foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-02-07 12:19:07 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

hosts/plover: update Bind config for dynamic updates

Browse Source
This commit is contained in:
Gabriel Arazas 2023-06-27 22:56:18 +08:00
parent df589b1915
commit d98527c89b
No known key found for this signature in database
GPG Key ID: ADE0C41DAB221FCC
5 changed files with 66 additions and 59 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hosts/plover/config/dns/foodogsquared.one.zone
View File

@ -3,8 +3,8 @@
$TTL 12h
$ORIGIN foodogsquared.one.
@ 3600 IN SOA ns1.first-ns.de. hostmaster.foodogsquared.one. (
2023062201 ; serial number
@ 3600 IN SOA ns1 hostmaster (
2023062601 ; serial number
1h ; refresh
15m ; update retry
3w ; expiry

4
hosts/plover/default.nix
View File

@ -133,10 +133,10 @@ in
# DNS-related settings. We're settling by configuring the ACME setup with a
# self-hosted DNS server.
security.acme.defaults = {
email = "admin@foodogsquared.one";
email = "admin+acme@foodogsquared.one";
dnsProvider = "rfc2136";
dnsResolver = "1.1.1.1";
credentialsFile = config.sops.secrets."plover/lego/env".path;
dnsPropagationCheck = false;
};
services.openssh.hostKeys = [{

108
hosts/plover/modules/services/bind.nix
View File

@ -14,6 +14,8 @@ let
(lib.attrValues secondaryNameServers);
secondaryNameServersIPs = secondaryNameServersIPv4 ++ secondaryNameServersIPv6;
serviceUser = config.users.users.named.name;
domainZone = pkgs.substituteAll {
src = ../../config/dns/${domain}.zone;
ploverWANIPv4 = interfaces.wan.IPv4.address;
@ -26,7 +28,7 @@ let
ploverLANIPv6 = interfaces.lan.IPv6.address;
};
zonesDir = "/var/db/dns";
zonesDir = "/etc/bind/zones";
zoneFile = domain: "${zonesDir}/${domain}.zone";
localhostIP = [
@ -48,6 +50,8 @@ let
"::1" # Loopback
"${privateIPv6Prefix}::/48" # Private uses
];
internalsACL = clientNetworks ++ serverNetworks;
in
{
sops.secrets =
@ -67,16 +71,26 @@ in
getSecrets {
"dns/${domain}/mailbox-security-key" = { };
"dns/${domain}/mailbox-security-key-record" = { };
"dns/${domain}/rfc2136-key" = {
owner = serviceUser;
group = "root";
reloadUnits = [ "bind.service" ];
mode = "0400";
};
};
networking.nameservers = localhostIP;
environment.etc."bind/named.conf".source = config.services.bind.configFile;
# Install the utilities.
environment.systemPackages = [ config.services.bind.package ];
services.bind = {
enable = true;
forward = "first";
forwarders = [ "127.0.0.53 port 53" ];
cacheNetworks = [
"127.0.0.1"
"::1"
];
listenOn = [
"127.0.0.1"
@ -91,58 +105,50 @@ in
];
extraConfig = ''
acl internals { ${lib.concatStringsSep "; " (clientNetworks ++ serverNetworks ++ [ "127.0.0.0/8" "::1" ])}; };
'';
include "${config.sops.secrets."plover/dns/${domain}/rfc2136-key".path}";
acl trusted { ${lib.concatStringsSep "; " internalsACL}; localhost; };
extraOptions = ''
allow-recursion { internals; };
empty-zones-enable yes;
'';
view external {
match-clients { any; };
zones = {
"${config.networking.domain}" = {
file = zoneFile domain;
allowQuery = allowedLANIPs ++ allowedLANIPv6s;
master = true;
slaves = secondaryNameServersIPs;
extraConfig = ''
forwarders { };
update-policy local;
'';
forwarders { };
empty-zones-enable yes;
allow-query { any; };
allow-recursion { none; };
zone "${domain}" {
type primary;
file "${zoneFile domain}";
allow-transfer { ${lib.concatStringsSep "; " secondaryNameServersIPs}; };
update-policy {
grant rfc2136key.${domain}. zonesub TXT;
};
};
};
"${config.networking.fqdn}" = {
file = zoneFile fqdn;
master = true;
allowQuery = allowedLANIPs ++ allowedLANIPv6s;
slaves = [ "none" ];
view internal {
match-clients { trusted; };
allow-recursion { any; };
forwarders { 127.0.0.53 port 53; };
zone "${fqdn}" {
type primary;
file "${zoneFile fqdn}";
};
zone "${domain}" {
in-view external;
};
};
};
'';
};
networking.firewall.extraInputRules =
let
allowedIPs = secondaryNameServersIPv4 ++ allowedLANIPs;
allowedIPv6s = secondaryNameServersIPv6 ++ allowedLANIPv6s;
in
''
meta l4proto {tcp, udp} th dport domain ip saddr { ${lib.concatStringsSep ", " allowedIPs} } accept comment "Accept DNS queries from secondary nameservers and private networks"
meta l4proto {tcp, udp} th dport domain ip6 saddr { ${lib.concatStringsSep ", " allowedIPv6s} } accept comment "Accept DNS queries from secondary nameservers and private networks"
meta l4proto {tcp, udp} th dport domain-s ip saddr { ${lib.concatStringsSep ", " allowedIPs} } accept comment "Accept DNS queries from secondary nameservers and private networks"
meta l4proto {tcp, udp} th dport domain-s ip6 saddr { ${lib.concatStringsSep ", " allowedIPv6s} } accept comment "Accept DNS queries from secondary nameservers and private networks"
'';
systemd.services.bind = {
preStart = let
secretsPath = path: config.sops.secrets."plover/${path}".path;
replaceSecretBin = "${lib.getBin pkgs.replace-secret}/bin/replace-secret";
in
lib.mkBefore ''
install -Dm0644 ${domainZone} ${zoneFile domain}
install -Dm0644 ${fqdnZone} ${zoneFile fqdn}
${replaceSecretBin} '#mailboxSecurityKey#' '${secretsPath "dns/${domain}/mailbox-security-key"}' '${zoneFile domain}'
${replaceSecretBin} '#mailboxSecurityKeyRecord#' '${secretsPath "dns/${domain}/mailbox-security-key-record"}' '${zoneFile domain}'
'';
networking.firewall ={
allowedUDPPorts = [
53 # DNS
853 # DNS-over-TLS/DNS-over-QUIC
];
allowedTCPPorts = [ 53 853 ];
};
}

