1 { pkgs, lib, config, ... }:
4 inherit (config.services) knot;
5 inherit (config.users) users groups;
10 knot/sourcephile.fr.nix
12 options.services.knot = {
13 zones = lib.mkOption {
15 type = types.attrsOf (types.submodule ({domain, ...}: {
16 #config.domain = lib.mkDefault domain;
22 type = types.nullOr types.lines;
29 services.shorewall.configs.rules = ''
30 DNS(ACCEPT) $FW net:217.70.177.40 # for knot to notify ns6.gandi.net
31 DNS(ACCEPT) $FW net:78.192.65.63 # for knot to notify ns0.muarf.org
33 systemd.services.knot.preStart = lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: {data, ...}:
34 lib.optionalString (data != null) ''
35 install -D -o ${users."knot".name} -g ${groups."knot".name} -m 700 \
36 ${pkgs.writeText "${domain}.zone" data} \
37 /var/lib/knot/zones/${domain}.zone
40 systemd.services.knot.postStart = lib.mkAfter ''
41 PATH="/run/current-system/sw/bin:$PATH"
42 knotc zone-freeze ${domain}.
43 while ! knotc zone-status ${domain}. +freeze | grep -q 'freeze: yes'; do sleep 1; done
44 knotc zone-flush ${domain}.
45 install -o knot -g knot -m 700 ${zone} /var/lib/knot/signed/${domain}.zone
46 knotc zone-reload ${domain}.
47 knotc zone-thaw ${domain}.
53 # https://www.knot-dns.cz/docs/2.6/html/reference.html
56 # Listen on localhost to allow only there
57 # dynamic updates for ACME challenges.
58 listen: 127.0.0.1@5353
68 # move databases below the state directory, because they need to be writable
69 storage: /var/lib/knot/zones
70 # Input-only zone files
71 # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3
72 # prevents modification of the zonefiles, since the zonefiles are immutable
74 zonefile-load: difference
75 journal-content: changes
76 global-module: mod-rrl/default
79 journal-db: /var/lib/knot/journal
80 kasp-db: /var/lib/knot/kasp
81 timer-db: /var/lib/knot/timer
92 address: 217.70.177.40@53
95 address: 78.192.65.63@53
98 - id: dnssec_validating_resolver
99 parent: local_resolver
103 single-type-signing: false
110 ksk-submission: dnssec_validating_resolver
113 single-type-signing: false
120 cds-cdnskey-publish: always
121 ksk-submission: dnssec_validating_resolver
124 # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
126 address: 217.70.177.40
130 address: 78.192.65.63
133 '' + lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: {conf, ...}: conf) knot.zones);