6 files changed, 93 insertions, 278 deletions

diff --git a/hosts/vidhar/dns/default.nix b/hosts/vidhar/dns/default.nix
index 11e6f55f..14d212e7 100644
--- a/hosts/vidhar/dns/default.nix
+++ b/hosts/vidhar/dns/default.nix
@@ -12,73 +12,36 @@ let
   in filter (v: v != null) (mapAttrsToList toKeyInfo (builtins.readDir dir));
 in {
   config = {
-    services.unbound = {
+    services.knot-resolver = {
       enable = true;
-      resolveLocalQueries = false;
-      stateDir = "/var/lib/unbound";
-      localControlSocketPath = "/run/unbound/unbound.ctl";
-      enableRootTrustAnchor = false;
       settings = {
-        server = {
-          interface = ["lo" "lan"];
-          prefer-ip6 = true;
-          access-control = ["0.0.0.0/0 allow" "::/0 allow"];
-          root-hints = "${pkgs.dns-root-data}/root.hints";
-          trust-anchor-file = "${pkgs.dns-root-data}/root.key";
-          trust-anchor-signaling = false;
-          ip-dscp = 20;
-
-          num-threads = 12;
-          so-reuseport = true;
-          msg-cache-slabs = 16;
-          rrset-cache-slabs = 16;
-          infra-cache-slabs = 16;
-          key-cache-slabs = 16;
-
-          rrset-cache-size = "100m";
-          msg-cache-size = "50m";
-          outgoing-range = 8192;
-          num-queries-per-thread = 4096;
-
-          so-rcvbuf = "4m";
-          so-sndbuf = "4m";
-
-          # serve-expired = true;
-          # serve-expired-ttl = 86400;
-          # serve-expired-reply-ttl = 0;
-
-          prefetch = true;
-          prefetch-key = true;
-
-          minimal-responses = false;
-
-          extended-statistics = true;
-
-          rrset-roundrobin = true;
-          use-caps-for-id = true;
-
-          do-not-query-localhost = false;
-          local-zone = [
-            "141.10.in-addr.arpa. transparent"
-            "1.0.0.0.a.d.a.0.2.5.0.0.0.0.0.4.3.0.a.2.ip6.arpa. transparent"
-            "yggdrasil. transparent"
-          ];
-          domain-insecure = [
-            "141.10.in-addr.arpa."
-            "1.0.0.0.a.d.a.0.2.5.0.0.0.0.0.4.3.0.a.2.ip6.arpa."
-            "yggdrasil."
-          ];
-        };
-
-        stub-zone = map (name: {
-          inherit name;
-          stub-addr = "127.0.0.1@5353";
-          stub-first = true;
-          stub-no-cache = true;
-          stub-prime = false;
-        }) ["yggdrasil." "arpa.in-addr.10.141." "1.0.0.0.a.d.a.0.2.5.0.0.0.0.0.4.3.0.a.2.ip6.arpa."];
+        network.listen = [
+          { interface = "lo"; }
+          { interface = "lan"; freebind = true; }
+        ];
+        forward = [
+          {
+            subtree = "yggdrasil.";
+            servers = [ { address = "::1@5353"; } ];
+            options.dnssec = false;
+          }
+          {
+            subtree = "141.10.in-addr.arpa.";
+            servers = [ { address = "::1@5353"; } ];
+            options.dnssec = false;
+          }
+          {
+            subtree = "1.0.0.0.a.d.a.0.2.5.0.0.0.0.0.4.3.0.a.2.ip6.arpa.";
+            servers = [ { address = "::1@5353"; } ];
+            options.dnssec = false;
+          }
+        ];
       };
     };
+    fileSystems."/var/cache/knot-resolver" = {
+      fsType = "tmpfs";
+      options = [ "size=200M" "nosuid" "nodev" "noexec" "mode=0700" ];
+    };
 
     systemd.services.knot = {
       unitConfig.RequiresMountsFor = [ "/var/lib/knot" ];
diff --git a/hosts/vidhar/kimai/default.nix b/hosts/vidhar/kimai/default.nix
index 0258697b..4d1057a9 100644
--- a/hosts/vidhar/kimai/default.nix
+++ b/hosts/vidhar/kimai/default.nix
@@ -6,6 +6,10 @@
     boot.kernel.sysctl = {
       "net.netfilter.nf_log_all_netns" = true;
     };
+    systemd.network = {
+      networks."80-container-ve".enable = false;
+      links."80-container-ve".enable = false;
+    };
 
     containers."kimai" = {
       autoStart = true;
@@ -50,7 +54,7 @@
           };
         };
 
