hosts/losurdo/networking/nsupdate.nix

   1 { pkgs, lib, config, hosts, hostName, credentials, ... }:
   2 let
   3   inherit (config.users) users groups;
   4   inherit (config.networking) domain;
   5 in
   6 {
   7 # TODO: nsupdate in the initrd
   8 systemd.services.nsupdate = {
   9   wantedBy = [ "multi-user.target" ];
  10   startAt = "*:0/5"; # every 5 min
  11   serviceConfig = {
  12     Type = "simple";
  13     LoadCredentialEncrypted = "${hostName}.tsig:${credentials}/nsupdate/sourcephile.fr/${hostName}.tsig.secret";
  14     ExecStart = pkgs.writeShellScript "nsupdate" ''
  15       set -eux
  16       publicIPv4=$(${pkgs.curl}/bin/curl -s4 https://whoami.sourcephile.fr/addr ||
  17         ${pkgs.curl}/bin/curl -s4L https://icanhazip.com || true)
  18       publicIPv6=$(${pkgs.curl}/bin/curl -s6L https://icanhazip.com || true)
  19       privateIPv4=$(${pkgs.miniupnpc}/bin/upnpc -s | sed -ne 's/^Local LAN ip address : //p')
  20       ${pkgs.knot-dns}/bin/knsupdate -k $CREDENTIALS_DIRECTORY/${hostName}.tsig <<EOF
  21       server ns.sourcephile.fr
  22       zone sourcephile.fr
  23       origin sourcephile.fr
  24       update delete ${hostName} A
  25       ''${publicIPv4:+update add ${hostName} 300 A $publicIPv4}
  26       update delete ${hostName} AAAA
  27       ''${publicIPv6:+update add ${hostName} 300 AAAA $publicIPv6}
  28       update delete lan.${hostName} A
  29       ''${privateIPv4:+update add lan.${hostName} 300 A $privateIPv4}
  30       show
  31       send
  32       EOF
  33     '';
  34     Restart = "on-failure";
  35     RestartSec = "30s";
  36     DynamicUser = true;
  37     User = users."nsupdate".name;
  38   };
  39 };
  40 users.users."nsupdate" = {
  41   isSystemUser = true;
  42   group = groups."nsupdate".name;
  43 };
  44 users.groups."nsupdate" = {};
  45 networking.nftables.ruleset = ''
  46   table inet filter {
  47     set nsupdate-ssdp {
  48       type inet_service
  49       timeout 5s
  50     }
  51     chain input-net {
  52       udp dport @nsupdate-ssdp counter accept comment "SSDP answer"
  53     }
  54     chain output-net {
  55       skuid ${users.nsupdate.name} \
  56         ip daddr ${hosts.mermet._module.args.ipv4} \
  57         meta l4proto { udp, tcp } th dport domain \
  58         counter accept comment "nsupdate: DNS"
  59       skuid ${users.nsupdate.name} \
  60         tcp dport ssdp \
  61         counter accept \
  62         comment "SSDP automatic opening"
  63       skuid ${users.nsupdate.name} \
  64         ip daddr 239.255.255.250 udp dport ssdp \
  65         set add udp sport @nsupdate-ssdp \
  66         comment "SSDP automatic opening"
  67       skuid ${users.nsupdate.name} \
  68         ip daddr 239.255.255.250 udp dport ssdp \
  69         counter accept comment "SSDP"
  70     }
  71   }
  72   '' + lib.optionalString config.networking.enableIPv6 ''
  73   table inet filter {
  74     chain output-net {
  75       skuid ${users.nsupdate.name} \
  76         ip6 daddr { FF02::C, FF05::C, FF08::C, FF0E::C } \
  77         udp dport ssdp \
  78         set add udp sport @nsupdate-ssdp \
  79         comment "SSDP automatic opening"
  80       skuid ${users.nsupdate.name} \
  81         ip6 daddr { FF02::C, FF05::C, FF08::C, FF0E::C } \
  82         udp dport ssdp \
  83         counter accept comment "SSDP"
  84     }
  85   }
  86   '';
  87 }