2024-04-29 11:19:21 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
|
|
cfg = config.sane.services.trust-dns;
|
|
|
|
dns = config.sane.dns;
|
|
|
|
toml = pkgs.formats.toml { };
|
2024-04-29 13:07:33 +00:00
|
|
|
instanceModule = with lib; types.submodule ({ config, ...}: {
|
2024-04-29 11:19:21 +00:00
|
|
|
options = {
|
|
|
|
port = mkOption {
|
|
|
|
type = types.port;
|
|
|
|
default = 53;
|
|
|
|
};
|
|
|
|
listenAddrs = mkOption {
|
|
|
|
type = types.listOf types.str;
|
2024-04-29 13:07:33 +00:00
|
|
|
default = [ "127.0.0.1" ];
|
2024-04-29 11:19:21 +00:00
|
|
|
description = ''
|
|
|
|
IP addresses to serve requests from.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
substitutions = mkOption {
|
|
|
|
type = types.attrsOf types.str;
|
|
|
|
default = {};
|
|
|
|
description = ''
|
|
|
|
text substitutions to make on the config and zone file before starting trust-dns.
|
|
|
|
'';
|
|
|
|
example = {
|
|
|
|
"%CNAMESELF%" = "lappy";
|
|
|
|
"%AWAN%" = ''"$(cat /var/www/wan.txt)"'';
|
|
|
|
};
|
|
|
|
};
|
2024-04-29 13:07:33 +00:00
|
|
|
enableRecursiveResolver = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
|
|
|
description = ''
|
|
|
|
act as a recursive resolver
|
|
|
|
'';
|
|
|
|
};
|
2024-04-29 11:19:21 +00:00
|
|
|
extraConfig = mkOption {
|
|
|
|
type = types.attrs;
|
|
|
|
default = {};
|
|
|
|
};
|
|
|
|
};
|
2024-04-29 13:07:33 +00:00
|
|
|
|
|
|
|
config = {
|
|
|
|
extraConfig = lib.mkIf config.enableRecursiveResolver {
|
|
|
|
zones = [
|
|
|
|
{
|
|
|
|
zone = ".";
|
|
|
|
zone_type = "Hint";
|
|
|
|
stores = {
|
|
|
|
type = "recursor";
|
|
|
|
# contains the list of toplevel DNS servers, from which to recursively resolve entries.
|
|
|
|
roots = "${pkgs.dns-root-data}/root.hints";
|
|
|
|
|
|
|
|
# dnssec, see: <https://github.com/hickory-dns/hickory-dns/issues/2193>
|
|
|
|
# probably not needed: the default seems to be that dnssec is disabled
|
|
|
|
# enable_dnssec = false;
|
|
|
|
#
|
|
|
|
# defaults, untuned
|
|
|
|
# ns_cache_size = 1024;
|
|
|
|
# record_cache_size = 1048576;
|
|
|
|
};
|
|
|
|
}
|
|
|
|
];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
});
|
|
|
|
|
|
|
|
mkSystemdService = flavor: { port, listenAddrs, substitutions, extraConfig, ... }: let
|
2024-04-29 11:19:21 +00:00
|
|
|
sed = "${pkgs.gnused}/bin/sed";
|
|
|
|
configTemplate = toml.generate "trust-dns-${flavor}.toml" (
|
|
|
|
(
|
|
|
|
lib.filterAttrsRecursive (_: v: v != null) config.services.trust-dns.settings
|
|
|
|
) // {
|
|
|
|
listen_addrs_ipv4 = listenAddrs;
|
|
|
|
} // extraConfig
|
|
|
|
);
|
|
|
|
configPath = "/var/lib/trust-dns/${flavor}-config.toml";
|
|
|
|
sedArgs = lib.mapAttrsToList (key: value: ''-e "s/${key}/${value}/g"'') substitutions;
|
|
|
|
subs = lib.concatStringsSep " " sedArgs;
|
|
|
|
in {
|
|
|
|
description = "trust-dns Domain Name Server (serving ${flavor})";
|
|
|
|
unitConfig.Documentation = "https://trust-dns.org/";
|
2024-04-29 13:07:33 +00:00
|
|
|
after = [ "network.target" ];
|
|
|
|
wantedBy = [ "network.target" ];
|
2024-05-09 07:19:17 +00:00
|
|
|
|
2024-04-29 11:19:21 +00:00
|
|
|
preStart = lib.concatStringsSep "\n" (
|
|
|
|
[''
|
|
|
|
mkdir -p "/var/lib/trust-dns/${flavor}"
|
|
|
|
${sed} ${subs} -e "" "${configTemplate}" > "${configPath}"
|
|
|
|
''] ++ lib.mapAttrsToList (zone: { rendered, ... }: ''
|
|
|
|
${sed} ${subs} -e "" ${pkgs.writeText "${zone}.zone.in" rendered} \
|
|
|
|
> "/var/lib/trust-dns/${flavor}/${zone}.zone"
|
|
|
|
'') dns.zones
|
|
|
|
);
|
|
|
|
|
|
|
|
serviceConfig = config.systemd.services.trust-dns.serviceConfig // {
|
|
|
|
ExecStart = lib.escapeShellArgs ([
|
2024-04-29 13:07:33 +00:00
|
|
|
"${config.services.trust-dns.package}/bin/${config.services.trust-dns.package.meta.mainProgram}"
|
2024-04-29 11:19:21 +00:00
|
|
|
"--port" (builtins.toString port)
|
|
|
|
"--zonedir" "/var/lib/trust-dns/${flavor}"
|
|
|
|
"--config" "${configPath}"
|
|
|
|
] ++ lib.optionals config.services.trust-dns.debug [
|
|
|
|
"--debug"
|
|
|
|
] ++ lib.optionals config.services.trust-dns.quiet [
|
|
|
|
"--quiet"
|
|
|
|
]);
