144 lines
4.7 KiB
Nix
144 lines
4.7 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
with lib;
|
|
let
|
|
backplane-cfg = config.fudo.backplane;
|
|
|
|
cfg = backplane-cfg.dns;
|
|
|
|
powerdns-conf-dir = "${cfg.powerdns.home}/conf.d";
|
|
|
|
in {
|
|
config = mkIf cfg.enable {
|
|
users = {
|
|
users = {
|
|
"${cfg.user}" = {
|
|
isSystemUser = true;
|
|
group = cfg.group;
|
|
createHome = true;
|
|
home = "/var/home/${cfg.user}";
|
|
};
|
|
${cfg.powerdns.user} = {
|
|
isSystemUser = true;
|
|
home = cfg.powerdns.home;
|
|
createHome = true;
|
|
};
|
|
};
|
|
|
|
groups = {
|
|
${cfg.group} = { members = [ cfg.user ]; };
|
|
${cfg.powerdns.user} = { members = [ cfg.powerdns.user ]; };
|
|
};
|
|
};
|
|
|
|
fudo = {
|
|
system.services = {
|
|
backplane-powerdns-config-generator = {
|
|
description =
|
|
"Generate postgres configuration for backplane DNS server.";
|
|
requires = cfg.required-services;
|
|
type = "oneshot";
|
|
restartIfChanged = true;
|
|
partOf = [ "backplane-dns.target" ];
|
|
|
|
readWritePaths = [ powerdns-conf-dir ];
|
|
|
|
# This builds the config in a bash script, to avoid storing the password
|
|
# in the nix store at any point
|
|
script = let
|
|
user = cfg.powerdns.user;
|
|
db = cfg.powerdns.database;
|
|
in ''
|
|
TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d -t pdns-XXXXXXXXXX)
|
|
TMPCONF=$TMPDIR/pdns.local.gpgsql.conf
|
|
|
|
if [ ! -f ${cfg.database.password-file} ]; then
|
|
echo "${cfg.database.password-file} does not exist!"
|
|
exit 1
|
|
fi
|
|
|
|
touch $TMPCONF
|
|
chmod go-rwx $TMPCONF
|
|
chown ${user} $TMPCONF
|
|
PASSWORD=$(cat ${db.password-file})
|
|
echo "launch+=gpgsql" >> $TMPCONF
|
|
echo "gpgsql-host=${db.host}" >> $TMPCONF
|
|
echo "gpgsql-dbname=${db.database}" >> $TMPCONF
|
|
echo "gpgsql-user=${db.username}" >> $TMPCONF
|
|
echo "gpgsql-password=$PASSWORD" >> $TMPCONF
|
|
echo "gpgsql-dnssec=yes" >> $TMPCONF
|
|
|
|
mv $TMPCONF ${powerdns-conf-dir}/pdns.local.gpgsql.conf
|
|
rm -rf $TMPDIR
|
|
|
|
exit 0
|
|
'';
|
|
};
|
|
|
|
backplane-dns = {
|
|
description = "Fudo DNS Backplane Server";
|
|
restartIfChanged = true;
|
|
path = with pkgs; [ backplane-dns-server ];
|
|
execStart = "launch-backplane-dns.sh";
|
|
pidFile = "/run/backplane-dns.$USERNAME.pid";
|
|
user = cfg.user;
|
|
group = cfg.group;
|
|
partOf = [ "backplane-dns.target" ];
|
|
requires = cfg.required-services ++ [ "postgresql.service" ];
|
|
environment = {
|
|
FUDO_DNS_BACKPLANE_XMPP_HOSTNAME = backplane-cfg.backplane-host;
|
|
FUDO_DNS_BACKPLANE_XMPP_USERNAME = cfg.backplane-role.role;
|
|
FUDO_DNS_BACKPLANE_XMPP_PASSWORD_FILE = cfg.backplane-role.password-file;
|
|
FUDO_DNS_BACKPLANE_DATABASE_HOSTNAME = cfg.database.host;
|
|
FUDO_DNS_BACKPLANE_DATABASE_NAME = cfg.database.database;
|
|
FUDO_DNS_BACKPLANE_DATABASE_USERNAME =
|
|
cfg.database.username;
|
|
FUDO_DNS_BACKPLANE_DATABASE_PASSWORD_FILE =
|
|
cfg.database.password-file;
|
|
|
|
CL_SOURCE_REGISTRY =
|
|
pkgs.lib.fudo.lisp.lisp-source-registry pkgs.backplane-dns-server;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd = {
|
|
tmpfiles.rules = [
|
|
"d ${powerdns-conf-dir} 0700 ${cfg.powerdns.user} - - -"
|
|
];
|
|
|
|
targets = {
|
|
backplane-dns = {
|
|
description = "Fudo DNS backplane services.";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = cfg.required-services ++ [ "postgresql.service" ];
|
|
};
|
|
};
|
|
|
|
services = {
|
|
backplane-powerdns = let
|
|
pdns-config-dir = pkgs.writeTextDir "pdns.conf" ''
|
|
local-address=${lib.concatStringsSep ", " cfg.listen-v4-addresses}
|
|
local-ipv6=${lib.concatStringsSep ", " cfg.listen-v6-addresses}
|
|
local-port=${toString cfg.port}
|
|
launch=
|
|
include-dir=${powerdns-conf-dir}/
|
|
'';
|
|
in {
|
|
description = "Backplane PowerDNS name server";
|
|
requires = [
|
|
"postgresql.service"
|
|
"backplane-powerdns-config-generator.service"
|
|
];
|
|
after = [ "network.target" ];
|
|
path = with pkgs; [ powerdns postgresql ];
|
|
serviceConfig = {
|
|
ExecStart = "pdns_server --setuid=${cfg.powerdns.user} --setgid=${cfg.powerdns.user} --chroot=${cfg.powerdns.home} --socket-dir=/ --daemon=no --guardian=no --disable-syslog --write-pid=no --config-dir=${pdns-config-dir}";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|