-        services.resolved.fallbackDns = [
+        services.resolved.settings.Resolve.FallbackDns = [
           "9.9.9.10#dns10.quad9.net"
           "149.112.112.10#dns10.quad9.net"
           "2620:fe::10#dns10.quad9.net"
diff --git a/hosts/vidhar/network/default.nix b/hosts/vidhar/network/default.nix
index 6fcef9d8..02a8d648 100644
--- a/hosts/vidhar/network/default.nix
+++ b/hosts/vidhar/network/default.nix
@@ -78,16 +78,29 @@ with lib;
 
     environment.etc."dnssec-trust-anchors.d/root.positive".source = "${pkgs.dns-root-data}/root.ds";
 
-    systemd.network.networks = {
-      "eno1" = {
-        matchConfig.Name = "eno1";
-        linkConfig = {
-          ActivationPolicy = "down";
+    systemd.network = {
+      networks = {
+        "eno1" = {
+          matchConfig.Name = "eno1";
+          linkConfig = {
+            ActivationPolicy = "down";
+          };
+        };
+        "eno2" = {
+          matchConfig.Name = "eno2";
+          networkConfig.LinkLocalAddressing = "no";
+        };
+        "40-lan" = {
+          matchConfig.Name = "lan";
+          networkConfig = {
+            IPv6SendRA = true;
+            DHCPPrefixDelegation = true;
+          };
+          ipv6SendRAConfig = {
+            DNS = "_link_local";
+            Domains = ["lan.yggdrasil" "yggdrasil"];
+          };
         };
-      };
-      "eno2" = {
-        matchConfig.Name = "eno2";
-        networkConfig.LinkLocalAddressing = "no";
       };
     };
 
diff --git a/hosts/vidhar/network/pppoe.nix b/hosts/vidhar/network/pppoe.nix
index 6b4942a6..7b342b69 100644
--- a/hosts/vidhar/network/pppoe.nix
+++ b/hosts/vidhar/network/pppoe.nix
@@ -102,33 +102,31 @@ in {
       '';
     };
 
