2022-12-15 11:16:07 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
|
2023-01-02 11:33:32 +00:00
|
|
|
# TODO: consider using this library for .zone file generation:
|
|
|
|
# - <https://github.com/kirelagin/dns.nix>
|
|
|
|
|
2022-12-15 11:16:07 +00:00
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
cfg = config.sane.services.trust-dns;
|
|
|
|
toml = pkgs.formats.toml { };
|
2023-03-14 11:34:48 +00:00
|
|
|
recordFormatters = {
|
|
|
|
# quote rules for zone files:
|
|
|
|
# - any character may be encoded by `\DDD`, where `DDD` represents its ascii value in base 8.
|
|
|
|
# - any non-digit `X` may be encoded by `\X`.
|
|
|
|
# - stated in: <https://www.ietf.org/rfc/rfc1035.txt>: 5.1 Format
|
|
|
|
# - visible in <trust-dns:crates/proto/src/serialize/txt/zone_lex.rs:escape_seq>
|
|
|
|
# for us, we can just replace `\` => `\\ and `"` -> `\"`
|
|
|
|
TXT = value: "\"" + (lib.escape [ "\\" "\"" ] value) + "\"";
|
|
|
|
};
|
|
|
|
fmtRecord = proto: rrtype: name: value:
|
|
|
|
let
|
|
|
|
formatter = recordFormatters."${rrtype}" or lib.id;
|
|
|
|
in
|
|
|
|
"${name}\t${proto}\t${rrtype}\t${formatter value}";
|
2022-12-19 04:00:27 +00:00
|
|
|
fmtRecordList = proto: rrtype: name: values: concatStringsSep
|
|
|
|
"\n"
|
|
|
|
(map (fmtRecord proto rrtype name) values)
|
|
|
|
;
|
|
|
|
fmtRecordAttrs = proto: rrtype: rrAttrs:
|
|
|
|
concatStringsSep
|
|
|
|
"\n"
|
|
|
|
(
|
|
|
|
attrValues (
|
|
|
|
mapAttrs
|
|
|
|
(name: fmtRecordList proto rrtype name)
|
|
|
|
rrAttrs
|
|
|
|
)
|
|
|
|
);
|
2022-12-19 04:38:41 +00:00
|
|
|
fmtIncludes = paths: concatStringsSep
|
|
|
|
"\n"
|
|
|
|
(map (path: "$INCLUDE ${path}") paths);
|
2022-12-21 08:50:41 +00:00
|
|
|
|
|
|
|
genZone = zcfg: ''
|
|
|
|
$TTL ${toString zcfg.TTL}
|
|
|
|
${fmtRecordAttrs "IN" "SOA" zcfg.inet.SOA}
|
|
|
|
${fmtRecordAttrs "IN" "A" zcfg.inet.A}
|
|
|
|
${fmtRecordAttrs "IN" "CNAME" zcfg.inet.CNAME}
|
|
|
|
${fmtRecordAttrs "IN" "MX" zcfg.inet.MX}
|
|
|
|
${fmtRecordAttrs "IN" "NS" zcfg.inet.NS}
|
|
|
|
${fmtRecordAttrs "IN" "SRV" zcfg.inet.SRV}
|
|
|
|
${fmtRecordAttrs "IN" "TXT" zcfg.inet.TXT}
|
|
|
|
${fmtIncludes zcfg.include}
|
|
|
|
${zcfg.extraConfig}
|
|
|
|
'';
|
|
|
|
|
2022-12-19 04:00:27 +00:00
|
|
|
configFile = toml.generate "trust-dns.toml" {
|
2022-12-15 11:16:07 +00:00
|
|
|
listen_addrs_ipv4 = cfg.listenAddrsIPv4;
|
|
|
|
zones = attrValues (
|
2022-12-21 08:50:41 +00:00
|
|
|
mapAttrs (zname: zcfg: rec {
|
|
|
|
zone = if zcfg.name == null then zname else zcfg.name;
|
2022-12-15 11:16:07 +00:00
|
|
|
zone_type = "Primary";
|
2022-12-21 08:50:41 +00:00
|
|
|
file = if zcfg.file == null then
|
|
|
|
pkgs.writeText "${zone}.zone" (genZone zcfg)
|
|
|
|
else
|
|
|
|
zcfg.file;
|
2022-12-15 11:16:07 +00:00
|
|
|
}) cfg.zones
|
|
|
|
);
|
|
|
|
};
