0.0.0.0" ];
|
||||
};
|
||||
|
||||
listen-port = mkOption {
|
||||
type = port;
|
||||
description = "Port on which to listen for DNS queries.";
|
||||
default = 53;
|
||||
};
|
||||
};
|
||||
|
||||
http = {
|
||||
listen-ip = mkOption {
|
||||
type = str;
|
||||
description = "IP on which to listen for incoming HTTP requests.";
|
||||
};
|
||||
|
||||
listen-port = mkOption {
|
||||
type = port;
|
||||
description = "Port on which to listen for incoming HTTP queries.";
|
||||
default = 8053;
|
||||
};
|
||||
};
|
||||
|
||||
filters = mkOption {
|
||||
type = listOf (submodule filterOpts);
|
||||
description = "List of filters to apply to DNS traffic.";
|
||||
default = [
|
||||
{
|
||||
name = "AdGuard DNS filter";
|
||||
url = "https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt";
|
||||
}
|
||||
{
|
||||
name = "AdAway Default Blocklist";
|
||||
url = "https://adaway.org/hosts.txt";
|
||||
}
|
||||
{
|
||||
name = "MalwareDomainList.com Hosts List";
|
||||
url = "https://www.malwaredomainlist.com/hostslist/hosts.txt";
|
||||
}
|
||||
{
|
||||
name = "OISD.NL Blocklist";
|
||||
url = "https://abp.oisd.nl/";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
blocked-hosts = mkOption {
|
||||
type = listOf str;
|
||||
description = "List of hosts to explicitly block.";
|
||||
default = [
|
||||
"version.bind"
|
||||
"id.server"
|
||||
"hostname.bind"
|
||||
];
|
||||
};
|
||||
|
||||
enable-dnssec = mkOption {
|
||||
type = bool;
|
||||
description = "Enable DNSSEC";
|
||||
default = true;
|
||||
};
|
||||
|
||||
upstream-dns = mkOption {
|
||||
type = listOf str;
|
||||
description = ''
|
||||
List of upstream DNS services to use.
|
||||
|
||||
See https://github.com/AdguardTeam/dnsproxy for correct formatting.
|
||||
'';
|
||||
default = [
|
||||
"https://1.1.1.1/dns-query"
|
||||
"https://1.0.0.1/dns-query"
|
||||
# These 11 addrs send the network, so the response can prefer closer answers
|
||||
"https://9.9.9.11/dns-query"
|
||||
"https://149.112.112.11/dns-query"
|
||||
"https://2620:fe::11/dns-query"
|
||||
"https://2620:fe::fe:11/dns-query"
|
||||
];
|
||||
};
|
||||
|
||||
bootstrap-dns = mkOption {
|
||||
type = listOf str;
|
||||
description = "List of DNS servers used to bootstrap DNS-over-HTTPS.";
|
||||
default = [
|
||||
"1.1.1.1"
|
||||
"1.0.0.1"
|
||||
"9.9.9.9"
|
||||
"149.112.112.112"
|
||||
"2620:fe::10"
|
||||
"2620:fe::fe:10"
|
||||
];
|
||||
};
|
||||
|
||||
allowed-networks = mkOption {
|
||||
type = nullOr (listOf str);
|
||||
description = "Optional list of networks with which this job may communicate.";
|
||||
default = null;
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = str;
|
||||
description = "User as which this job will run.";
|
||||
default = "adguard-dns-proxy";
|
||||
};
|
||||
|
||||
local-domain-name = mkOption {
|
||||
type = str;
|
||||
description = "Local domain name.";
|
||||
};
|
||||
|
||||
verbose = mkEnableOption "Keep verbose logs.";
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable (let
|
||||
upgrade-perms = cfg.dns.listen-port <= 1024 || cfg.http.listen-port <= 1024;
|
||||
in {
|
||||
users = mkIf upgrade-perms {
