{...}: { config = { fileSystems."/var/lib/knot" = { device = "surtr/safe/var-lib-knot"; fsType = "zfs"; }; systemd.services.knot.unitConfig.RequiresMountsFor = [ "/var/lib/knot" ]; networking.firewall = { allowedTCPPorts = [ 53 # DNS ]; allowedUDPPorts = [ 53 # DNS ]; }; services.knot = { enable = true; extraConfig = '' server: listen: 127.0.0.1@53 listen: ::1@53 listen: 202.61.241.61@53 listen: 2a03:4000:52:ada::@53 remote: - id: inwx_notify address: 185.181.104.96@53 acl: - id: inwx_acl address: 185.181.104.96 action: transfer template: - id: inwx_zone storage: /var/lib/knot zonefile-sync: -1 zonefile-load: difference-no-serial serial-policy: dateserial journal-content: all semantic-checks: on dnssec-signing: on notify: [inwx_notify] acl: [inwx_acl] policy: - id: rsa algorithm: RSASHA256 ksk-size: 4096 zsk-size: 2048 zsk-lifetime: 30d zone: - domain: yggdrasil.li template: inwx_zone file: ${./zones/li.yggdrasil.soa} - domain: nights.email template: inwx_zone file: ${./zones/email.nights.soa} - domain: 141.li template: inwx_zone file: ${./zones/li.141.soa} - domain: kleen.li template: inwx_zone file: ${./zones/li.kleen.soa} - domain: xmpp.li template: inwx_zone file: ${./zones/li.xmpp.soa} - domain: dirty-haskell.org template: inwx_zone file: ${./zones/org.dirty-haskell.soa} - domain: praseodym.org template: inwx_zone file: ${./zones/org.praseodym.soa} - domain: rheperire.org template: inwx_zone file: ${./zones/org.rheperire.soa} ''; }; }; }