|
2023-01-02 13:23:52 +00:00
|
|
|
|
|
|
|
# (listOf ty) type which also accepts single-assignment of `ty`.
|
|
|
|
# it's used to allow the user to write:
|
|
|
|
# CNAME."foo" = "bar";
|
|
|
|
# as shorthand for
|
|
|
|
# CNAME."foo" = [ "bar" ];
|
|
|
|
listOrUnit = ty: types.coercedTo ty (elem: [ elem ]) (types.listOf ty);
|
2022-12-15 11:16:07 +00:00
|
|
|
in
|
|
|
|
{
|
|
|
|
options = {
|
|
|
|
sane.services.trust-dns = {
|
|
|
|
enable = mkOption {
|
|
|
|
default = false;
|
|
|
|
type = types.bool;
|
|
|
|
};
|
|
|
|
listenAddrsIPv4 = mkOption {
|
|
|
|
type = types.listOf types.str;
|
|
|
|
default = [];
|
|
|
|
description = "array of ipv4 addresses on which to listen for DNS queries";
|
|
|
|
};
|
2023-01-25 08:18:29 +00:00
|
|
|
quiet = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
|
|
|
};
|
2022-12-15 11:16:07 +00:00
|
|
|
# reference <nixpkgs:nixos/modules/services/web-servers/nginx/vhost-options.nix>
|
|
|
|
zones = mkOption {
|
|
|
|
type = types.attrsOf (types.submodule {
|
|
|
|
options = {
|
2022-12-21 08:50:41 +00:00
|
|
|
name = mkOption {
|
|
|
|
type = types.nullOr types.str;
|
|
|
|
description = "zone name. defaults to the attribute name in zones";
|
|
|
|
default = null;
|
|
|
|
};
|
2022-12-15 11:16:07 +00:00
|
|
|
TTL = mkOption {
|
|
|
|
type = types.int;
|
|
|
|
description = "default TTL";
|
2022-12-19 04:38:41 +00:00
|
|
|
default = 3600;
|
|
|
|
};
|
|
|
|
include = mkOption {
|
|
|
|
type = types.listOf types.str;
|
|
|
|
description = "paths of other zone files to $INCLUDE into this one";
|
|
|
|
default = [];
|
2022-12-15 11:16:07 +00:00
|
|
|
};
|
2022-12-19 03:12:25 +00:00
|
|
|
extraConfig = mkOption {
|
2022-12-15 11:16:07 +00:00
|
|
|
type = types.lines;
|
2022-12-19 03:12:25 +00:00
|
|
|
description = "extra lines to append to the zone file";
|
2022-12-19 04:38:41 +00:00
|
|
|
default = "";
|
2022-12-15 11:16:07 +00:00
|
|
|
};
|
2022-12-19 04:00:27 +00:00
|
|
|
inet = {
|
|
|
|
SOA = mkOption {
|
2023-01-02 13:23:52 +00:00
|
|
|
type = types.attrsOf (listOrUnit types.str);
|
2022-12-19 04:38:41 +00:00
|
|
|
description = "Start of Authority record(s)";
|
|
|
|
default = {};
|
|
|
|
};
|
|
|
|
A = mkOption {
|
2023-01-02 13:23:52 +00:00
|
|
|
type = types.attrsOf (listOrUnit types.str);
|
2022-12-19 04:38:41 +00:00
|
|
|
description = "IPv4 address record(s)";
|
|
|
|
default = {};
|
|
|
|
};
|
|
|
|
CNAME = mkOption {
|
2023-01-02 13:23:52 +00:00
|
|
|
type = types.attrsOf (listOrUnit types.str);
|
2022-12-19 04:38:41 +00:00
|
|
|
description = "canonical name record(s)";
|
|
|
|
default = {};
|
|
|
|
};
|
|
|
|
MX = mkOption {
|
2023-01-02 13:23:52 +00:00
|
|
|
type = types.attrsOf (listOrUnit types.str);
|
2022-12-19 04:38:41 +00:00
|
|
|
description = "mail exchanger record(s)";
|
|
|
|
default = {};
|
|
|
|
};
|
|
|
|
NS = mkOption {
|
2023-01-02 13:23:52 +00:00
|
|
|
type = types.attrsOf (listOrUnit types.str);
|
2022-12-19 04:38:41 +00:00
|
|
|
description = "name server record(s)";
|
|
|
|
default = {};
|
|
|
|
};
|
|
|
|
SRV = mkOption {
|
2023-01-02 13:23:52 +00:00
|
|
|
type = types.attrsOf (listOrUnit types.str);
|
2022-12-19 04:38:41 +00:00
|
|
|
description = "service record(s)";
|
|
|
|
default = {};
|
|
|
|
};
|
|
|
|
TXT = mkOption {
|
2023-01-02 13:23:52 +00:00
|
|
|
type = types.attrsOf (listOrUnit types.str);
|
2022-12-19 04:38:41 +00:00
|
|
|
description = "text record(s)";
|
|
|
|
default = {};
|
2022-12-19 04:00:27 +00:00
|
|
|
};
|
|
|
|
};
|
2022-12-21 08:50:41 +00:00
|
|
|
|
|
|
|
file = mkOption {
|
|
|
|
type = types.nullOr types.str;
|
|
|
|
default = null;
|
|
|
|
description = "instead of using the generated zone file, use the specified path";
|
|
|
|
};
|
2022-12-15 11:16:07 +00:00
|
|
|
};
|
|
|
|
});
|
|
|
|
default = {};
|
|
|
|
description = "Declarative zone config";
|
|
|
|
};
|
2022-12-21 08:50:41 +00:00
|
|
|
|
|
|
|
generatedZones = mkOption {
|
|
|
|
type = types.attrsOf types.str;
|
|
|
|
description = "generated zone text for each zone";
|
|
|
|
};
|
2022-12-15 11:16:07 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
config = mkIf cfg.enable {
|
2022-12-21 08:50:41 +00:00
|
|
|
sane.services.trust-dns.generatedZones = mapAttrs (zone: zcfg: genZone zcfg) cfg.zones;
|
2022-12-15 11:16:07 +00:00
|
|
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
|
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
|
|
|
|
|
|
systemd.services.trust-dns = {
|
|
|
|
description = "trust-dns DNS server";
|
|
|
|
serviceConfig = {
|
2023-01-25 08:18:29 +00:00
|
|
|
ExecStart =
|
|
|
|
let
|
|
|
|
flags = lib.optionalString cfg.quiet "-q";
|
|
|
|
in ''
|
|
|
|
${pkgs.trust-dns}/bin/named \
|
|
|
|
--config ${configFile} \
|
|
|
|
--zonedir / ${flags}
|
|
|
|
'';
|
2022-12-15 11:16:07 +00:00
|
|
|
Type = "simple";
|
|
|
|
Restart = "on-failure";
|
|
|
|
RestartSec = "10s";
|
|
|
|
# TODO: hardening (like, don't run as root!)
|
|
|
|
};
|
|
|
|
after = [ "network.target" ];
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
}
|