|
||||
users.${cfg.user} = {
|
||||
isSystemUser = true;
|
||||
group = cfg.user;
|
||||
};
|
||||
|
||||
groups.${cfg.user} = {
|
||||
members = [ cfg.user ];
|
||||
};
|
||||
};
|
||||
|
||||
fudo = {
|
||||
secrets.host-secrets.${hostname} = {
|
||||
adguard-dns-proxy-admin-password = {
|
||||
source-file = admin-passwd-file;
|
||||
target-file = "/run/adguard-dns-proxy/admin.passwd";
|
||||
user = "root";
|
||||
};
|
||||
};
|
||||
|
||||
system.services.adguard-dns-proxy = let
|
||||
cfg-path = "/run/adguard-dns-proxy/config.yaml";
|
||||
in {
|
||||
description = "DNS Proxy for ad filtering and DNS-over-HTTPS lookups.";
|
||||
wantedBy = [ "default.target" ];
|
||||
after = [ "syslog.target" ];
|
||||
requires = [ "network.target" ];
|
||||
privateNetwork = false;
|
||||
requiredCapabilities = optional upgrade-perms "CAP_NET_BIND_SERVICE";
|
||||
restartWhen = "always";
|
||||
addressFamilies = null;
|
||||
networkWhitelist = cfg.allowed-networks;
|
||||
user = mkIf upgrade-perms cfg.user;
|
||||
runtimeDirectory = "adguard-dns-proxy";
|
||||
stateDirectory = "adguard-dns-proxy";
|
||||
preStart = ''
|
||||
cp ${generate-config-file cfg} ${cfg-path};
|
||||
chown $USER ${cfg-path};
|
||||
chmod u+w ${cfg-path};
|
||||
'';
|
||||
|
||||
execStart = let
|
||||
args = [
|
||||
"--no-check-update"
|
||||
"--work-dir /var/lib/adguard-dns-proxy"
|
||||
"--pidfile /run/adguard-dns-proxy/adguard-dns-proxy.pid"
|
||||
"--host ${cfg.http.listen-ip}"
|
||||
"--port ${toString cfg.http.listen-port}"
|
||||
"--config ${cfg-path}"
|
||||
];
|
||||
arg-string = concatStringsSep " " args;
|
||||
in "${pkgs.adguardhome}/bin/adguardhome ${arg-string}";
|
||||
};
|
||||
};
|
||||
});
|
||||
}
|
||||
|
|
@ -0,0 +1,131 @@
|
|||
{ config, lib, pkgs, ... } @ toplevel:
|
||||
|
||||
with lib;
|
||||
let
|
||||
cfg = config.fudo.backplane.dns;
|
||||
|
||||
backplane-dns-home = "${config.instance.service-home}/backplane-dns";
|
||||
|
||||
in {
|
||||
options.fudo.backplane.dns = with types; {
|
||||
enable = mkEnableOption "Enable DNS backplane service.";
|
||||
|
||||
required-services = mkOption {
|
||||
type = listOf str;
|
||||
description = "List of systemd units on which the DNS backplane job depends.";
|
||||
default = [ ];
|
||||
};
|
||||
|
||||
backplane-server = mkOption {
|
||||
type = str;
|
||||
description = "Backplane XMPP server hostname.";
|
||||
default = toplevel.config.fudo.backplane.backplane-hostname;
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = str;
|
||||
description = "User as which to run the backplane dns service.";
|
||||
default = "backplane-dns";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = str;
|
||||
description = "Group as which to run the backplane dns service.";
|
||||
default = "backplane-dns";
|
||||
};
|
||||
|
||||
database = {
|
||||
host = mkOption {
|
||||
type = str;
|
||||
description = "Hostname or IP of the PostgreSQL server.";
|
||||
};
|
||||
|
||||
database = mkOption {
|
||||
type = str;
|
||||
description = "Database to use for DNS backplane.";
|
||||
default = "backplane_dns";
|
||||
};
|
||||
|
||||
username = mkOption {
|
||||
