mermet: unbound: provide a DNS cache for iodine users

diff --git a/hosts/mermet/iodine.nix b/hosts/mermet/iodine.nix
index 1f7fd6960dafa266bb94e83eb2fb25ae777f3d61..1f906a1f2edb2adfd36c92e96f69e19b87b4f180 100644 (file)
--- a/hosts/mermet/iodine.nix
+++ b/hosts/mermet/iodine.nix
@@ -28,5 +28,12 @@ networking.nftables.ruleset = ''
 
   # Masquerading
   add rule inet nat postrouting iifname "${iface}" oifname "${gateway}" masquerade
+
+  # Servicing
+  add rule inet filter input iifname "${iface}" udp dport 53 counter accept comment "Unbound"
 '';
+services.unbound.settings.server = {
+  interface = [ "10.53.53.1" ];
+  access-control = [ "10.53.53.0/24 allow" ];
+};
 }

diff --git a/hosts/mermet/unbound.nix b/hosts/mermet/unbound.nix
index d35e8dbedaae4ee9e0eabfd28297a46cfa62ebaa..8a3625444cbdea8c5482afb63c66cf56ea92d116 100644 (file)
--- a/hosts/mermet/unbound.nix
+++ b/hosts/mermet/unbound.nix
@@ -2,7 +2,6 @@
 let
   inherit (config.services) unbound;
   inherit (config.users) users;
-  stateDir = "/var/lib/unbound";
 in
 {
 networking.resolvconf.useLocalResolver = true;
@@ -22,7 +21,16 @@ services.unbound = {
     server = {
       log-queries = false;
       verbosity = 1;
-      interface = [ "127.0.0.1" "::1" ];
+      interface = [
+        "127.0.0.1"
+        "::1"
+      ];
+      access-control = [
+        "0.0.0.0/0 refuse"
+        "::0/0 refuse"
+        "127.0.0.0/8 allow"
+        "::1 allow"
+      ];
       prefer-ip4 = !config.networking.enableIPv6;
       port = 53;
 
@@ -140,13 +148,10 @@ networking.nftables.ruleset = ''
 '';
 systemd.services.unbound = {
   serviceConfig = {
-    RuntimeDirectory = "unbound";
-    RuntimeDirectoryMode = "0700";
+    #RuntimeDirectoryMode = "0700";
+    BindReadOnlyPaths = [
+     "${../../networking/named.root}:/var/lib/unbound/named.root"
+    ];
   };
-  preStart = ''
-    install -m 444 \
-     ${../../networking/named.root} \
-     /var/lib/unbound/named.root
-  '';
 };
 }