1 files changed, 92 insertions, 0 deletions

diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
new file mode 100644
index 00000000..ce909b72
--- /dev/null
+++ b/hosts/surtr/dns/default.nix
@@ -0,0 +1,92 @@
+{...}:
+{
+  config = {
+    fileSystems."/var/lib/knot" =
+      { device = "surtr/safe/var-lib-knot";
+        fsType = "zfs";
+      };
+
+    systemd.services.knot.unitConfig.RequiresMountsFor = [ "/var/lib/knot" ];
+
+    networking.firewall = {
+      allowedTCPPorts = [
+        53 # DNS
+      ];
+      allowedUDPPorts = [
+        53 # DNS
+      ];
+    };
+    
+    services.knot = {
+      enable = true;
+      extraConfig = ''
+        server:
+          listen: 127.0.0.1@53
+          listen: ::1@53
+          listen: 202.61.241.61@53
+          listen: 2a03:4000:52:ada::@53
+
+        remote:
+          - id: inwx_notify
+            address: 185.181.104.96@53
+
+        acl:
+          - id: inwx_acl
+            address: 185.181.104.96
+            action: transfer
+
+        template:
+          - id: inwx_zone
+            storage: /var/lib/knot
+            zonefile-sync: -1
+            zonefile-load: difference-no-serial
+            serial-policy: dateserial
+            journal-content: all
+            semantic-checks: on
+            dnssec-signing: on
+            notify: [inwx_notify]
+            acl: [inwx_acl]
+
+        policy:
+          - id: rsa
+            algorithm: rsasha256
+            ksk-size: 4096
+            zsk-size: 2048
+            zsk-lifetime: 30d
+
+        zone:
+          - domain: yggdrasil.li
+            template: inwx_zone
+            file: ${./zones/li.yggdrasil.soa}
+
+          - domain: nights.email
+            template: inwx_zone
+            file: ${./zones/email.nights.soa}
+
+          - domain: 141.li
+            template: inwx_zone
+            file: ${./zones/li.141.soa}
+
+          - domain: kleen.li
+            template: inwx_zone
+            file: ${./zones/li.kleen.soa}
+
+          - domain: xmpp.li
+            template: inwx_zone
+            file: ${./zones/li.xmpp.soa}
+
+          - domain: dirty-haskell.org
+            template: inwx_zone
+            file: ${./zones/org.dirty-haskell.soa}
+
+          - domain: praseodym.org
+            template: inwx_zone
+            file: ${./zones/org.praseodym.soa}
+
+          - domain: rheperire.org
+            template: inwx_zone
+            file: ${./zones/org.rheperire.soa}
+      '';
+    };
+  };
+}