hosts/losurdo/unbound.nix

   1 { config, host, ... }:
   2 let
   3   inherit (config.services) unbound;
   4   inherit (config.users) users;
   5 in
   6 {
   7   networking.resolvconf.useLocalResolver = true;
   8   services.unbound = {
   9     enable = true;
  10     # DOC: https://calomel.org/unbound_dns.html
  11     settings = {
  12       remote-control = {
  13         control-enable = true;
  14         control-interface = "/run/unbound/unbound.socket";
  15       };
  16       server = {
  17         log-queries = false;
  18         verbosity = 1;
  19         interface = [
  20           "127.0.0.1"
  21           "::1"
  22         ];
  23         access-control = [
  24           "0.0.0.0/0 refuse"
  25           "::0/0 refuse"
  26           "127.0.0.0/8 allow"
  27           "::1 allow"
  28         ];
  29         prefer-ip4 = !config.networking.enableIPv6;
  30         port = 53;
  31
  32         # The file which contains the listing of primary root DNS servers.
  33         # To be updated once every six months.
  34         root-hints = "/var/lib/unbound/named.root";
  35
  36         # Do no answer id.server and hostname.bind queries.
  37         hide-identity = true;
  38         # Do not answer version.server and version.bind queries.
  39         hide-version = true;
  40
  41         # Will trust glue only if it is within the servers authority.
  42         # Harden against out of zone rrsets, to avoid spoofing attempts.
  43         # Hardening queries multiple name servers for the same data to make
  44         # spoofing significantly harder and does not mandate dnssec.
  45         harden-glue = true;
  46
  47         # Require DNSSEC data for trust-anchored zones, if such data is absent, the
  48         # zone becomes  bogus.  Harden against receiving dnssec-stripped data. If you
  49         # turn it off, failing to validate dnskey data for a trustanchor will trigger
  50         # insecure mode for that zone (like without a trustanchor).  Default on,
  51         # which insists on dnssec data for trust-anchored zones.
  52         harden-dnssec-stripped = true;
  53
  54         # Use 0x20-encoded random bits in the query to foil spoof attempts.
  55         # http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
  56         #
  57         # When Unbound sends a query to a remote server it sends the hostname
  58         # string in random upper and lower characters. The remote server must
  59         # resolve the hostname as if all the characters were lower case. The remote
  60         # server must then send the query back to Unbound in the same random upper
  61         # and lower characters that Unbound sent. If the characters of the hostname
  62         # in the response are in the same format as the query then the dns-0x20
  63         # check is satisfied.
  64         # Attackers hoping to poison a Unbound DNS cache must therefore guess the
  65         # mixed-case encoding of the query and the timing of the return dns answer
  66         # in addition to all other fields required in a DNS poisoning attack.
  67         # dns-0x20 increases the difficulty of the attack significantly.
  68         #
  69         # It may result in maybe 0.4% of domains getting no answers
  70         # due to no support on the authoritative server side
  71         use-caps-for-id = true;
  72
  73         #cache-min-ttl = 3600;
  74         cache-max-ttl = 86400;
  75
  76         # Perform prefetching of close to expired message cache entries.  If a client
  77         # requests the dns lookup and the TTL of the cached hostname is going to
  78         # expire in less than 10% of its TTL, unbound will (1st) return the IP of the
  79         # host to the client and (2nd) pre-fetch the DNS request from the remote DNS server.
  80         # This method has been shown to increase the amount of cached hits by
  81         # local clients by 10% on average.
  82         prefetch = true;
  83
  84         # Number of threads to create. 1 disables threading.
  85         # This should equal the number of CPU cores in the host.
  86         num-threads = host.CPUs;
  87
  88         # The number of slabs to use for cache and must be a power of 2 times the
  89         # number of num-threads set above. more slabs reduce lock contention,
  90         # but fragment memory usage.
  91         msg-cache-slabs = 8;
  92         rrset-cache-slabs = 8;
  93         infra-cache-slabs = 8;
  94         key-cache-slabs = 8;
  95
  96         # Increase the memory size of the cache. Use roughly twice as much rrset cache
  97         # memory as you use msg cache memory. Due to malloc overhead, the total memory
  98         # usage is likely to rise to double (or 2.5x) the total cache memory.
  99         rrset-cache-size = "32m";
 100         msg-cache-size = "16m";
 101
 102         # buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets
 103         # the kernel buffer larger so that no messages are lost in spikes in the traffic.
 104         so-rcvbuf = "1m";
 105
 106         # Enforce privacy of these addresses. Strips them away from answers.
 107         # It may cause DNSSEC validation to additionally mark it as bogus.
 108         # Protects against 'DNS Rebinding' (uses browser as network proxy).
 109         #  Only 'private-domain' and 'local-data' names are allowed
 110         # to have these private addresses. No default.
 111         private-address = [
 112           "192.168.0.0/16"
 113           "172.16.0.0/12"
 114           "10.0.0.0/8"
 115         ];
 116
 117         # Allow the domain (and its subdomains) to contain private addresses.
 118         # local-data statements are allowed to contain private addresses too.
 119         #private-domain = "home.lan";
 120
 121         # If nonzero, unwanted replies are not only reported in statistics, but also
 122         # a running total is kept per thread. If it reaches the threshold, a warning
 123         # is printed and a defensive action is taken, the cache is cleared to flush
 124         # potential poison out of it.  A suggested value is 10000000, the default is
 125         # 0 (turned off). calomel.org thinks 10K is a good value.
 126         unwanted-reply-threshold = 10000;
 127
 128         # IMPORTANT FOR TESTING: If you are testing and setup NSD or BIND on
 129         # localhost you will want to allow the resolver to send queries to localhost.
 130         # Make sure to set do-not-query-localhost = true;.
 131         do-not-query-localhost = true;
 132
 133         # Should additional section of secure message also be kept clean of unsecure
 134         # data. Useful to shield the users of this validator from potential bogus
 135         # data in the additional section. All unsigned data in the additional section
 136         # is removed from secure messages.
 137         val-clean-additional = true;
 138       };
 139     };
 140   };
 141   networking.nftables.ruleset = ''
 142     table inet filter {
 143       chain output-net {
 144         meta l4proto { udp, tcp } \
 145           th dport domain \
 146           skuid ${users.unbound.name} \
 147           counter accept comment "unbound"
 148       }
 149     }
 150   '';
 151   systemd.services.unbound = {
 152     serviceConfig = {
 153       RuntimeDirectory = "unbound";
 154       RuntimeDirectoryMode = "0700";
 155     };
 156     preStart = ''
 157       install -m 444 \
 158        ${../../networking/named.root} \
 159        /var/lib/unbound/named.root
 160     '';
 161   };
 162 }