type = str;
|
||||
description = "Database user for DNS backplane.";
|
||||
default = "backplane_dns";
|
||||
};
|
||||
|
||||
password-file = mkOption {
|
||||
type = str;
|
||||
description = "File containing password for DNS backplane database user.";
|
||||
};
|
||||
|
||||
ssl-mode = mkOption {
|
||||
type = enum ["no" "yes" "full" "try" "require"];
|
||||
description = "SSL connection mode.";
|
||||
default = "require";
|
||||
};
|
||||
};
|
||||
|
||||
backplane-role = {
|
||||
role = mkOption {
|
||||
type = str;
|
||||
description = "Backplane XMPP role name for DNS backplane job.";
|
||||
default = "service-dns";
|
||||
};
|
||||
|
||||
password-file = mkOption {
|
||||
type = str;
|
||||
description = "Password file for backplane XMPP for DNS backplane job.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
users = {
|
||||
users.${cfg.user} = {
|
||||
isSystemUser = true;
|
||||
group = cfg.group;
|
||||
home = backplane-dns-home;
|
||||
createHome = true;
|
||||
};
|
||||
groups.${cfg.group} = {
|
||||
members = [ cfg.user ];
|
||||
};
|
||||
};
|
||||
|
||||
fudo.system.services = {
|
||||
backplane-dns = {
|
||||
description = "Fudo DNS Backplane Server";
|
||||
restartIfChanged = true;
|
||||
path = with pkgs; [ backplane-dns-server ];
|
||||
execStart = "${pkgs.backplane-dns-server}/bin/launch-backplane-dns.sh";
|
||||
#pidFile = "/run/backplane/dns.pid";
|
||||
partOf = [ "backplane-dns.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
requires = cfg.required-services;
|
||||
user = cfg.user;
|
||||
group = cfg.group;
|
||||
memoryDenyWriteExecute = false; # Needed becuz Lisp
|
||||
readWritePaths = [ backplane-dns-home ];
|
||||
privateNetwork = false;
|
||||
addressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||
environment = {
|
||||
FUDO_DNS_BACKPLANE_XMPP_HOSTNAME = cfg.backplane-server;
|
||||
FUDO_DNS_BACKPLANE_XMPP_USERNAME = cfg.backplane-role.role;
|
||||
FUDO_DNS_BACKPLANE_XMPP_PASSWORD_FILE = cfg.backplane-role.password-file;
|
||||
|
||||
FUDO_DNS_BACKPLANE_DATABASE_HOSTNAME = cfg.database.host;
|
||||
FUDO_DNS_BACKPLANE_DATABASE_NAME = cfg.database.database;
|
||||
FUDO_DNS_BACKPLANE_DATABASE_USERNAME =
|
||||
cfg.database.username;
|
||||
FUDO_DNS_BACKPLANE_DATABASE_PASSWORD_FILE =
|
||||
cfg.database.password-file;
|
||||
FUDO_DNS_BACKPLANE_DATABASE_USE_SSL = cfg.database.ssl-mode;
|
||||
|
||||
CL_SOURCE_REGISTRY =
|
||||
pkgs.lib.lisp.lisp-source-registry pkgs.backplane-dns-server;
|
||||
|
||||
LD_LIBRARY_PATH = "${pkgs.openssl.out}/lib";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,134 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
cfg = config.fudo.backplane;
|
||||
hostname = config.instance.hostname;
|
||||
|
||||
host-secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
generate-auth-file = name: files: let
|
||||
make-entry = name: passwd-file:
|
||||
''("${name}" . "${readFile passwd-file}")'';
|
||||
entries = mapAttrsToList make-entry files;
|
||||
content = concatStringsSep "\n" entries;
|
||||
in pkgs.writeText "${name}-backplane-auth.scm" "'(${content})";
|
||||
|
||||
host-auth-file = generate-auth-file "host"
|