|
2024-04-29 13:07:33 +00:00
|
|
|
# servo/dyn-dns needs /var/lib/uninsane/wan.txt.
|
|
|
|
# this might not exist on other systems,
|
|
|
|
# so just bind the deepest path which is guaranteed to exist.
|
|
|
|
ReadOnlyPaths = [ "/var/lib" ];
|
2024-04-29 11:19:21 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
in
|
|
|
|
{
|
|
|
|
options = with lib; {
|
|
|
|
sane.services.trust-dns = {
|
|
|
|
enable = mkOption {
|
|
|
|
default = false;
|
|
|
|
type = types.bool;
|
|
|
|
};
|
|
|
|
instances = mkOption {
|
|
|
|
default = {};
|
|
|
|
type = types.attrsOf instanceModule;
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
|
|
# enable nixpkgs' trust-dns so that i get its config generation
|
|
|
|
# but don't actually enable the systemd service... i'll instantiate *multiple* instances per interface further below
|
|
|
|
services.trust-dns.enable = true;
|
2024-04-29 13:07:33 +00:00
|
|
|
services.trust-dns.settings.zones = []; #< TODO: remove once upstreamed (bad default)
|
2024-04-29 11:19:21 +00:00
|
|
|
|
|
|
|
# don't bind to IPv6 until i explicitly test that stack
|
|
|
|
services.trust-dns.settings.listen_addrs_ipv6 = [];
|
|
|
|
services.trust-dns.quiet = true;
|
|
|
|
# FIXME(2023/11/26): services.trust-dns.debug doesn't log requests: use RUST_LOG=debug env for that.
|
|
|
|
# - see: <https://github.com/hickory-dns/hickory-dns/issues/2082>
|
|
|
|
# services.trust-dns.debug = true;
|
|
|
|
|
2024-04-29 13:07:33 +00:00
|
|
|
services.trust-dns.package = pkgs.trust-dns.override {
|
|
|
|
rustPlatform.buildRustPackage = args: pkgs.rustPlatform.buildRustPackage (args // {
|
|
|
|
buildFeatures = [
|
|
|
|
"recursor"
|
|
|
|
];
|
|
|
|
|
|
|
|
# fix enough bugs inside the recursive resolver that it's compatible with my infra.
|
|
|
|
# TODO: upstream these patches!
|
|
|
|
src = pkgs.fetchFromGitea {
|
|
|
|
domain = "git.uninsane.org";
|
|
|
|
owner = "colin";
|
|
|
|
repo = "hickory-dns";
|
|
|
|
rev = "67649863faf2e08f63963a96a491a4025aaf8ed6";
|
|
|
|
hash = "sha256-vmVY8C0cCCFxy/4+g1vKZsAD5lMaufIExnFaSVVAhGM=";
|
|
|
|
};
|
|
|
|
cargoHash = "sha256-FEjNxv1iu27SXQhz1+Aehs4es8VxT1BPz5uZq8TcG/k=";
|
|
|
|
});
|
|
|
|
};
|
|
|
|
|
2024-04-29 11:19:21 +00:00
|
|
|
users.groups.trust-dns = {};
|
|
|
|
users.users.trust-dns = {
|
|
|
|
group = "trust-dns";
|
|
|
|
isSystemUser = true;
|
|
|
|
};
|
|
|
|
|
|
|
|
systemd.services = lib.mkMerge [
|
|
|
|
{
|
|
|
|
trust-dns.enable = false;
|
|
|
|
trust-dns.serviceConfig = {
|
|
|
|
DynamicUser = lib.mkForce false;
|
|
|
|
User = "trust-dns";
|
|
|
|
Group = "trust-dns";
|
|
|
|
wantedBy = lib.mkForce [];
|
|
|
|
};
|
|
|
|
}
|
|
|
|
(lib.mapAttrs'
|
|
|
|
(flavor: instanceConfig: {
|
|
|
|
name = "trust-dns-${flavor}";
|
|
|
|
value = mkSystemdService flavor instanceConfig;
|
|
|
|
})
|
|
|
|
cfg.instances
|
|
|
|
)
|
|
|
|
];
|
|
|
|
};
|
|
|
|
}
|