foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-02-07 12:19:07 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

hosts/plover: enable DNS-over-HTTPS for Bind server

Browse Source
This commit is contained in:
Gabriel Arazas 2023-09-21 11:36:43 +08:00
parent eed4160b85
commit 0eb19acc40
No known key found for this signature in database
GPG Key ID: ADE0C41DAB221FCC
2 changed files with 60 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hosts/plover/config/dns/foodogsquared.one.zone
View File

@ -4,7 +4,7 @@ $TTL 12h
$ORIGIN foodogsquared.one. $ORIGIN foodogsquared.one.
@ 3600 IN SOA ns1 hostmaster ( @ 3600 IN SOA ns1 hostmaster (
2023072701 ; serial number 2023092001 ; serial number
1h ; refresh 1h ; refresh
15m ; update retry 15m ; update retry
3w ; expiry 3w ; expiry
@ -64,6 +64,8 @@ code IN CNAME plover
vpn IN CNAME plover vpn IN CNAME plover
mux IN CNAME plover mux IN CNAME plover
ns1 IN CNAME plover
postgres IN CNAME plover postgres IN CNAME plover
; Other things. ; Other things.

65
hosts/plover/modules/services/bind.nix
View File

@ -29,6 +29,7 @@ let
zoneFile = domain: "${zonesDir}/${domain}.zone"; zoneFile = domain: "${zonesDir}/${domain}.zone";
dnsSubdomain = "ns1.${domain}"; dnsSubdomain = "ns1.${domain}";
dnsOverHTTPSPort = 8443;
in in
{ {
sops.secrets = sops.secrets =
@ -79,6 +80,8 @@ in
let let
cfg = config.services.bind; cfg = config.services.bind;
certDir = path: "${config.security.acme.certs."${dnsSubdomain}".directory}/${path}"; certDir = path: "${config.security.acme.certs."${dnsSubdomain}".directory}/${path}";
listenInterfaces = lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn;
listenInterfacesIpv6 = lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6;
in in
pkgs.writeText "named.conf" '' pkgs.writeText "named.conf" ''
include "/etc/bind/rndc.key"; include "/etc/bind/rndc.key";
@ -97,15 +100,28 @@ in
session-tickets no; session-tickets no;
}; };
http ${dnsSubdomain} {
endpoints { "/dns-query"; };
};
acl trusted { ${lib.concatStringsSep "; " (clientNetworks ++ serverNetworks)}; localhost; }; acl trusted { ${lib.concatStringsSep "; " (clientNetworks ++ serverNetworks)}; localhost; };
acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} }; acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} };
acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} }; acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} };
options { options {
listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} }; # Native DNS.
listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} }; listen-on { ${listenInterfaces} };
listen-on tls ${dnsSubdomain} { ${lib.concatMapStrings (interface: "${interface}; ") cfg.listenOn} }; listen-on-v6 { ${listenInterfacesIpv6} };
listen-on-v6 tls ${dnsSubdomain} { ${lib.concatMapStrings (interface: "${interface}; ") cfg.listenOnIpv6} };
# DNS-over-TLS.
listen-on tls ${dnsSubdomain} { ${listenInterfaces} };
listen-on-v6 tls ${dnsSubdomain} { ${listenInterfacesIpv6} };
# DNS-over-HTTPS.
https-port ${dnsOverHTTPSPort};
listen-on tls ${dnsSubdomain} http ${dnsSubdomain} { ${listenInterfaces} };
listen-on-v6 tls ${dnsSubdomain} http ${dnsSubdomain} { ${listenInterfacesIpv6} };
allow-query { cachenetworks; }; allow-query { cachenetworks; };
blackhole { badnetworks; }; blackhole { badnetworks; };
forward ${cfg.forward}; forward ${cfg.forward};
@ -242,13 +258,46 @@ in
}; };
}; };
# Set up the firewall. # Set up the firewall. Take note the ports with the transport layer being
networking.firewall = { # accepted in Bind.
allowedUDPPorts = [ networking.firewall = let
ports = [
53 # DNS 53 # DNS
853 # DNS-over-TLS/DNS-over-QUIC 853 # DNS-over-TLS/DNS-over-QUIC
dnsOverHTTPSPort
]; ];
allowedTCPPorts = [ 53 853 ]; in {
allowedUDPPorts = ports;
allowedTCPPorts = ports;
};
# Making this with nginx.
services.nginx.upstreams.local-dns = {
extraConfig = ''
zone dns 64k;
'';
servers = {
"127.0.0.1:${dnsOverHTTPSPort}" = { };
};
};
services.nginx.virtualHosts."${dnsSubdomain}" = {
forceSSL = true;
enableACME = true;
acmeRoot = null;
extraConfig = ''
add_header Strict-Transport-Security max-age=31536000;
'';
locations = {
"/".return = "404";
"/dns-query".extraConfig = ''
grpc_pass grpcs://local-dns;
grpc_socket_keepalive on;
grpc_connect_timeout 10s;
grpc_ssl_verify off;
grpc_ssl_protocols TLSv1.3 TLSv1.2;
'';
};
}; };
# Setting up DNS-over-TLS by generating a certificate. # Setting up DNS-over-TLS by generating a certificate.