hosts/mermet/iodine.nix

   1 { pkgs, lib, config, credentials, host, ... }:
   2 let
   3   domain = "i.sourcephile.fr";
   4   dnsIface = "iode";
   5   gwIface = config.networking.defaultGateway.interface;
   6 in
   7 {
   8 systemd.services.iodined.serviceConfig.LoadCredentialEncrypted = "password:${credentials}/iodine/password.secret";
   9 systemd.sockets.iodined = {
  10   enable = true;
  11   listenDatagrams = [ "127.0.0.1:1053" ];
  12   socketConfig.BindToDevice = "lo";
  13   socketConfig.ReusePort = true;
  14   wantedBy = [ "sockets.target" ];
  15 };
  16 services.iodine.server = {
  17   enable = true;
  18   ip = "10.53.53.1/24";
  19   passwordFile = "$CREDENTIALS_DIRECTORY/password";
  20   inherit domain;
  21   extraConfig = "-4 -c -d ${dnsIface} -i 1800 -n ${host.ipv4}";
  22 };
  23 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  24 networking.nftables.ruleset = ''
  25   table inet filter {
  26     chain input {
  27       iifname ${dnsIface} udp dport domain counter accept comment "unbound: DNS"
  28     }
  29     chain forward {
  30       iifname ${dnsIface} oifname ${gwIface} counter accept
  31       iifname ${gwIface} oifname ${dnsIface} counter accept
  32     }
  33   }
  34   table inet nat {
  35     chain postrouting {
  36       iifname ${dnsIface} oifname ${gwIface} masquerade
  37     }
  38   }
  39 '';
  40 services.unbound.settings.server = {
  41   interface = [ "10.53.53.1" ];
  42   access-control = [ "10.53.53.0/24 allow" ];
  43 };
  44 }