Add authoritative DNS on ns1/ns2 and finalize clan config

- Knot authoritative DNS: ns1 primary, ns2 secondary serving cnx.network, buildfor.life and cnx.email over TSIG-secured zone transfer (modules/dns) - Knot listens publicly + over ZeroTier; firewall opens port 53 - Complete clan inventory: name/domain, admin SSH key, control as the zerotier controller, tor on all nixos machines - Enable age yubikey/fido2-hmac secret plugins
2026-06-14 13:24:23 +07:00
parent 9f1a2861ce
commit 807785cdab
9 changed files with 146 additions and 36 deletions
@@ -0,0 +1,41 @@
+{ config, pkgs, ... }:
+let
+  # ZeroTier addresses — zone transfers run over the mesh, not the public net.
+  ns1zt = "fd06:1bad:ece2:92ad:ba99:939d:766d:8974";
+  ns2zt = "fd06:1bad:ece2:92ad:ba99:9323:61be:a09e";
+in
+{
+  # Shared TSIG key, generated once and copied to every machine that imports
+  # this module, so primary and secondary authenticate transfers with the same key.
+  clan.core.vars.generators.dns-tsig = {
+    share = true;
+    files."tsig.conf".secret = true;
+    runtimeInputs = [ pkgs.knot-dns ];
+    script = ''
+      keymgr -t cnx_xfr hmac-sha256 > "$out"/tsig.conf
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ 53 ];
+  networking.firewall.allowedUDPPorts = [ 53 ];
+
+  services.knot = {
+    enable = true;
+    # Including the key via keyFiles keeps the secret out of the Nix store.
+    keyFiles = [ config.clan.core.vars.generators.dns-tsig.files."tsig.conf".path ];
+    settings = {
+      server.listen = [ "0.0.0.0@53" "::@53" ];
+      log = [ { target = "syslog"; any = "info"; } ];
+
+      remote = [
+        { id = "ns1"; address = [ ns1zt ]; key = "cnx_xfr"; }
+        { id = "ns2"; address = [ ns2zt ]; key = "cnx_xfr"; }
+      ];
+
+      acl = [
+        { id = "acl_ns1"; address = [ ns1zt ]; key = "cnx_xfr"; action = [ "transfer" "notify" ]; }
+        { id = "acl_ns2"; address = [ ns2zt ]; key = "cnx_xfr"; action = [ "transfer" "notify" ]; }
+      ];
+    };
+  };
+}
@@ -0,0 +1,7 @@
+# Public zones served authoritatively by ns1 (primary) and ns2 (secondary).
+# Add a domain here AND drop a matching <domain>.zone file in ./zones/.
+[
+  "cnx.network"
+  "buildfor.life"
+  "cnx.email"
+]
@@ -0,0 +1,17 @@
+$ORIGIN buildfor.life.
+$TTL 3600
+
+@   IN  SOA ns1.cnx.network. hostmaster.cnx.network. (
+        2026061401  ; serial   (bump on every edit: YYYYMMDDnn)
+        3600        ; refresh
+        900         ; retry
+        604800      ; expire
+        300 )       ; negative-cache TTL
+
+; Served by the same nameservers (out-of-bailiwick, no glue needed here).
+@       IN  NS      ns1.cnx.network.
+@       IN  NS      ns2.cnx.network.
+
+; ---- Web / apex (fill in once you have a web host) ----
+;@      IN  A       <web-ipv4>
+;www    IN  CNAME   buildfor.life.
@@ -0,0 +1,18 @@
+$ORIGIN cnx.email.
+$TTL 3600
+
+@   IN  SOA ns1.cnx.network. hostmaster.cnx.network. (
+        2026061401  ; serial   (bump on every edit: YYYYMMDDnn)
+        3600        ; refresh
+        900         ; retry
+        604800      ; expire
+        300 )       ; negative-cache TTL
+
+@       IN  NS      ns1.cnx.network.
+@       IN  NS      ns2.cnx.network.
+
+; ---- Mail (fill in once the mail host exists) ----
+;@      IN  MX 10   mail.cnx.email.
+;mail   IN  A       <mail-ipv4>
+;@      IN  TXT     "v=spf1 mx -all"
+;_dmarc IN  TXT     "v=DMARC1; p=quarantine; rua=mailto:postmaster@cnx.email"
@@ -0,0 +1,26 @@
+$ORIGIN cnx.network.
+$TTL 3600
+
+@   IN  SOA ns1.cnx.network. hostmaster.cnx.network. (
+        2026061402  ; serial   (bump on every edit: YYYYMMDDnn)
+        3600        ; refresh
+        900         ; retry
+        604800      ; expire
+        300 )       ; negative-cache TTL
+
+; ---- Nameservers (used by every zone we serve) ----
+@       IN  NS      ns1.cnx.network.
+@       IN  NS      ns2.cnx.network.
+
+; ---- Glue for the nameservers ----
+ns1     IN  A       46.224.170.206
+ns1     IN  AAAA    fd06:1bad:ece2:92ad:ba99:939d:766d:8974
+ns2     IN  A       157.180.70.82
+ns2     IN  AAAA    fd06:1bad:ece2:92ad:ba99:9323:61be:a09e
+
+; ---- control (ZeroTier controller) ----
+control IN  AAAA    fd06:1bad:ece2:92ad:ba99:9306:1bad:ece2
+
+; ---- Web / apex (fill in once you have a web host) ----
+;@      IN  A       <web-ipv4>
+;www    IN  CNAME   cnx.network.