7
hosts/plover/secrets/secrets.yaml
View File

@ -1,6 +1,6 @@
ssh-key: ENC[AES256_GCM,data:UgJB9WiLs1nt8e95sYeBr9XJRw16CldxBFYazppwHD0Tx0rkv9YDsqJMdrMFQJJ15UgOx61yQ2rg56KoaR4cJIqQM/7foKY3+LgdI4ePtfnbGRebIMyeqCiEVWq+a5ppwsG6B9w9liRqaOG7LpD90JpXcLKVG6Lo/YwTmwDbOBGJHhyJk2DindJ7qWly1gcys5Mm9GTZmtuz8lKG7hNVQar5lmuq1fhyOolnxlFKCLG3zfumttVnT3U1ELd3TzZIaWnNIL7SuhfZDBko3ZO4bbDj/JdX1uNKlEh2FeS7Mp/DvylFlVleoQOMI9FTes/tQHmztVaA7DllYP6gKHzvLsKX577fXeoZihrGvQiNj11qDXxcj3qhUx/8iXdyVzvy/UTGWW5/QeDGNDsrT7wlwuVmqVHb7s+9Ep6Oq9tFbDQHkRMRv/Nl3C/xxtH23RuShJ1IjxXTPu9t+AiD/qPvecXyD0iZ9OX1YJn5AM9WyPLisEFasaFbgfhF6uDS2l61oCS3LPwjdbXA8UyB7vUi,iv:1OGfGUojkL0/DS+HMbyAK0GeVKa6AuQkyRwO5txiD54=,tag:TmD3ljgWGv0SNPq8GxI/kw==,type:str]
lego:
env: ENC[AES256_GCM,data:pJPaYAuFEj8f0Rm+Quhf4T2FKmvJ5cxGPAW7TCZkl++0yMaYx7e94WKYjLmWp+OWfUQss6byZ4WiARHY0XuF7w/S41isJdObSGgeUXnoLAu9oqt9JLsVOlQABtrY45ZF,iv:J6vBXY1gi12Zy6wXM1NyGZNxuVApKWy7eJUs8WapDoE=,tag:nEoAiY7Uy92/JjJDaSJZzw==,type:str]
env: ENC[AES256_GCM,data:gmzfAQOK94baSS0nOHEX33n61kLbGRHqoAa1W+KnLsfC3RLSbtgeRXgmKfsKFwfd1czQE5Yf/ZB/eTjDSUPLfXcnt4OoiNAyJNxAoc5cpeveYIlp9WaqdSkcD+zefLPmwYDTVPyrBKS1qE8GjYBxpfObnesbwq8hxx9Tm19Z+MTB+DznYqhSFt5Yx5+VnBaeQBMKnLd3XGazRv//QnpUFvgJba0SF4mhD3I40SHKMt3enmj1M+ITIn99ELf7HG0XSCH7aGmccXraQNUnAOwdJCNXyFY/ASxoK0DLv8Um5VX6O04GZVg2y3EoGsNZkyH9T8/3jTg=,iv:iYct97YZhUcoy/C5aVmSlsHLEyPVlRP2pGdwvwTIm9w=,tag:Hf3CMJwUXY5yf0CUxPNbtQ==,type:str]
sourcehut:
network-key: ENC[AES256_GCM,data:e28WJt1POxWnCgjYG+6HdSOwhHiIArGPrGb/3pQ5o2P2R4gIuxm8YxRPg4E=,iv:44VlT5ID8KXDquDOZMIEPBWl7r+JwbamRdqhBsFO4Rw=,tag:JRTs4FRT8bBpPyetDbt6zg==,type:str]
service-key: ENC[AES256_GCM,data:glZuT+e9c2UOXieP313ny6Dl15HRXpeHtGr4XPWjhNSAvFgcwp/1AgFYrHDWZBf771MkN0pgVE/d/fx0oBOgSg==,iv:S4BzMYPZtVFhXV0g5qBxjItqCyEQ25Ct6swBut7FefQ=,tag:w3t59DqroYuAmgHlu/BhEQ==,type:str]
@ -40,6 +40,7 @@ dns:
