Berwn
848c4ec47d
The control/ns1/ns2 mesh IPs and the /88 subnet were duplicated literals in mesh-hosts.nix. clan-core's zerotier generator already writes each machine's IP as a public var (vars/per-machine/<m>/zerotier/zerotier-ip), so read from there and derive the subnet from zerotier-network-id. Pure refactor: the rendered values are identical and the system derivation hash is unchanged.
84 lines
2.0 KiB
Nix
84 lines
2.0 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
let
|
|
# ZeroTier addresses — zone transfers run over the mesh, not the public net.
|
|
mesh = import ../mesh-hosts.nix { inherit config lib; };
|
|
ns1zt = mesh.hosts.ns1;
|
|
ns2zt = mesh.hosts.ns2;
|
|
in
|
|
{
|
|
# Shared TSIG key, generated once and copied to every machine that imports
|
|
# this module, so primary and secondary authenticate transfers with the same key.
|
|
clan.core.vars.generators.dns-tsig = {
|
|
share = true;
|
|
files."tsig.conf" = {
|
|
secret = true;
|
|
# knotd drops to the "knot" user, so the included key must be readable by it.
|
|
owner = "knot";
|
|
group = "knot";
|
|
};
|
|
runtimeInputs = [ pkgs.knot-dns ];
|
|
script = ''
|
|
keymgr -t cnx_xfr hmac-sha256 > "$out"/tsig.conf
|
|
'';
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
|
|
# knot binds 0.0.0.0@53 and ::@53, so free port 53 by disabling the
|
|
# systemd-resolved stub listener. Resolution still works via nss-resolve.
|
|
services.resolved.extraConfig = "DNSStubListener=no";
|
|
|
|
services.knot = {
|
|
enable = true;
|
|
# Including the key via keyFiles keeps the secret out of the Nix store.
|
|
keyFiles = [ config.clan.core.vars.generators.dns-tsig.files."tsig.conf".path ];
|
|
settings = {
|
|
server.listen = [
|
|
"0.0.0.0@53"
|
|
"::@53"
|
|
];
|
|
log = [
|
|
{
|
|
target = "syslog";
|
|
any = "info";
|
|
}
|
|
];
|
|
|
|
remote = [
|
|
{
|
|
id = "ns1";
|
|
address = [ ns1zt ];
|
|
key = "cnx_xfr";
|
|
}
|
|
{
|
|
id = "ns2";
|
|
address = [ ns2zt ];
|
|
key = "cnx_xfr";
|
|
}
|
|
];
|
|
|
|
acl = [
|
|
{
|
|
id = "acl_ns1";
|
|
address = [ ns1zt ];
|
|
key = "cnx_xfr";
|
|
action = [
|
|
"transfer"
|
|
"notify"
|
|
];
|
|
}
|
|
{
|
|
id = "acl_ns2";
|
|
address = [ ns2zt ];
|
|
key = "cnx_xfr";
|
|
action = [
|
|
"transfer"
|
|
"notify"
|
|
];
|
|
}
|
|
];
|
|
};
|
|
};
|
|
}
|