||||
(mapAttrs (hostname: hostOpts: hostOpts.password-file)
|
||||
cfg.client-hosts);
|
||||
|
||||
service-auth-file = generate-auth-file "service"
|
||||
(mapAttrs (service: serviceOpts: serviceOpts.password-file)
|
||||
cfg.services);
|
||||
|
||||
clientHostOpts = { name, ... }: {
|
||||
options = with types; {
|
||||
password-file = mkOption {
|
||||
type = path;
|
||||
description =
|
||||
"Location (on the build host) of the file containing the host password.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
serviceOpts = { name, ... }: {
|
||||
options = with types; {
|
||||
password-file = mkOption {
|
||||
type = path;
|
||||
description =
|
||||
"Location (on the build host) of the file containing the service password.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
in {
|
||||
options.fudo.backplane = with types; {
|
||||
enable = mkEnableOption "Enable backplane XMPP server.";
|
||||
|
||||
client-hosts = mkOption {
|
||||
type = attrsOf (submodule clientHostOpts);
|
||||
description = "List of backplane client options.";
|
||||
default = {};
|
||||
};
|
||||
|
||||
services = mkOption {
|
||||
type = attrsOf (submodule serviceOpts);
|
||||
description = "List of backplane service options.";
|
||||
default = {};
|
||||
};
|
||||
|
||||
backplane-hostname = mkOption {
|
||||
type = str;
|
||||
description = "Hostname of the backplane XMPP server.";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
fudo = {
|
||||
secrets.host-secrets.${hostname} = {
|
||||
backplane-host-auth = {
|
||||
source-file = generate-auth-file "host"
|
||||
(mapAttrs (hostname: hostOpts: hostOpts.password-file)
|
||||
cfg.client-hosts);
|
||||
target-file = "/run/backplane/host-passwords.scm";
|
||||
user = config.fudo.jabber.user;
|
||||
};
|
||||
backplane-service-auth = {
|
||||
source-file = generate-auth-file "service"
|
||||
(mapAttrs (service: serviceOpts: serviceOpts.password-file)
|
||||
cfg.services);
|
||||
target-file = "/run/backplane/service-passwords.scm";
|
||||
user = config.fudo.jabber.user;
|
||||
};
|
||||
};
|
||||
|
||||
jabber = {
|
||||
environment = {
|
||||
FUDO_HOST_PASSWD_FILE =
|
||||
host-secrets.backplane-host-auth.target-file;
|
||||
FUDO_SERVICE_PASSWD_FILE =
|
||||
host-secrets.backplane-service-auth.target-file;
|
||||
};
|
||||
|
||||
sites.${cfg.backplane-hostname} = {
|
||||
hostname = cfg.backplane-hostname;
|
||||
|
||||
site-config = {
|
||||
auth_method = "external";
|
||||
extauth_program =
|
||||
"${pkgs.guile}/bin/guile -s ${pkgs.backplane-auth}/backplane-auth.scm";
|
||||
extauth_pool_size = 3;
|
||||
auth_use_cache = true;
|
||||
|
||||
modules = {
|
||||
mod_adhoc = {};
|
||||
mod_caps = {};
|
||||
mod_carboncopy = {};
|
||||
mod_client_state = {};
|
||||
mod_configure = {};
|
||||
mod_disco = {};
|
||||
mod_fail2ban = {};
|
||||
mod_last = {};
|
||||
mod_offline.access_max_user_messages = 5000;
|
||||
mod_ping = {};
|
||||
mod_pubsub = {
|
||||
access_createnode = "pubsub_createnode";
|
||||
ignore_pep_from_offline = true;
|
||||
last_item_cache = false;
|
||||
plugins = [
|
||||
"flat"
|
||||
"pep"
|
||||
];
|
||||
};
|
||||
mod_roster = {};
|
