Berwn
48fcc3058b
Bump clan-core and nixos-mailserver to 26.05 (NixOS 26.05) and adapt to
the breaking changes surfaced by nix flake check:
- mesh-hosts/clan.nix: read the new shared, instance-scoped zerotier vars
(zerotier-ip-<machine>-zerotier, zerotier-network-zerotier); admit
external members via the controller's native allowedIds.
- monitoring/server.nix: Grafana lost its built-in secret_key default;
mint one via a clan generator and pass it with $__file{}.
- dns/authoritative.nix: services.resolved.extraConfig removed -> settings.
- mail.nix: SNM cert API change (x509.useACMEHost + acme extraDomainNames)
and accounts/dkim option renames.
- docs: mesh runbook updated for the new var paths and allowedIds.
89 lines
2.0 KiB
Nix
89 lines
2.0 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
# ZeroTier addresses — zone transfers run over the mesh, not the public net.
|
|
mesh = import ../mesh-hosts.nix { inherit config lib; };
|
|
ns1zt = mesh.hosts.ns1;
|
|
ns2zt = mesh.hosts.ns2;
|
|
in
|
|
{
|
|
# Shared TSIG key, generated once and copied to every machine that imports
|
|
# this module, so primary and secondary authenticate transfers with the same key.
|
|
clan.core.vars.generators.dns-tsig = {
|
|
share = true;
|
|
files."tsig.conf" = {
|
|
secret = true;
|
|
# knotd drops to the "knot" user, so the included key must be readable by it.
|
|
owner = "knot";
|
|
group = "knot";
|
|
};
|
|
runtimeInputs = [ pkgs.knot-dns ];
|
|
script = ''
|
|
keymgr -t cnx_xfr hmac-sha256 > "$out"/tsig.conf
|
|
'';
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
|
|
# knot binds 0.0.0.0@53 and ::@53, so free port 53 by disabling the
|
|
# systemd-resolved stub listener. Resolution still works via nss-resolve.
|
|
services.resolved.settings.Resolve.DNSStubListener = "no";
|
|
|
|
services.knot = {
|
|
enable = true;
|
|
# Including the key via keyFiles keeps the secret out of the Nix store.
|
|
keyFiles = [ config.clan.core.vars.generators.dns-tsig.files."tsig.conf".path ];
|
|
settings = {
|
|
server.listen = [
|
|
"0.0.0.0@53"
|
|
"::@53"
|
|
];
|
|
log = [
|
|
{
|
|
target = "syslog";
|
|
any = "info";
|
|
}
|
|
];
|
|
|
|
remote = [
|
|
{
|
|
id = "ns1";
|
|
address = [ ns1zt ];
|
|
key = "cnx_xfr";
|
|
}
|
|
{
|
|
id = "ns2";
|
|
address = [ ns2zt ];
|
|
key = "cnx_xfr";
|
|
}
|
|
];
|
|
|
|
acl = [
|
|
{
|
|
id = "acl_ns1";
|
|
address = [ ns1zt ];
|
|
key = "cnx_xfr";
|
|
action = [
|
|
"transfer"
|
|
"notify"
|
|
];
|
|
}
|
|
{
|
|
id = "acl_ns2";
|
|
address = [ ns2zt ];
|
|
key = "cnx_xfr";
|
|
action = [
|
|
"transfer"
|
|
"notify"
|
|
];
|
|
}
|
|
];
|
|
};
|
|
};
|
|
}
|