]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/networking/nsupdate.nix
nix: update input julm-nix
[sourcephile-nix.git] / hosts / losurdo / networking / nsupdate.nix
1 { pkgs, lib, config, hostName, credentials, ... }:
2 let
3 inherit (config.users) users groups;
4 inherit (config.networking) domain;
5 in
6 {
7 # TODO: nsupdate in the initrd
8 systemd.services.nsupdate = {
9 wantedBy = [ "multi-user.target" ];
10 startAt = "*:0/5"; # every 5 min
11 serviceConfig = {
12 Type = "simple";
13 LoadCredentialEncrypted = "${hostName}.key:${credentials}/knot/tsig/sourcephile.fr/${hostName}.key"
14 ExecStart = pkgs.writeShellScript "nsupdate" ''
15 set -eux
16 publicIPv4=$(${pkgs.curl}/bin/curl -s4 https://whoami.sourcephile.fr/addr ||
17 ${pkgs.curl}/bin/curl -s4L https://icanhazip.com || true)
18 publicIPv6=$(${pkgs.curl}/bin/curl -s6L https://icanhazip.com || true)
19 privateIPv4=$(${pkgs.miniupnpc}/bin/upnpc -s | sed -ne 's/^Local LAN ip address : //p')
20 ${pkgs.knot-dns}/bin/knsupdate -k $CREDENTIALS_DIRECTORY/${hostName}.key <<EOF
21 server ns.sourcephile.fr
22 zone sourcephile.fr
23 origin sourcephile.fr
24 update delete ${hostName} A
25 ''${publicIPv4:+update add ${hostName} 300 A $publicIPv4}
26 update delete ${hostName} AAAA
27 ''${publicIPv6:+update add ${hostName} 300 AAAA $publicIPv6}
28 update delete lan.losurdo A
29 ''${privateIPv4:+update add lan.${hostName} 300 A $privateIPv4}
30 show
31 send
32 EOF
33 '';
34 Restart = "on-failure";
35 RestartSec = "30s";
36 DynamicUser = true;
37 User = users."nsupdate".name;
38 };
39 };
40 users.users."nsupdate" = {
41 isSystemUser = true;
42 group = groups."nsupdate".name;
43 };
44 users.groups."nsupdate" = {};
45 networking.nftables.ruleset =
46 lib.optionalString (config.services.upnpc.redirections != []) ''
47 # Create a rule for accepting any SSDP packets going to a remembered port.
48 add rule inet filter net2fw udp dport @ssdp_out \
49 counter accept comment "SSDP answer"
50 add rule inet filter fw2net \
51 skuid {${users.upnpc.name},${users.nsupdate.name}} \
52 tcp dport 1900 \
53 counter accept \
54 comment "SSDP automatic opening"
55 add rule inet filter fw2net \
56 skuid {${users.upnpc.name},${users.nsupdate.name}} \
57 ip daddr 239.255.255.250 udp dport 1900 \
58 set add udp sport @ssdp_out \
59 comment "SSDP automatic opening"
60 add rule inet filter fw2net \
61 skuid {${users.upnpc.name},${users.nsupdate.name}} \
62 ip daddr 239.255.255.250 udp dport 1900 \
63 counter accept comment "SSDP"
64 '' + lib.optionalString config.networking.enableIPv6 ''
65 add rule inet filter fw2net \
66 skuid {${users.upnpc.name},${users.nsupdate.name}} \
67 ip6 daddr {FF02::C, FF05::C, FF08::C, FF0E::C} udp dport 1900 \
68 set add udp sport @ssdp_out comment "SSDP automatic opening"
69 add rule inet filter fw2net \
70 skuid {${users.upnpc.name},${users.nsupdate.name}} \
71 ip6 daddr {FF02::C, FF05::C, FF08::C, FF0E::C} udp dport 1900 \
72 counter accept comment "SSDP"
73 '';
74 }