||||
mod_stream_mgmt = {};
|
||||
mod_time = {};
|
||||
mod_version = {};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,339 @@
|
|||
{ config, lib, pkgs, ... } @ toplevel:
|
||||
|
||||
# NOTE: To get DNS records:
|
||||
# pdnsutil --config-dir=... show-zone <domain>
|
||||
|
||||
with lib;
|
||||
let
|
||||
cfg = config.fudo.powerdns;
|
||||
|
||||
hostname = config.instance.hostname;
|
||||
|
||||
runtime-dir = "/run/powerdns/conf";
|
||||
|
||||
target-gpgsql-config = "${runtime-dir}/pdns.local.gpgsql.conf";
|
||||
|
||||
gpgsql-template = pkgs.writeText "pdns.gpgsql.conf.template" ''
|
||||
launch+=gpgsql
|
||||
gpgsql-host=${cfg.database.host}
|
||||
gpgsql-dbname=${cfg.database.database}
|
||||
gpgsql-user=${cfg.database.user}
|
||||
gpgsql-password=__PASSWORD__
|
||||
gpgsql-dnssec=${if cfg.enable-dnssec then "yes" else "no"}
|
||||
gpgsql-extra-connection-parameters=sslmode=require
|
||||
'';
|
||||
|
||||
pdns-config-dir = pkgs.writeTextDir "pdns.conf" ''
|
||||
local-address=${concatStringsSep ", " cfg.listen-v4-addresses}
|
||||
local-ipv6=${concatStringsSep ", " cfg.listen-v6-addresses}
|
||||
local-port=${toString cfg.port}
|
||||
launch=
|
||||
include-dir=${runtime-dir}
|
||||
'';
|
||||
|
||||
make-pgpass-file = user: target-file: let
|
||||
db = cfg.database;
|
||||
in pkgs.writeShellScript "genenrate-pgpass-file.sh" ''
|
||||
touch ${target-file}
|
||||
chown ${user} ${target-file}
|
||||
chmod 700 ${target-file}
|
||||
PASSWORD=$(cat ${db.password-file})
|
||||
echo "${db.host}:${toString db.port}:${db.database}:${db.user}:__PASSWORD__" | sed "s/__PASSWORD__/$PASSWORD/" > ${target-file}
|
||||
'';
|
||||
|
||||
mkRecord = name: type: content: {
|
||||
inherit name type content;
|
||||
};
|
||||
|
||||
initialize-domain-sql = domain: let
|
||||
domain-name = domain.domain;
|
||||
host-ip = pkgs.lib.network.host-ipv4 config hostname;
|
||||
ipv6-net = net: (builtins.match ":" net) != null;
|
||||
ipv4-net = net: !(ipv6-net net);
|
||||
domain-records = [
|
||||
(mkRecord domain-name "SOA" "ns1.${domain-name} hostmaster.${domain-name} ${toString config.instance.build-timestamp} 10800 3600 1209600 3600")
|
||||
(mkRecord "_dmark.${domain-name}" "TXT" ''"v=DMARC1; p=reject; rua=mailto:${domain.admin}; ruf=mailto:${domain.admin}; fo=1;"'')
|
||||
(mkRecord domain-name "NS" "ns1.${domain-name}")
|
||||
(mkRecord domain-name "TXT" (let
|
||||
networks = config.instance.local-networks;
|
||||
v4-nets = map (net: "ip4:${net}") (filter ipv4-net networks);
|
||||
v6-nets = map (net: "ip6:${net}") (filter ipv6-net networks);
|
||||
networks-string = concatStringsSep " " (v4-nets ++ v6-nets);
|
||||
in ''"v=spf1 mx ${networks-string} -all"''))
|
||||
(mkRecord "ns1.${domain-name}" "A" host-ip)
|
||||
] ++
|
||||
(optional (domain.gssapi-realm != null)
|
||||
(mkRecord "_kerberos.${domain-name}" "TXT" ''"domain.gssapi-realm"'')) ++
|
||||
(mapAttrsToList (alias: target: mkRecord alias "CNAME" target)
|
||||
domain.aliases);
|
||||
records-strings = map (record:
|
||||
"INSERT INTO records (domain_id, name, type, content) SELECT id, '${record.name}', '${record.type}', '${record.content}' FROM domains WHERE name='${domain-name}';")