-    systemd.network.networks.${pppInterface} = {
-      matchConfig = {
-        Name = pppInterface;
-      };
-      dns = [ "::1" "127.0.0.1" ];
-      domains = [ "~." ];
-      networkConfig = {
-        LinkLocalAddressing = "no";
-        DNSSEC = true;
-      };
-    };
-
-    services.ndppd = {
-      enable = true;
-      proxies = {
-        ${pppInterface} = {
-          router = true;
-          rules = {
-            lan = {
-              method = "iface";
-              interface = "lan";
-              network = "::/0";
-            };
-          };
+    systemd.package = pkgs.systemd.overrideAttrs (oldAttrs: {
+      patches = (oldAttrs.patches or []) ++ [
+        (pkgs.fetchpatch {
+          url = "https://github.com/sysedwinistrator/systemd/commit/b9691a43551739ddacdb8d53a4312964c3ddfa08.patch";
+          hash = "sha256-TLfOTFodLzCVywnF4Xp4BR2Pja0Qq4ItE/yaKkzI414=";
+        })
+      ];
+    });
+
+    systemd.network.networks = {
+      "40-${pppInterface}" = {
+        matchConfig.Name = pppInterface;
+        dns = [ "::1" "127.0.0.1" ];
+        domains = [ "~." ];
+        networkConfig = {
+          DHCP = true;
+          DNSSEC = true;
+        };
+        dhcpV6Config = {
+          PrefixDelegationHint = "::/64";
+          WithoutRA = "solicit";
         };
       };
     };
+
     boot.kernelModules = [ "ifb" ];
     boot.kernel.sysctl = {
       "net.ipv6.conf.all.forwarding" = true;
@@ -143,159 +141,5 @@ in {
       bindsTo = [ "sys-subsystem-net-devices-telekom.device" ];
       after = [ "sys-subsystem-net-devices-telekom.device" ];
     };
-
-    networking.interfaces.${pppInterface}.useDHCP = true;
-    networking.dhcpcd = {
-      enable = true;
-      persistent = false;
-      setHostname = false;
-      wait = "ipv6";
-      IPv6rs = false;
-
-      extraConfig = ''
-        duid
-        vendorclassid
-        ipv6only
-
-        require dhcp_server_identifier
-
-        reboot 0
-
-        interface ${pppInterface}
-          nooption domain_name_servers, domain_name, domain_search, ntp_servers
-          nohook hostname, resolv.conf
-          option rapid_commit
-
-          ipv6rs
-
-          ia_pd 1 lan/0/64/0
-      '';
-    };
-    systemd.services.dhcpcd = {
-      wantedBy = [ "multi-user.target" "network-online.target" "pppd-telekom.service" ];
-      bindsTo = [ "pppd-telekom.service" ];
-      after = [ "pppd-telekom.service" ];
-      wants = [ "network.target" ];
-      before = [ "network-online.target" ];
-
-      serviceConfig = {
-        ExecStartPre = [
-          (pkgs.resholve.writeScript "wait-${pppInterface}-ip" {
-            interpreter = pkgs.runtimeShell;
-            inputs = with pkgs; [ iproute2 coreutils ];
-            execer = [
-              "cannot:${lib.getExe' pkgs.iproute2 "ip"}"
-            ];
-          } ''
-            i=0
-
-            while [[ -z "$(ip -6 addr show dev ${pppInterface} scope link)" ]]; do
-              sleep 0.1
-              i=$((i + 1))
-              if [[ "$i" -ge 10 ]]; then
-                exit 1
-              fi
-            done
-          '')
-        ];
-
-        RestartSec = "5";
-      };
-    };
-    systemd.services.ndppd = {
-      wantedBy = [ "dhcpcd.service" ];
-      bindsTo = [ "dhcpcd.service" ];
-      after = [ "dhcpcd.service" ];
-
-      serviceConfig = {
-        Restart = "always";
-        RestartSec = "5";
-      };
-    };
-    systemd.services.radvd = {
-      wantedBy = [ "dhcpcd.service" "multi-user.target" ];
-      bindsTo = [ "dhcpcd.service" ];
-      after = [ "dhcpcd.service" "network.target" ];
-
-      serviceConfig = {
-        Restart = "always";
-        RestartSec = "5";
-        DynamicUser = true;
-        AmbientCapabilities = ["CAP_NET_ADMIN" "CAP_NET_RAW"];
-        CapabilityBoundingSet = ["CAP_NET_ADMIN" "CAP_NET_RAW"];
-        RuntimeDirectory = "radvd";
-        PIDFile = "$RUNTIME_DIRECTORY/radvd.pid";
-        ExecStart = pkgs.writers.writePython3 "radvd-genconfig" {
-          libraries = with pkgs.python3Packages; [ jinja2 ];
-          doCheck = false;
-        } ''
-          import os
-          import sys
-          from tempfile import NamedTemporaryFile
-          import subprocess
-          import json
-          import jinja2
-          from pathlib import Path
-          from ipaddress import IPv6Network
-
-
-          def network_address(value, prefixlen):
-              return IPv6Network(value + "/" + str(prefixlen), strict=False).network_address
-
-
-          with subprocess.Popen(["${lib.getExe' pkgs.iproute2 "ip"}", "-j", "addr", "show", "dev", "lan"], stdout=subprocess.PIPE) as proc:
-              addresses = json.load(proc.stdout)
-
-          global_addresses = [ addr for addr in addresses[0]["addr_info"] if addr["family"] == "inet6" and addr["scope"] == "global" ]
-
-          if not global_addresses:
-            sys.exit(1)
-
-          with NamedTemporaryFile(mode='w', dir=os.environ["RUNTIME_DIRECTORY"], prefix="radvd.", suffix=".conf", delete=False) as fh:
-              config_file = fh.name
-              env = jinja2.Environment(
-                  loader = jinja2.FileSystemLoader("${pkgs.writeTextDir "radvd.conf.jinja2" ''
-                    interface lan {
-                      IgnoreIfMissing off;
-                      AdvSendAdvert on;
-                      MaxRtrAdvInterval 240;
-                      {% for addr in addrs %}
-                      prefix {{addr["local"] | network_address(addr["prefixlen"])}}/{{addr["prefixlen"]}} {
-                        AdvValidLifetime 86400;
-                        AdvPreferredLifetime 300;
-                        DeprecatePrefix on;
-                      };
-                      route {{addr["local"] | network_address(56)}}/56 {
-                        AdvRouteLifetime 300;
-                        RemoveRoute on;
-                      };
-                      RDNSS {{addr["local"]}} {
-                        AdvRDNSSLifetime 300;
-                      };
-                      {%- endfor %}
-                      DNSSL yggdrasil {};
-                    };
-                  ''}"),
-                  autoescape = False,
-              )
-              env.filters["network_address"] = network_address
-              env.get_template("radvd.conf.jinja2").stream({
-                "addrs": global_addresses,
-              }).dump(fh)
-
-          os.execv("${lib.getExe' pkgs.radvd "radvd"}", ["radvd", "-n", "-p", str(Path(os.environ["RUNTIME_DIRECTORY"]) / "radvd.pid"), "-d", "1", "-C", config_file])
-        '';
-      };
-    };
-
-    systemd.services.unbound = {
-      wantedBy = [ "dhcpcd.service" ];
-      bindsTo = [ "dhcpcd.service" ];
-      after = [ "dhcpcd.service" ];
-
-      serviceConfig = {
-        Restart = lib.mkForce "always";
-      };
-    };
   };
 }
diff --git a/hosts/vidhar/prometheus/default.nix b/hosts/vidhar/prometheus/default.nix
index 4a5fa3c8..35942c53 100644
--- a/hosts/vidhar/prometheus/default.nix
+++ b/hosts/vidhar/prometheus/default.nix
@@ -39,11 +39,6 @@ in {
           enable = true;
           configurationPath = pkgs.copyPathToStore "${pkgs.prometheus-snmp-exporter.src}/snmp.yml";
         };
-        unbound = {
-          enable = true;
-          unbound.host = "unix:///run/unbound/unbound.ctl";
-          group = config.services.unbound.group;
-        };
         wireguard = {
           enable = true;
           wireguardConfig =
@@ -164,10 +159,11 @@ in {
           ];
           scrape_interval = "10s";
         }
-        { job_name = "unbound";
+        { job_name = "knot-resolver";
           static_configs = [
-            { targets = ["localhost:${toString config.services.prometheus.exporters.unbound.port}"]; }
+            { targets = ["localhost:9167"]; }
           ];
+          metrics_path = "/metrics/prometheus";
           relabel_configs = relabelHosts;
           scrape_interval = "1s";
         }
@@ -241,7 +237,7 @@ in {
           [ { source_labels = ["__param_target"];
               target_label = "job";
               regex = "127\.0\.0\.1:53";
-              replacement = "unbound.dns_soa";
+              replacement = "knot-resolver.dns_soa";
             }
             { replacement = "localhost:${toString config.services.prometheus.exporters.blackbox.port}";
               target_label = "__address__";
@@ -332,20 +328,6 @@ in {
       };
     };
 