foodogsquared.one:
mailbox-security-key: ENC[AES256_GCM,data:CmiAcewC47dTlKX+PmWJrnSM7dreMImEL3nw6+MnJ2MCwcnakT8zUw==,iv:tRh4d+QUUqxzz+c0r6NLnnPOgqtYZNdE3RgCa7MbvE4=,tag:RHkPwRVt8+YCw61RwBZZzg==,type:str]
mailbox-security-key-record: ENC[AES256_GCM,data:vXwTyZEsov20GDkg/X2P/MJFKWkrijnNNHrGRp0AMJORh0H5/mnshQ==,iv:7BKnkKj1vwLYCcm1uoHF+Ndunl2enSoXRpReW/uuaAo=,tag:KTzU1MMwXard4+Ar4WrJhA==,type:str]
rfc2136-key: ENC[AES256_GCM,data:K6CRj09oQA/po/IYfM/LH1y8Hjt/gXewUxfDcEzZVsFCYs4CEpysnhFlu6P9Srwy0lXapZI+4x4kB0mY5TarxZc5OFpx+6Xslw964x10Eot1sTFn8Y7Mrogh8VwHFXdtKuvHKkHcW2nZshBnKv0FPsy6Wvv79NUwEfc=,iv:TJiq+z552fT0vVT1WKJUUwB+oP/sUGIav1ab8G/1ENc=,tag:aqpBcdWh2i551p8aAzsUXA==,type:str]
sops:
kms: []
gcp_kms: []
@ -55,8 +56,8 @@ sops:
ZCtNbnFqdzNkVlBtNjVCdE4yNHMrRjQKfFV4GaReO0UO81xsTB0EuN5ibVsafXJY
miBgZAZWbJjSBcM4X+Fym/DlxHRoB1a6iFEFN9yg+Z9WI8PfjKnbsA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-06-22T08:57:24Z"
mac: ENC[AES256_GCM,data:Ltx4nr5Llq3txLTcK1mO1/BoOKm6O0FaQd60FMPpFtpIUhFQhPaPrDmnAB7/j1rMMCc4fg9hv2AYAx/rCCoaMy2aQmgRnjsuX8S7UfwqOYqvCVl6CJz3HeCfficDe5P2Un0BeblK1SeSJ689VXO0kAa2z8/uB5tis5cULfAIkBs=,iv:HKEN2YLM83mu4JjNWdBQGI+RX03nssZPwIdaP9iMW1I=,tag:VMHrarG2H/NPuymojxntUQ==,type:str]
lastmodified: "2023-06-27T13:01:04Z"
mac: ENC[AES256_GCM,data:4Zzgji5OsdUZL93sO00Sf6pQ9+LhUODv8YRp9o/lLiKelbZSLweAXeMCO3Zf8xLQDvd/6gQ8P6MvmDCtCmyQ4Nxlojv7cpX+H/bgN5skqIgYP+CMDoUvu99IiqK5SfGBZosG0c30x7mL42dzWIzZ8filHpX2t8lIm217OqTzEHo=,iv:VBGUmqVO1Wh/ZK+Z5kRJMI3kdqx6mbaTzZcaHcQK2/o=,tag:A52f7dRiLmMg7WSuX6URyQ==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.7.3

2
modules/nixos/profiles/server.nix
View File

@ -76,7 +76,7 @@ in
# this.
security.acme = {
acceptTerms = true;
defaults.email = "admin@foodogsquared.one";
defaults.email = "admin+acme@foodogsquared.one";
};
# We're only going to deal with servers in English.