hosts/mermet/knot.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (lib) types;
   4   inherit (config.services) knot;
   5   inherit (config.users) users groups;
   6 in
   7 {
   8   imports = [
   9     knot/autogeree.net.nix
  10     knot/sourcephile.fr.nix
  11   ];
  12   options.services.knot = {
  13     zones = lib.mkOption {
  14       default = { };
  15       type = types.attrsOf (types.submodule ({ ... }: {
  16         #config.domain = lib.mkDefault name;
  17         options = {
  18           conf = lib.mkOption {
  19             type = types.lines;
  20           };
  21           data = lib.mkOption {
  22             type = types.nullOr types.lines;
  23           };
  24         };
  25       }));
  26     };
  27   };
  28   config = {
  29     systemd.services.knot.serviceConfig.ExecStartPre =
  30       lib.mapAttrsToList
  31         (domain: { data, ... }: ''
  32           +${pkgs.coreutils}/bin/install -D -o ${users.knot.name} -g ${groups."knot".name} -m 700 \
  33            ${pkgs.writeText "${domain}.zone" data} \
  34            /var/lib/knot/zones/${domain}.zone
  35         '')
  36         knot.zones;
  37     /*
  38       systemd.services.knot.postStart = lib.mkAfter ''
  39       PATH="/run/current-system/sw/bin:$PATH"
  40       knotc zone-freeze ${domain}.
  41       while ! knotc zone-status ${domain}. +freeze | grep -q 'freeze: yes'; do sleep 1; done
  42       knotc zone-flush ${domain}.
  43       install -o knot -g knot -m 700 ${zone} /var/lib/knot/signed/${domain}.zone
  44       knotc zone-reload ${domain}.
  45       knotc zone-thaw ${domain}.
  46       '';
  47     */
  48     networking.nftables.ruleset = ''
  49       table inet filter {
  50         chain input-net {
  51           meta l4proto { udp, tcp } th dport domain counter accept comment "knot: DNS"
  52         }
  53         set output-net-knot-ipv4 { type ipv4_addr; }
  54         set output-net-knot-ipv6 { type ipv6_addr; }
  55         chain output-net {
  56           skuid ${users.knot.name} \
  57             meta l4proto { udp, tcp } th dport domain \
  58             ip daddr @output-net-knot-ipv4 \
  59             counter accept \
  60             comment "knot: DNS notify"
  61           skuid ${users.knot.name} \
  62             meta l4proto { udp, tcp } th dport domain \
  63             ip6 daddr @output-net-knot-ipv6 \
  64             counter accept \
  65             comment "knot: DNS notify"
  66         }
  67       }
  68     '';
  69     services.knot = {
  70       enable = true;
  71       extraArgs = [ "-v" ];
  72       # https://www.knot-dns.cz/docs/2.6/html/reference.html
  73       extraConfig = ''
  74         server :
  75           # Listen on localhost to allow only there
  76           # dynamic updates for ACME challenges.
  77           listen: 127.0.0.1@5353
  78
  79         mod-rrl:
  80           - id: default
  81             rate-limit: 200
  82             slip: 2
  83
  84         template:
  85           - id: default
  86             dnssec-signing: off
  87             # move databases below the state directory, because they need to be writable
  88             storage: /var/lib/knot/zones
  89             # Input-only zone files
  90             # https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3
  91             # prevents modification of the zonefiles, since the zonefiles are immutable
  92             #zonefile-sync: -1
  93             zonefile-load: difference
  94             journal-content: changes
  95             global-module: mod-rrl/default
  96
  97         database:
  98             journal-db: /var/lib/knot/journal
  99             kasp-db: /var/lib/knot/kasp
 100             timer-db: /var/lib/knot/timer
 101
 102         log:
 103           - target: syslog
 104             any: info
 105
 106         remote:
 107           - id: local_resolver
 108             address: 127.0.0.1@53
 109
 110           - id: secondary_gandi
 111             address: 217.70.177.40@53
 112
 113           - id: secondary_muarf
 114             address: 78.192.65.63@53
 115
 116         submission:
 117           - id: dnssec_validating_resolver
 118             parent: local_resolver
 119
 120         policy:
 121           - id: rsa
 122             single-type-signing: false
 123             ksk-shared: false
 124             algorithm: RSASHA256
 125             ksk-size: 4096
 126             zsk-size: 2048
 127             zsk-lifetime: 30d
 128             ksk-lifetime: 365d
 129             ksk-submission: dnssec_validating_resolver
 130
 131           - id: ed25519
 132             single-type-signing: false
 133             ksk-shared: false
 134             algorithm: ED25519
 135             ksk-size: 256
 136             zsk-size: 256
 137             zsk-lifetime: 30d
 138             ksk-lifetime: 365d
 139             cds-cdnskey-publish: always
 140             ksk-submission: dnssec_validating_resolver
 141
 142         acl:
 143           # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
 144           - id: acl_gandi
 145             address: 217.70.177.40
 146             action: transfer
 147
 148           - id: acl_muarf
 149             address: 78.192.65.63
 150             action: transfer
 151
 152       '' + lib.concatStringsSep "\n" (lib.mapAttrsToList (_domain: { conf, ... }: conf) knot.zones);
 153     };
 154   };
 155 }