-    users.users.${config.services.prometheus.exporters.unbound.user} = {
-      description = "Prometheus unbound exporter service user";
-      isSystemUser = true;
-      group = config.services.unbound.group;
-    };
-    systemd.services."prometheus-unbound-exporter" = {
-      wantedBy = [ "unbound.service" ];
-      serviceConfig = {
-        DynamicUser = false;
-        Restart = lib.mkForce "always";
-        RestartSec = "5";
-      };
-    };
-
     systemd.services."prometheus-nftables-exporter" = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
@@ -501,6 +483,20 @@ in {
       sopsFile = ./zte_dsl01.mgmt.yggdrasil;
     };
 
+    systemd.sockets."prometheus-knot-resolver-exporter" = {
+      unitConfig.WantedBy = [ "sockets.target" ];
+      socketConfig.ListenStream = "[::1]:9167";
+    };
+    systemd.services."prometheus-knot-resolver-exporter" = {
+      unitConfig = {
+        BindsTo = [ "knot-resolver.service" ];
+      };
+      serviceConfig = {
+        Type = "notify";
+        ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd /run/knot-resolver/kres-api.sock";
+      };
+    };
+
     services.corerad = {
       enable = true;
       settings = {
diff --git a/hosts/vidhar/zfs.nix b/hosts/vidhar/zfs.nix
index 9d667fd6..4b009c0d 100644
--- a/hosts/vidhar/zfs.nix
+++ b/hosts/vidhar/zfs.nix
@@ -44,11 +44,6 @@ with lib;
           fsType = "zfs";
         };
 
-      # "/var/lib/unbound" =
-      #   { device = "ssd-raid1/local/var-lib-unbound";
-      #     fsType = "zfs";
-      #   };
-
       # "/var/lib/dhcp" =
       #   { device = "ssd-raid1/local/var-lib-dhcp";
       #     fsType = "zfs";