summaryrefslogtreecommitdiff
path: root/hosts/surtr/dns/default.nix
blob: eb4dbe134246fdd50121dac2375fe7fb901f1872 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
{...}:
{
  config = {
    fileSystems."/var/lib/knot" =
      { device = "surtr/safe/var-lib-knot";
        fsType = "zfs";
      };

    systemd.services.knot.unitConfig.RequiresMountsFor = [ "/var/lib/knot" ];
    
    services.knot = {
      enable = true;
      extraConfig = ''
        server:
          listen: 127.0.0.1@53
          listen: ::1@53
          listen: 202.61.241.61@53
          listen: 2a03:4000:52:ada::@53

        remote:
          - id: inwx_notify
            address: 185.181.104.96@53

        acl:
          - id: inwx_acl
            address: 185.181.104.96
            action: transfer

        mod-rrl:
          - id: default
            rate-limit: 200
            slip: 2

        mod-cookies:
          - id: default
            secret-lifetime: 4h
            badcookie-slip: 1

        policy:
          - id: rsa2048
            algorithm: rsasha256
            ksk-size: 4096
            zsk-size: 2048
            zsk-lifetime: 30d
          - id: ed25519
            algorithm: ed25519
            nsec3: on
            ksk-lifetime: 360d
            signing-threads: 2

        template:
          - id: default
            global-module: [mod-cookies/default, mod-rrl/default]
          - id: inwx_zone
            storage: /var/lib/knot
            zonefile-sync: -1
            zonefile-load: difference-no-serial
            serial-policy: dateserial
            journal-content: all
            semantic-checks: on
            dnssec-signing: on
            dnssec-policy: ed25519
            notify: [inwx_notify]
            acl: [inwx_acl]

        zone:
          - domain: yggdrasil.li
            template: inwx_zone
            file: ${./zones/li.yggdrasil.soa}

          - domain: nights.email
            template: inwx_zone
            file: ${./zones/email.nights.soa}

          - domain: 141.li
            template: inwx_zone
            file: ${./zones/li.141.soa}

          - domain: kleen.li
            template: inwx_zone
            file: ${./zones/li.kleen.soa}

          - domain: xmpp.li
            template: inwx_zone
            file: ${./zones/li.xmpp.soa}

          - domain: dirty-haskell.org
            template: inwx_zone
            file: ${./zones/org.dirty-haskell.soa}

          - domain: praseodym.org
            template: inwx_zone
            file: ${./zones/org.praseodym.soa}

          - domain: rheperire.org
            template: inwx_zone
            file: ${./zones/org.rheperire.soa}
      '';
    };
  };
}