60 lines
1.8 KiB
Nix
60 lines
1.8 KiB
Nix
{ hostInterface, servedDomains, stateDirectory, ipHostMap, ... }:
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
inherit (pkgs.lib) getSiteGatewayV4;
|
|
|
|
zoneName = "fudo.org";
|
|
zone = config.fudo.zones."${zoneName}";
|
|
nameserverDeets = zone.hosts."nameserver";
|
|
siteName = config.instance.local-site;
|
|
|
|
in {
|
|
config = {
|
|
systemd.tmpfiles.rules = [ "d ${stateDirectory} 700 root root - -" ];
|
|
|
|
containers.nameserver = {
|
|
autoStart = true;
|
|
# Needs to be able to set it's own IP(s)
|
|
additionalCapabilities = [ "CAP_NET_ADMIN" ];
|
|
macvlans = [ hostInterface ];
|
|
bindMounts."/var/lib/nsd".hostPath = stateDirectory;
|
|
|
|
config = {
|
|
imports = [ pkgs.moduleRegistry.authoritativeDns ];
|
|
|
|
networking = {
|
|
defaultGateway = getSiteGatewayV4 siteName;
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 53 ];
|
|
allowedUDPPorts = [ 53 ];
|
|
};
|
|
interfaces."mv-${hostInterface}" = {
|
|
ipv4.addresses = optional (nameserverDeets.ipv4-address != null) {
|
|
address = nameserverDeets.ipv4-address;
|
|
prefixLength = getSiteV4PrefixLength siteName;
|
|
};
|
|
ipv6.addresses = optional (nameserverDeets.ipv6-address != null) {
|
|
address = nameserverDeets.ipv6-address;
|
|
prefixLength = getSiteV6PrefixLength siteName;
|
|
};
|
|
};
|
|
};
|
|
|
|
services.authoritative-dns = {
|
|
enable = true;
|
|
identity = "nameserver.${zoneName}";
|
|
listen-ips = [ nameserverDeets.ipv4-address ];
|
|
state-directory = "/var/lib/nsd";
|
|
timestamp = toString config.instance.build-timestamp;
|
|
ip-host-map = ipHostMap;
|
|
domains = servedDomains;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|