|
||||
domain-records;
|
||||
in pkgs.writeText "initialize-${domain-name}.sql" ''
|
||||
INSERT INTO domains (name, master, type, notified_serial) VALUES ('${domain-name}', '${host-ip}', 'MASTER', '${toString config.instance.build-timestamp}');
|
||||
${concatStringsSep "\n" records-strings}
|
||||
'';
|
||||
|
||||
initialize-domain-script = domain: let
|
||||
domain-name = domain.domain;
|
||||
in pkgs.writeShellScript "initialize-${domain-name}.sh" ''
|
||||
if [ "$( psql -tAc "SELECT id FROM domains WHERE name='${domain-name}'" )" ]; then
|
||||
logger "${domain-name} already initialized, skipping"
|
||||
exit 0
|
||||
else
|
||||
logger "initializing ${domain-name} in powerdns database"
|
||||
psql -f ${initialize-domain-sql domain}
|
||||
fi
|
||||
'';
|
||||
|
||||
domainOpts = { name, ... }: {
|
||||
options = with types; {
|
||||
domain = mkOption {
|
||||
type = str;
|
||||
description = "Domain name.";
|
||||
default = name;
|
||||
};
|
||||
|
||||
admin = mkOption {
|
||||
type = str;
|
||||
description = "Administrator email.";
|
||||
default = "admin@${name}";
|
||||
};
|
||||
|
||||
aliases = mkOption {
|
||||
type = attrsOf str;
|
||||
description = "Map of alias to authoritative hostname for this domain.";
|
||||
default = {};
|
||||
};
|
||||
|
||||
gssapi-realm = mkOption {
|
||||
type = nullOr str;
|
||||
description = "GSSAPI realm of this domain.";
|
||||
default = null;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
in {
|
||||
options.fudo.powerdns = with types; {
|
||||
enable = mkEnableOption "Enable PowerDNS nameserver.";
|
||||
|
||||
port = mkOption {
|
||||
type = port;
|
||||
description = "Port on which to listen for DNS requests.";
|
||||
default = 53;
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = str;
|
||||
description = "User as which to run PowerDNS server.";
|
||||
default = "powerdns";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = str;
|
||||
description = "Group as which to run PowerDNS server.";
|
||||
default = "powerdns";
|
||||
};
|
||||
|
||||
listen-v4-addresses = mkOption {
|
||||
type = listOf str;
|
||||
description = "List of IPv4 addresses on which to listen.";
|
||||
};
|
||||
|
||||
listen-v6-addresses = mkOption {
|
||||
type = listOf str;
|
||||
description = "List of IPv6 addresses on which to listen.";
|
||||
default = [];
|
||||
};
|
||||
|
||||
domains = mkOption {
|
||||
type = attrsOf (submodule domainOpts);
|
||||
description = "Domains to be served by this DNS server.";
|
||||
};
|
||||
|
||||
enable-dnssec = mkOption {
|
||||
type = bool;
|
||||
description = "Enable DNSSEC for this domain.";
|
||||
default = true;
|
||||
};
|
||||
|
||||
database = {
|
||||
host = mkOption {
|
||||
type = str;
|
||||
description = "Hostname or IP of the PostgreSQL server.";
|
||||
};
|
||||
|
||||
port = mkOption {
|
||||
type = port;
|
||||
description = "Port of the PostgreSQL server.";
|
||||
default = 5432;
|
||||
};
|
||||
|
||||
database = mkOption {
|
||||
type = str;
|
||||
description = "Database to use for DNS backplane.";
|
||||
default = "backplane_dns";
