3 files changed, 30 insertions, 65 deletions

diff --git a/hosts/vidhar/dns/default.nix b/hosts/vidhar/dns/default.nix
index 11e6f55f..14d212e7 100644
--- a/hosts/vidhar/dns/default.nix
+++ b/hosts/vidhar/dns/default.nix
@@ -12,73 +12,36 @@ let
   in filter (v: v != null) (mapAttrsToList toKeyInfo (builtins.readDir dir));
 in {
   config = {
-    services.unbound = {
+    services.knot-resolver = {
       enable = true;
-      resolveLocalQueries = false;
-      stateDir = "/var/lib/unbound";
-      localControlSocketPath = "/run/unbound/unbound.ctl";
-      enableRootTrustAnchor = false;
       settings = {
-        server = {
-          interface = ["lo" "lan"];
-          prefer-ip6 = true;
-          access-control = ["0.0.0.0/0 allow" "::/0 allow"];
-          root-hints = "${pkgs.dns-root-data}/root.hints";
-          trust-anchor-file = "${pkgs.dns-root-data}/root.key";
-          trust-anchor-signaling = false;
-          ip-dscp = 20;
-
-          num-threads = 12;
-          so-reuseport = true;
-          msg-cache-slabs = 16;
-          rrset-cache-slabs = 16;
-          infra-cache-slabs = 16;
-          key-cache-slabs = 16;
-
-          rrset-cache-size = "100m";
-          msg-cache-size = "50m";
-          outgoing-range = 8192;
-          num-queries-per-thread = 4096;
-
-          so-rcvbuf = "4m";
-          so-sndbuf = "4m";
-
-          # serve-expired = true;
-          # serve-expired-ttl = 86400;
-          # serve-expired-reply-ttl = 0;
-
-          prefetch = true;
-          prefetch-key = true;
-
-          minimal-responses = false;
-
-          extended-statistics = true;
-
-          rrset-roundrobin = true;
-          use-caps-for-id = true;
-
-          do-not-query-localhost = false;
-          local-zone = [
-            "141.10.in-addr.arpa. transparent"
-            "1.0.0.0.a.d.a.0.2.5.0.0.0.0.0.4.3.0.a.2.ip6.arpa. transparent"
-            "yggdrasil. transparent"
-          ];
-          domain-insecure = [
-            "141.10.in-addr.arpa."
-            "1.0.0.0.a.d.a.0.2.5.0.0.0.0.0.4.3.0.a.2.ip6.arpa."
-            "yggdrasil."
-          ];
-        };
-
-        stub-zone = map (name: {
-          inherit name;
-          stub-addr = "127.0.0.1@5353";
-          stub-first = true;
-          stub-no-cache = true;
-          stub-prime = false;
-        }) ["yggdrasil." "arpa.in-addr.10.141." "1.0.0.0.a.d.a.0.2.5.0.0.0.0.0.4.3.0.a.2.ip6.arpa."];
+        network.listen = [
+          { interface = "lo"; }
+          { interface = "lan"; freebind = true; }
+        ];
+        forward = [
+          {
+            subtree = "yggdrasil.";
+            servers = [ { address = "::1@5353"; } ];
+            options.dnssec = false;
+          }
+          {
+            subtree = "141.10.in-addr.arpa.";
+            servers = [ { address = "::1@5353"; } ];
+            options.dnssec = false;
+          }
+          {
+            subtree = "1.0.0.0.a.d.a.0.2.5.0.0.0.0.0.4.3.0.a.2.ip6.arpa.";
+            servers = [ { address = "::1@5353"; } ];
+            options.dnssec = false;
+          }
+        ];
       };
     };
+    fileSystems."/var/cache/knot-resolver" = {
+      fsType = "tmpfs";
+      options = [ "size=200M" "nosuid" "nodev" "noexec" "mode=0700" ];
+    };
 
     systemd.services.knot = {
       unitConfig.RequiresMountsFor = [ "/var/lib/knot" ];
diff --git a/hosts/vidhar/dns/zones/arpa.ip6.2.a.0.3.4.0.0.0.0.0.5.2.0.a.d.a.0.0.0.1.soa b/hosts/vidhar/dns/zones/arpa.ip6.2.a.0.3.4.0.0.0.0.0.5.2.0.a.d.a.0.0.0.1.soa
index 2d94b1e1..2613bbb7 100644
--- a/hosts/vidhar/dns/zones/arpa.ip6.2.a.0.3.4.0.0.0.0.0.5.2.0.a.d.a.0.0.0.1.soa
+++ b/hosts/vidhar/dns/zones/arpa.ip6.2.a.0.3.4.0.0.0.0.0.5.2.0.a.d.a.0.0.0.1.soa
@@ -1,7 +1,7 @@
 $ORIGIN 1.0.0.0.a.d.a.0.2.5.0.0.0.0.0.4.3.0.a.2.ip6.arpa.
 $TTL 300
 @ IN SOA vidhar.lan.yggdrasil. hostmaster.yggdrasil.li (
-  2023030501 ; serial
+  2026092400 ; serial
   300        ; refresh
   300        ; retry
   300        ; expire
@@ -13,3 +13,4 @@ $TTL 300
 0.0.0.0.0.0.0.0.0.0.0.0 IN      PTR     surtr.yggdrasil.
 0.0.0.0.0.0.0.0.0.0.0.1 IN      PTR     vidhar.yggdrasil.
 0.0.0.0.0.0.0.0.0.0.0.2 IN      PTR     sif.yggdrasil.
+0.0.0.0.0.0.0.0.0.0.0.3 IN      PTR     skadhi.yggdrasil.
diff --git a/hosts/vidhar/dns/zones/yggdrasil.soa b/hosts/vidhar/dns/zones/yggdrasil.soa
index dede06ac..1cb6b75c 100644
--- a/hosts/vidhar/dns/zones/yggdrasil.soa
+++ b/hosts/vidhar/dns/zones/yggdrasil.soa
@@ -1,7 +1,7 @@
 $ORIGIN yggdrasil.
 $TTL 300
 @ IN SOA vidhar.yggdrasil. hostmaster.yggdrasil.li (
-  2024070901 ; serial
+  2026092400 ; serial
   300        ; refresh
   300        ; retry
   300        ; expire
@@ -13,6 +13,7 @@ $TTL 300
 surtr           IN      AAAA    2a03:4000:52:ada:1::
 vidhar          IN      AAAA    2a03:4000:52:ada:1:1::
 sif             IN      AAAA    2a03:4000:52:ada:1:2::
+skadhi          IN      AAAA    2a03:4000:52:ada:1:3::
 
 grafana.vidhar          IN      CNAME   vidhar.yggdrasil.
 prometheus.vidhar       IN      CNAME   vidhar.yggdrasil.