servers/mermet/knot.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (lib) types;
   4   inherit (config.services) knot;
   5   inherit (config.users) users groups;
   6 in
   7 {
   8 imports = [
   9   knot/autogeree.net.nix
  10   knot/sourcephile.fr.nix
  11 ];
  12 options.services.knot = {
  13   zones = lib.mkOption {
  14     default = {};
  15     type = types.attrsOf (types.submodule ({domain, ...}: {
  16       #config.domain = lib.mkDefault domain;
  17       options = {
  18         conf = lib.mkOption {
  19           type = types.lines;
  20         };
  21         data = lib.mkOption {
  22           type = types.nullOr types.lines;
  23         };
  24       };
  25     }));
  26   };
  27 };
  28 config = {
  29 services.shorewall.configs.rules = ''
  30   DNS(ACCEPT) $FW net:217.70.177.40 # for knot to notify ns6.gandi.net
  31   DNS(ACCEPT) $FW net:78.192.65.63  # for knot to notify ns0.muarf.org
  32 '';
  33 systemd.services.knot.preStart = lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: {data, ...}:
  34   lib.optionalString (data != null) ''
  35     install -D -o ${users."knot".name} -g ${groups."knot".name} -m 700 \
  36      ${pkgs.writeText "${domain}.zone" data} \
  37      /var/lib/knot/zones/${domain}.zone
  38   '') knot.zones);
  39 /*
  40 systemd.services.knot.postStart = lib.mkAfter ''
  41   PATH="/run/current-system/sw/bin:$PATH"
  42   knotc zone-freeze ${domain}.
  43   while ! knotc zone-status ${domain}. +freeze | grep -q 'freeze: yes'; do sleep 1; done
  44   knotc zone-flush ${domain}.
  45   install -o knot -g knot -m 700 ${zone} /var/lib/knot/signed/${domain}.zone
  46   knotc zone-reload ${domain}.
  47   knotc zone-thaw ${domain}.
  48 '';
  49 */
  50 services.knot = {
  51   enable = true;
  52   extraArgs = [ "-v" ];
  53   # https://www.knot-dns.cz/docs/2.6/html/reference.html
  54   extraConfig = ''
  55     server :
  56       # Listen on localhost to allow only there
  57       # dynamic updates for ACME challenges.
  58       listen: 127.0.0.1@5353
  59
  60     mod-rrl:
  61       - id: default
  62         rate-limit: 200
  63         slip: 2
  64
  65     template:
  66       - id: default
  67         dnssec-signing: off
  68         # move databases below the state directory, because they need to be writable
  69         storage: /var/lib/knot/zones
  70         # Input-only zone files
  71         # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3
  72         # prevents modification of the zonefiles, since the zonefiles are immutable
  73         #zonefile-sync: -1
  74         zonefile-load: difference
  75         journal-content: changes
  76         global-module: mod-rrl/default
  77
  78     database:
  79         journal-db: /var/lib/knot/journal
  80         kasp-db: /var/lib/knot/kasp
  81         timer-db: /var/lib/knot/timer
  82
  83     log:
  84       - target: syslog
  85         any: info
  86
  87     remote:
  88       - id: local_resolver
  89         address: 127.0.0.1@53
  90
  91       - id: secondary_gandi
  92         address: 217.70.177.40@53
  93
  94       - id: secondary_muarf
  95         address: 78.192.65.63@53
  96
  97     submission:
  98       - id: dnssec_validating_resolver
  99         parent: local_resolver
 100
 101     policy:
 102       - id: rsa
 103         single-type-signing: false
 104         ksk-shared: false
 105         algorithm: RSASHA256
 106         ksk-size: 4096
 107         zsk-size: 2048
 108         zsk-lifetime: 30d
 109         ksk-lifetime: 365d
 110         ksk-submission: dnssec_validating_resolver
 111
 112       - id: ed25519
 113         single-type-signing: false
 114         ksk-shared: false
 115         algorithm: ED25519
 116         ksk-size: 256
 117         zsk-size: 256
 118         zsk-lifetime: 30d
 119         ksk-lifetime: 365d
 120         cds-cdnskey-publish: always
 121         ksk-submission: dnssec_validating_resolver
 122
 123     acl:
 124       # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
 125       - id: acl_gandi
 126         address: 217.70.177.40
 127         action: transfer
 128
 129       - id: acl_muarf
 130         address: 78.192.65.63
 131         action: transfer
 132
 133   '' + lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: {conf, ...}: conf) knot.zones);
 134 };
 135 };
 136 }