{ pkgs, ... }: { config = { fileSystems."/var/lib/knot" = { device = "surtr/safe/var-lib-knot"; fsType = "zfs"; }; systemd.services.knot.unitConfig.RequiresMountsFor = [ "/var/lib/knot" ]; services.knot = { enable = true; extraConfig = '' server: listen: 127.0.0.1@53 listen: ::1@53 listen: 202.61.241.61@53 listen: 2a03:4000:52:ada::@53 remote: - id: inwx_notify address: 185.181.104.96@53 - id: recursive address: ::1@5353 acl: - id: inwx_acl address: 185.181.104.96 action: transfer mod-rrl: - id: default rate-limit: 200 slip: 2 mod-cookies: - id: default secret-lifetime: 4h badcookie-slip: 1 submission: - id: validating-resolver parent: recursive policy: - id: rsa2048 algorithm: rsasha256 ksk-size: 4096 zsk-size: 2048 zsk-lifetime: 30d ksk-submission: validating-resolver - id: ed25519 algorithm: ed25519 nsec3: on nsec3-iterations: 0 ksk-lifetime: 360d signing-threads: 2 ksk-submission: validating-resolver template: - id: default global-module: [mod-cookies/default, mod-rrl/default] - id: inwx_zone storage: /var/lib/knot zonefile-sync: -1 zonefile-load: difference-no-serial serial-policy: dateserial journal-content: all semantic-checks: on dnssec-signing: on dnssec-policy: ed25519 notify: [inwx_notify] acl: [inwx_acl] zone: - domain: yggdrasil.li template: inwx_zone file: ${./zones/li.yggdrasil.soa} - domain: nights.email template: inwx_zone file: ${./zones/email.nights.soa} - domain: 141.li template: inwx_zone file: ${./zones/li.141.soa} - domain: kleen.li template: inwx_zone file: ${./zones/li.kleen.soa} - domain: xmpp.li template: inwx_zone file: ${./zones/li.xmpp.soa} - domain: dirty-haskell.org template: inwx_zone file: ${./zones/org.dirty-haskell.soa} - domain: praseodym.org template: inwx_zone file: ${./zones/org.praseodym.soa} - domain: rheperire.org template: inwx_zone file: ${./zones/org.rheperire.soa} ''; }; fileSystems."/var/lib/unbound" = { device = "surtr/local/var-lib-unbound"; fsType = "zfs"; }; systemd.services.unbound.unitConfig.RequiresMountFor = [ "/var/lib/unbound" ]; services.unbound = { enable = true; resolveLocalQueries = false; stateDir = "/var/lib/unbound"; localControlSocketPath = "/run/unbound/unbound.ctl"; settings = { server = { interface = ["127.0.0.1@5353" "::1@5353"]; access-control = ["127.0.0.0/8 allow" "::1/128 allow"]; root-hints = "${pkgs.dns-root-data}/root.hints"; num-threads = 12; so-reuseport = true; msg-cache-slabs = 16; rrset-cache-slabs = 16; infra-cache-slabs = 16; key-cache-slabs = 16; rrset-cache-size = "100m"; msg-cache-size = "50m"; outgoing-range = 8192; num-queries-per-thread = 4096; so-rcvbuf = "4m"; so-sndbuf = "4m"; # serve-expired = true; # serve-expired-ttl = 86400; # serve-expired-reply-ttl = 0; prefetch = true; prefetch-key = true; minimal-responses = false; extended-statistics = true; rrset-roundrobin = true; use-caps-for-id = true; }; }; }; }; }