summaryrefslogtreecommitdiff
path: root/hosts/vidhar/dns/default.nix
blob: 8d36f3728302e4d7c800692db849600987c455cd (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
{ config, lib, pkgs, ... }:

with lib;

let
  knotKeys = let
    dir = ./keys;
    toKeyInfo = name: v:
      if v == "regular" || v == "symlink"
      then { path = dir + "/${name}"; inherit name; }
      else null;
  in filter (v: v != null) (mapAttrsToList toKeyInfo (builtins.readDir dir));
in {
  config = {
    services.unbound = {
      enable = true;
      resolveLocalQueries = false;
      stateDir = "/var/lib/unbound";
      localControlSocketPath = "/run/unbound/unbound.ctl";
      settings = {
        server = {
          interface = ["lo" "lan"];
          prefer-ip6 = true;
          access-control = ["0.0.0.0/0 allow" "::/0 allow"];
          root-hints = "${pkgs.dns-root-data}/root.hints";

          num-threads = 12;
          so-reuseport = true;
          msg-cache-slabs = 16;
          rrset-cache-slabs = 16;
          infra-cache-slabs = 16;
          key-cache-slabs = 16;

          rrset-cache-size = "100m";
          msg-cache-size = "50m";
          outgoing-range = 8192;
          num-queries-per-thread = 4096;

          so-rcvbuf = "4m";
          so-sndbuf = "4m";

          # serve-expired = true;
          # serve-expired-ttl = 86400;
          # serve-expired-reply-ttl = 0;

          prefetch = true;
          prefetch-key = true;

          minimal-responses = false;

          extended-statistics = true;

          rrset-roundrobin = true;
          use-caps-for-id = true;

          do-not-query-localhost = false;
          local-zone = [
            "141.10.in-addr.arpa. transparent"
            "yggdrasil. transparent"
          ];
          domain-insecure = [
            "141.10.in-addr.arpa."
            "yggdrasil."
          ];
        };

        stub-zone = map (name: {
          inherit name;
          stub-addr = "127.0.0.1@5353";
          stub-first = true;
          stub-no-cache = true;
          stub-prime = false;
        }) ["yggdrasil." "arpa.in-addr.10.141."];
      };
    };

    services.knot = {
      enable = true;
      keyFiles = map ({name, ...}: config.sops.secrets.${name}.path) knotKeys;
      extraConfig = ''
        server:
          listen: 127.0.0.1@5353
          listen: ::1@5353

          listen: 10.141.1.1@53
          listen: 10.141.2.1@53
          listen: 2a03:4000:52:ada:1:1::@53

        acl:
          - id: local_acl
            key: local_key
            action: update

        template:
          - id: local_zone
            storage: /var/lib/knot
            zonefile-sync: -1
            zonefile-load: difference-no-serial
            serial-policy: dateserial
            journal-content: all
            semantic-checks: on
            acl: [local_acl]

        zone:
          - domain: yggdrasil
            template: local_zone
            file: ${./zones/yggdrasil.soa}
          - domain: 141.10.in-addr.arpa
            template: local_zone
            file: ${./zones/arpa.in-addr.10.141.soa}
      '';
    };

    sops.secrets = listToAttrs (map ({name, path}: nameValuePair name {
      format = "binary";
      owner = "knot";
      sopsFile = path;
    }) knotKeys);
  };
}