Merge pull request #2790 from ehmry/unbound

unbound: update from 1.4.21 to 1.4.22, service from Upstart to systemd

lib/maintainers.nix

@@ -33,7 +33,7 @@
   ederoyd46 = "Matthew Brown <matt@ederoyd.co.uk>";
   edwtjo = "Edward Tjörnhammar <ed@cflags.cc>";
   eelco = "Eelco Dolstra <eelco.dolstra@logicblox.com>";
-  emery = "Emery Hemingawy <emery@vfemail.net>";
+  emery = "Emery Hemingway <emery@vfemail.net>";
   ertes = "Ertugrul Söylemez <ertesx@gmx.de>";
   falsifian = "James Cook <james.cook@utoronto.ca>";
   fuuzetsu = "Mateusz Kowalczyk <fuuzetsu@fuuzetsu.co.uk>";

nixos/modules/services/networking/unbound.nix

@@ -18,25 +18,25 @@ let
     "forward-zone:\n  name: .\n" +
     concatMapStrings (x: "  forward-addr: ${x}\n") cfg.forwardAddresses;
 
-  confFile = pkgs.writeText "unbound.conf"
+  confFile = pkgs.writeText "unbound.conf" ''
-    ''
+    server:
-      server:
+      directory: "${stateDir}"
-        directory: "${stateDir}"
+      username: ${username}
-        username: ${username}
+      # make sure unbound can access entropy from inside the chroot.
-        # make sure unbound can access entropy from inside the chroot.
+      # e.g. on linux the use these commands (on BSD, devfs(8) is used):
-        # e.g. on linux the use these commands (on BSD, devfs(8) is used):
+      #      mount --bind -n /dev/random /etc/unbound/dev/random
-        #      mount --bind -n /dev/random /etc/unbound/dev/random
+      # and  mount --bind -n /dev/log /etc/unbound/dev/log
-        # and  mount --bind -n /dev/log /etc/unbound/dev/log
+      chroot: "${stateDir}"
-        chroot: "${stateDir}"
+      # logfile: "${stateDir}/unbound.log"  #uncomment to use logfile.
-        # logfile: "${stateDir}/unbound.log"  #uncomment to use logfile.
+      pidfile: "${stateDir}/unbound.pid"
-        pidfile: "${stateDir}/unbound.pid"
+      verbosity: 1      # uncomment and increase to get more logging.
-        verbosity: 1      # uncomment and increase to get more logging.
-        # listen on all interfaces, answer queries from the local subnet.
       ${interfaces}
       ${access}
-      ${forward}
+
-      ${cfg.extraConfig}
+    ${forward}
-    '';
+
+    ${cfg.extraConfig}
+  '';
 
 in
 
@@ -45,74 +45,61 @@ in
   ###### interface
 
   options = {
-
     services.unbound = {
 
       enable = mkOption {
-        default = false;
+	default = false;
-        description = "
+	description = "Whether to enable the Unbound domain name server.";
-          Whether to enable the Unbound domain name server.
-        ";
       };
 
       allowedAccess = mkOption {
-        default = ["127.0.0.0/24"];
+	default = ["127.0.0.0/24"];
-        description = "
+	description = "What networks are allowed to use unbound as a resolver.";
-          What networks are allowed to use us as a resolver.
-        ";
       };
 
       interfaces = mkOption {
-        default = [ "127.0.0.0" "::1" ];
+	default = [ "127.0.0.1" "::1" ];
-        description = "
+	description = "What addresses the server should listen on.";
-          What addresses the server should listen to.
-        ";
       };
 
       forwardAddresses = mkOption {
-        default = [ ];
+	default = [ ];
-        description = "
+	description = "What servers to forward queries to.";
-          What servers to forward the queries to.
-        ";
       };
 
       extraConfig = mkOption {
-        default = "";
+	default = "";
-        description = "
+	description = "Extra lines of unbound config.";
-          Extra unbound config
-        ";
       };
 
     };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ pkgs.unbound ];
+
+    users.extraUsers = singleton {
+      name = username;
+      uid = config.ids.uids.unbound;
+      description = "unbound daemon user";
+      home = stateDir;
+      createHome = true;
+    };
+
+    systemd.services.unbound = {
+      description="Unbound recursive Domain Name Server";
+      after = [ "network.target" ];
+      before = [ "nss-lookup.target" ];
+      wants = [" nss-lookup.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      path = [ pkgs.unbound ];
+      serviceConfig.ExecStart = "${pkgs.unbound}/sbin/unbound -d -c ${confFile}";
+    };
 
   };
 
-
-  ###### implementation
-
-  config = mkIf config.services.unbound.enable {
-    environment.systemPackages = [ pkgs.unbound ];
-
-    users.extraUsers = singleton
-      { name = username;
-        uid = config.ids.uids.unbound;
-        description = "unbound daemon user";
-        home = "/tmp";
-      };
-
-    jobs.unbound =
-      { description = "Unbound name server job";
-
-        preStart =
-          ''
-            ${pkgs.coreutils}/bin/mkdir -p ${stateDir}
-          '';
-
-        daemonType = "fork";
-
-        exec = "${pkgs.unbound}/sbin/unbound -c ${confFile}";
-      };
-
-  };
-
 }

pkgs/tools/networking/unbound/default.nix

@@ -1,22 +1,23 @@
-{ stdenv, fetchurl, openssl, expat, libevent, ldns }:
+{ stdenv, fetchurl, openssl, expat, libevent }:
 
 stdenv.mkDerivation rec {
-  name = "unbound-1.4.21";
+  name = "unbound-1.4.22";
 
   src = fetchurl {
     url = "http://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "0w09m2rbn688rsk37k5xm3vkk5h2hxhivsr374j7h7vjf9x82bsh";
+    sha256 = "17yjly9c00zfgbzvllqzjh668a4yk6vrinf47yrcs3hrna0m1bqw";
   };
  
-  buildInputs = [openssl expat libevent ldns];
+  buildInputs = [openssl expat libevent];
 
   configureFlags = [ "--with-ssl=${openssl}" "--with-libexpat=${expat}"
     "--localstatedir=/var" ];
 
   meta = {
     description = "Validating, recursive, and caching DNS resolver";
-    license = "BSD";
+    license = stdenv.lib.licenses.bsd3;
     homepage = http://www.unbound.net;
-    platforms = with stdenv.lib.platforms; linux;
+    maintainers = [ stdenv.lib.maintainers.emery ];
+    platforms = stdenv.lib.platforms.unix;
   };
 }