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = str;
|
||||
description = "Database user for DNS backplane.";
|
||||
default = "backplane_dns";
|
||||
};
|
||||
|
||||
password-file = mkOption {
|
||||
type = str;
|
||||
description = "File containing password for database user.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
|
||||
users = {
|
||||
users.${cfg.user} = {
|
||||
isSystemUser = true;
|
||||
group = cfg.group;
|
||||
};
|
||||
groups.${cfg.group}.members = [ cfg.user ];
|
||||
};
|
||||
|
||||
fudo.system.services.powerdns-config-generator = {
|
||||
description = "Generate PostgreSQL config for backplane DNS server.";
|
||||
type = "oneshot";
|
||||
restartIfChanged = true;
|
||||
readWritePaths = [ runtime-dir ];
|
||||
user = cfg.user;
|
||||
execStart = let
|
||||
script = pkgs.writeShellScript "generate-powerdns-config.sh" ''
|
||||
TARGET=${target-gpgsql-config}
|
||||
touch $TARGET
|
||||
chown ${cfg.user}:${cfg.group} $TARGET
|
||||
chmod 0700 $TARGET
|
||||
PASSWORD=$( cat ${cfg.database.password-file} | tr -d '\n')
|
||||
sed -e 's/__PASSWORD__/$PASSWORD/' ${gpgsql-template} > $TARGET
|
||||
'';
|
||||
in "${script}";
|
||||
};
|
||||
|
||||
systemd = let
|
||||
pgpass-file = "${runtime-dir}/pgpass";
|
||||
|
||||
initialize-jobs = mapAttrs' (_: domain: let
|
||||
domain-name = domain.domain;
|
||||
in nameValuePair "powerdns-initialize-${domain-name}" {
|
||||
description = "Initialize the ${domain-name} domain";
|
||||
requires = [ "powerdns-initialize-db.service" "powerdns-generate-pgpass.service" ];
|
||||
after = [ "powerdns-initialize-db.service" "powerdns-generate-pgpass.service" ];
|
||||
requiredBy = [ "powerdns.service" ];
|
||||
wantedBy = [ "powerdns.service" ];
|
||||
before = [ "powerdns.service" ];
|
||||
environment = {
|
||||
PGHOST = cfg.database.host;
|
||||
PGUSER = cfg.database.user;
|
||||
PGDATABASE = cfg.database.database;
|
||||
PGPORT = toString cfg.database.port;
|
||||
PGSSLMODE= "require";
|
||||
PGPASSFILE = pgpass-file;
|
||||
};
|
||||
path = with pkgs; [ postgresql util-linux ];
|
||||
serviceConfig = {
|
||||
ExecStart = initialize-domain-script domain;
|
||||
};
|
||||
}) cfg.domains;
|
||||
in {
|
||||
tmpfiles.rules = [
|
||||
"d ${runtime-dir} 0750 ${cfg.user} ${cfg.group} - -"
|
||||
];
|
||||
|
||||
services = initialize-jobs // {
|
||||
powerdns-generate-pgpass = {
|
||||
description = "Create pgpass file required for database init.";
|
||||
serviceConfig = {
|
||||
ExecStart = make-pgpass-file cfg.user "${runtime-dir}/pgpass";
|
||||
};
|
||||
};
|
||||
|
||||
powerdns-initialize-db = {
|
||||
description = "Initialize the powerdns database.";
|
||||
requiredBy = [ "powerdns.service" ];
|
||||
before = [ "powerdns.service" ];
|
||||
requires = [ "powerdns-generate-pgpass.service" ];
|
||||
after = [ "powerdns-generate-pgpass.service" ];
|
||||
path = with pkgs; [ postgresql util-linux ];
|
||||
environment = {
|
||||
PGHOST = cfg.database.host;
|
||||
PGUSER = cfg.database.user;
|
||||
PGDATABASE = cfg.database.database;
|
||||
PGPORT = toString cfg.database.port;
|
||||
PGSSLMODE= "require";
|
||||
PGPASSFILE = pgpass-file;
