servers/mermet/knot.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (lib) types;
   4   inherit (config.services) knot;
   5 in
   6 {
   7 imports = [
   8   knot/sourcephile.fr.nix
   9 ];
  10 options.services.knot = {
  11   zones = lib.mkOption {
  12     default = {};
  13     type = types.attrsOf (types.submodule ({domain, ...}: {
  14       #config.domain = lib.mkDefault domain;
  15       options = {
  16         conf = lib.mkOption {
  17           type = types.lines;
  18         };
  19         data = lib.mkOption {
  20           type = types.nullOr types.lines;
  21         };
  22       };
  23     }));
  24   };
  25 };
  26 config = {
  27 security.acme = {
  28   acceptTerms = true;
  29 };
  30 systemd.services.knot.preStart = lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: {data, ...}:
  31   lib.optionalString (data != null) ''
  32     install -D -o knot -g knot -m 700 ${pkgs.writeText "${domain}.zone" data} /var/lib/knot/zones/${domain}.zone
  33   '') knot.zones);
  34 /*
  35 systemd.services.knot.postStart = lib.mkAfter ''
  36   PATH="/run/current-system/sw/bin:$PATH"
  37   knotc zone-freeze ${domain}.
  38   while ! knotc zone-status ${domain}. +freeze | grep -q 'freeze: yes'; do sleep 1; done
  39   knotc zone-flush ${domain}.
  40   install -o knot -g knot -m 700 ${zone} /var/lib/knot/signed/${domain}.zone
  41   knotc zone-reload ${domain}.
  42   knotc zone-thaw ${domain}.
  43 '';
  44 */
  45 services.knot = {
  46   enable = true;
  47   extraArgs = [ "-v" ];
  48   # https://www.knot-dns.cz/docs/2.6/html/reference.html
  49   extraConfig = ''
  50     server :
  51       listen: 127.0.0.1@5353
  52
  53     mod-rrl:
  54       - id: default
  55         rate-limit: 200
  56         slip: 2
  57
  58     template:
  59       - id: default
  60         dnssec-signing: off
  61         # move databases below the state directory, because they need to be writable
  62         storage: /var/lib/knot/zones
  63         # Input-only zone files
  64         # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3
  65         # prevents modification of the zonefiles, since the zonefiles are immutable
  66         #zonefile-sync: -1
  67         zonefile-load: difference
  68         journal-content: changes
  69         global-module: mod-rrl/default
  70
  71     database:
  72         journal-db: /var/lib/knot/journal
  73         kasp-db: /var/lib/knot/kasp
  74         timer-db: /var/lib/knot/timer
  75
  76     log:
  77       - target: syslog
  78         any: info
  79
  80     remote:
  81       - id: local_resolver
  82         address: 127.0.0.1@53
  83
  84       - id: secondary_gandi
  85         address: 217.70.177.40@53
  86
  87     submission:
  88       - id: dnssec_validating_resolver
  89         parent: local_resolver
  90
  91     policy:
  92       - id: rsa
  93         single-type-signing: false
  94         ksk-shared: false
  95         algorithm: RSASHA256
  96         ksk-size: 4096
  97         zsk-size: 2048
  98         zsk-lifetime: 30d
  99         ksk-lifetime: 365d
 100         ksk-submission: dnssec_validating_resolver
 101
 102       - id: ed25519
 103         single-type-signing: false
 104         ksk-shared: false
 105         algorithm: ED25519
 106         ksk-size: 256
 107         zsk-size: 256
 108         zsk-lifetime: 30d
 109         ksk-lifetime: 365d
 110         cds-cdnskey-publish: always
 111         ksk-submission: dnssec_validating_resolver
 112
 113     acl:
 114       - id: acl_localhost
 115         address: 127.0.0.1
 116         action: transfer
 117
 118       - id: acl_lego
 119         address: 127.0.0.1
 120         action: update
 121
 122       # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
 123       - id: acl_gandi
 124         address: 217.70.177.40
 125         action: transfer
 126
 127   '' + lib.concatStringsSep "\n" (lib.mapAttrsToList (domain: {conf, ...}: conf) knot.zones);
 128 };
 129 };
 130 }