hosts/losurdo/networking/nsupdate.nix

   1 { pkgs, lib, config, hosts, ... }:
   2 let
   3   inherit (config.security) gnupg;
   4   inherit (config.users) users groups;
   5   inherit (config.networking) domain;
   6 in
   7 {
   8 systemd.services.nsupdate = {
   9   after = [
  10     "network-online.target"
  11     gnupg.secrets."knot/tsig/${domain}/bureau1.key".service
  12   ];
  13   wants = [
  14     gnupg.secrets."knot/tsig/${domain}/bureau1.key".service
  15   ];
  16   wantedBy = [ "multi-user.target" ];
  17   startAt = "*:0/5"; # every 5 min
  18   serviceConfig = {
  19     Type = "simple";
  20     ExecStart = pkgs.writeShellScript "nsupdate" ''
  21       set -eux
  22       publicIPv4=$(${pkgs.curl}/bin/curl -s4 https://whoami.sourcephile.fr/addr ||
  23         ${pkgs.curl}/bin/curl -s4L https://icanhazip.com || true)
  24       publicIPv6=$(${pkgs.curl}/bin/curl -s6L https://icanhazip.com || true)
  25       privateIPv4=$(${pkgs.miniupnpc}/bin/upnpc -s | sed -ne 's/^Local LAN ip address : //p')
  26       ${pkgs.knot-dns}/bin/knsupdate -k ${gnupg.secrets."knot/tsig/${domain}/bureau1.key".path} <<EOF
  27       server ns.sourcephile.fr
  28       zone sourcephile.fr
  29       origin sourcephile.fr
  30       update delete bureau1 A
  31       ''${publicIPv4:+update add bureau1 300 A $publicIPv4}
  32       update delete bureau1 AAAA
  33       ''${publicIPv6:+update add bureau1 300 AAAA $publicIPv6}
  34       update delete lan.losurdo A
  35       ''${privateIPv4:+update add lan.losurdo 300 A $privateIPv4}
  36       show
  37       send
  38       EOF
  39     '';
  40     Restart = "on-failure";
  41     RestartSec = "30s";
  42     DynamicUser = true;
  43     User = users."nsupdate".name;
  44   };
  45 };
  46 users.users."nsupdate".isSystemUser = true;
  47 users.groups."keys".members = [users."nsupdate".name];
  48 security.gnupg.secrets."knot/tsig/${domain}/bureau1.key" = {
  49   user = users."nsupdate".name;
  50 };
  51 networking.nftables.ruleset =
  52   lib.optionalString (config.services.upnpc.redirections != []) ''
  53   # Create a rule for accepting any SSDP packets going to a remembered port.
  54   add rule inet filter net2fw udp dport @ssdp_out \
  55     counter accept comment "SSDP answer"
  56   add rule inet filter fw2net \
  57     skuid {${users.upnpc.name},${users.nsupdate.name}} \
  58     tcp dport 1900 \
  59     counter accept \
  60     comment "SSDP automatic opening"
  61   add rule inet filter fw2net \
  62     skuid {${users.upnpc.name},${users.nsupdate.name}} \
  63     ip daddr 239.255.255.250 udp dport 1900 \
  64     set add udp sport @ssdp_out \
  65     comment "SSDP automatic opening"
  66   add rule inet filter fw2net \
  67     skuid {${users.upnpc.name},${users.nsupdate.name}} \
  68     ip daddr 239.255.255.250 udp dport 1900 \
  69     counter accept comment "SSDP"
  70   '' + lib.optionalString config.networking.enableIPv6 ''
  71   add rule inet filter fw2net \
  72     skuid {${users.upnpc.name},${users.nsupdate.name}} \
  73     ip6 daddr {FF02::C, FF05::C, FF08::C, FF0E::C} udp dport 1900 \
  74     set add udp sport @ssdp_out comment "SSDP automatic opening"
  75   add rule inet filter fw2net \
  76     skuid {${users.upnpc.name},${users.nsupdate.name}} \
  77     ip6 daddr {FF02::C, FF05::C, FF08::C, FF0E::C} udp dport 1900 \
  78     counter accept comment "SSDP"
  79   '';
  80 }