hosts/losurdo/networking/nsupdate.nix

   1 { pkgs, lib, config, hosts, ... }:
   2 let
   3   inherit (config.security) gnupg;
   4   inherit (config.users) users groups;
   5   inherit (config.networking) domain;
   6 in
   7 {
   8 systemd.services.nsupdate = {
   9   after = [
  10     "network-online.target"
  11     gnupg.secrets."knot/tsig/${domain}/bureau1.key".service
  12   ];
  13   wants = [
  14     gnupg.secrets."knot/tsig/${domain}/bureau1.key".service
  15   ];
  16   wantedBy = [ "multi-user.target" ];
  17   startAt = "*:0/5"; # every 5 min
  18   serviceConfig = {
  19     Type = "simple";
  20     ExecStart = pkgs.writeShellScript "nsupdate" ''
  21       set -eux
  22       publicIPv4=$(${pkgs.curl}/bin/curl -s4 https://whoami.sourcephile.fr/addr ||
  23         ${pkgs.curl}/bin/curl -s4L https://icanhazip.com || true)
  24       publicIPv6=$(${pkgs.curl}/bin/curl -s6L https://icanhazip.com || true)
  25       privateIPv4=$(${pkgs.miniupnpc}/bin/upnpc -s | sed -ne 's/^Local LAN ip address : //p')
  26       ${pkgs.knot-dns}/bin/knsupdate -k ${gnupg.secrets."knot/tsig/${domain}/bureau1.key".path} <<EOF
  27       server ns.sourcephile.fr
  28       zone sourcephile.fr
  29       origin sourcephile.fr
  30       update delete bureau1 A
  31       ''${publicIPv4:+update add bureau1 300 A $publicIPv4}
  32       update delete bureau1 AAAA
  33       ''${publicIPv6:+update add bureau1 300 AAAA $publicIPv6}
  34       update delete lan.losurdo A
  35       ''${privateIPv4:+update add lan.losurdo 300 A $privateIPv4}
  36       show
  37       send
  38       EOF
  39     '';
  40     Restart = "on-failure";
  41     RestartSec = "30s";
  42     DynamicUser = true;
  43     User = users."nsupdate".name;
  44   };
  45 };
  46 users.users."nsupdate".isSystemUser = true;
  47 users.groups."keys".members = [users."nsupdate".name];
  48 security.gnupg.secrets."knot/tsig/${domain}/bureau1.key" = {
  49   user = users."nsupdate".name;
  50 };
  51 }