|
||||
};
|
||||
serviceConfig = {
|
||||
ExecStart = pkgs.writeShellScript "powerdns-initialize-db.sh" ''
|
||||
if [ "$( psql -tAc "SELECT to_regclass('public.domains')" )" ]; then
|
||||
logger "database initialized, skipping"
|
||||
else
|
||||
logger "initializing powerdns database"
|
||||
psql -f ${pkgs.powerdns}/share/doc/pdns/schema.pgsql.sql
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
powerdns = {
|
||||
description = "PowerDNS nameserver.";
|
||||
requires = [ "powerdns-config-generator.service" ];
|
||||
after = [
|
||||
"network.target"
|
||||
"powerdns-config-generator.service"
|
||||
];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = with pkgs; [ powerdns postgresql util-linux ];
|
||||
serviceConfig = {
|
||||
ExecStartPre = pkgs.writeShellScript "powerdns-init-config.sh" ''
|
||||
TARGET=${target-gpgsql-config}
|
||||
touch $TARGET
|
||||
chown ${cfg.user}:${cfg.group} $TARGET
|
||||
chmod 0700 $TARGET
|
||||
PASSWORD=$( cat ${cfg.database.password-file} | tr -d '\n')
|
||||
sed -e "s/__PASSWORD__/$PASSWORD/" ${gpgsql-template} > $TARGET
|
||||
'';
|
||||
ExecStart = pkgs.writeShellScript "launch-powerdns.sh" (concatStringsSep " " [
|
||||
"${pkgs.powerdns}/bin/pdns_server"
|
||||
"--setuid=${cfg.user}"
|
||||
"--setgid=${cfg.group}"
|
||||
"--chroot=${runtime-dir}"
|
||||
"--daemon=no"
|
||||
"--guardian=no"
|
||||
"--disable-syslog"
|
||||
"--write-pid=no"
|
||||
"--config-dir=${pdns-config-dir}"
|
||||
]);
|
||||
ExecStartPost = pkgs.writeShellScript "powerdns-secure-zones.sh"
|
||||
(concatStringsSep "\n"
|
||||
(mapAttrsToList
|
||||
(_: domain: ''
|
||||
DNSINFO=$(${pkgs.powerdns}/bin/pdnsutil --config-dir=${pdns-config-dir} show-zone ${domain.domain})
|
||||
if [[ "x$DNSINFO" =~ "xNo such zone in the database" ]]; then
|
||||
logger "zone ${domain.domain} does not exist in powerdns database"
|
||||
elif [[ "x$DNSINFO" =~ "xZone is not actively secured" ]]; then
|
||||
logger "securing zone ${domain.domain} in powerdns database"
|
||||
${pkgs.powerdns}/bin/pdnsutil --config-dir=${pdns-config-dir} secure-zone ${domain.domain}
|
||||
elif [[ "x$DNSINFO" =~ "xNo keys for zone" ]]; then
|
||||
logger "securing zone ${domain.domain} in powerdns database"
|
||||
${pkgs.powerdns}/bin/pdnsutil --config-dir=${pdns-config-dir} secure-zone ${domain.domain}
|
||||
else
|
||||
logger "not securing zone ${domain.domain} in powerdns database"
|
||||
fi
|
||||
${pkgs.powerdns}/bin/pdnsutil --config-dir=${pdns-config-dir} rectify-zone ${domain.domain}
|
||||
'')
|
||||
cfg.domains));
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{ pkgs, ... }:
|
||||
|
||||
with pkgs.lib;
|
||||
let
|
||||
get-basename = filename:
|
||||
head (builtins.match "^[a-zA-Z0-9]+-(.+)$" (baseNameOf filename));
|
||||
|
||||
format-json-file = filename: pkgs.stdenv.mkDerivation {
|
||||
name = "formatted-${get-basename filename}";
|
||||
phases = [ "installPhase" ];
|
||||
buildInputs = with pkgs; [ python ];
|
||||
installPhase = "python -mjson.tool ${filename} > $out";
|
||||
};
|
||||
|
||||
in {
|
||||
inherit format-json-file;
|
||||
}
|
||||
Loading…
Reference in New Issue