kay/dns: init

7 files changed, 149 insertions, 19 deletions

diff --git a/hosts/kay/configuration.nix b/hosts/kay/configuration.nix
index ad10a96..7009a2a 100644
--- a/hosts/kay/configuration.nix
+++ b/hosts/kay/configuration.nix
@@ -6,6 +6,7 @@
     ./modules/network.nix
     ./modules/www.nix
     ./modules/sftp.nix
+    ./modules/dns
     ../../common.nix
   ];
 
diff --git a/hosts/kay/modules/dns/ddns.nix b/hosts/kay/modules/dns/ddns.nix
new file mode 100644
index 0000000..5b87968
--- /dev/null
+++ b/hosts/kay/modules/dns/ddns.nix
@@ -0,0 +1,39 @@
+{ pkgs,  ... }: {
+   services.pppd.script = {
+      "02-ddns-ipv4" = {
+         runtimeInputs = with pkgs; [ coreutils knot-dns ];
+         type = "ip-up";
+
+         text = ''
+            cat <<- EOF | knsupdate
+                    server  2001:470:ee65::1
+                    zone    sinanmohd.com.
+
+                    update  delete  sinanmohd.com.  A
+                    update  add     sinanmohd.com.  180     A       $4
+
+                    send
+            EOF
+         '';
+       };
+
+      "02-ddns-ipv6" = {
+         runtimeInputs = with pkgs; [ coreutils knot-dns iproute2 gnugrep ];
+         type = "ipv6-up";
+
+         text = ''
+            ipv6="$(ip -6 addr show dev $1 scope global | grep -o '[0-9a-f:]*::1')"
+
+            cat <<- EOF | knsupdate
+                    server  2001:470:ee65::1
+                    zone    sinanmohd.com.
+
+                    update  delete  sinanmohd.com.  AAAA
+                    update  add     sinanmohd.com.  180     AAAA    $ipv6
+
+                    send
+            EOF
+         '';
+       };
+    };
+}
diff --git a/hosts/kay/modules/dns/default.nix b/hosts/kay/modules/dns/default.nix
new file mode 100644
index 0000000..5f287fd
--- /dev/null
+++ b/hosts/kay/modules/dns/default.nix
@@ -0,0 +1,75 @@
+{ config, ... }: let
+  listen_addr = "2001:470:ee65::1";
+in {
+  imports = [ ./ddns.nix ];
+
+  networking.firewall = {
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 ];
+  };
+
+  sops.secrets.dns = {
+    owner = config.systemd.services.knot.serviceConfig.User;
+    group = config.systemd.services.knot.serviceConfig.Group;
+  };
+
+  services.knot = {
+    enable = true;
+    keyFiles = [ config.sops.secrets.dns.path ];
+
+    settings = {
+      server.listen = listen_addr;
+
+      remote = [{
+        id = "ns1.he.net";
+        address = [ "2001:470:100::2" "216.218.130.2" ];
+        via = "2001:470:ee65::1";
+      }];
+
+      # generate TSIG key with keymgr -t name
+      acl = [
+        {
+          id = "ns1.he.net";
+          key = "ns1.he.net";
+          address = [ "2001:470:600::2" "216.218.133.2" ];
+          action = "transfer";
+        }
+        {
+          id = "localhost";
+          address = [ listen_addr ];
+          update-type = [ "A" "AAAA" ];
+          action = "update";
+        }
+      ];
+
+      mod-rrl = [{
+        id = "default";
+        rate-limit = 200;
+        slip = 2;
+      }];
+
+      template = [
+        {
+          id = "default";
+          semantic-checks = "on";
+          global-module = "mod-rrl/default";
+        }
+        {
+          id = "master";
+          semantic-checks = "on";
+          notify = [ "ns1.he.net" ];
+          acl = [ "ns1.he.net" "localhost" ];
+          zonefile-sync = "-1";
+          zonefile-load = "difference";
+        }
+      ];
+
+      zone = [{
+        domain = "sinanmohd.com";
+        file = ./sinanmohd.com.zone;
+        template = "master";
+      }];
+    };
+  };
+
+}
diff --git a/hosts/kay/modules/dns/sinanmohd.com.zone b/hosts/kay/modules/dns/sinanmohd.com.zone
new file mode 100644
index 0000000..9cff3c5
--- /dev/null
+++ b/hosts/kay/modules/dns/sinanmohd.com.zone
@@ -0,0 +1,25 @@
+$ORIGIN sinanmohd.com.
+$TTL 2d
+
+@	IN	SOA	ns1	sinan (
+			2024020100 ; serial
+			2h         ; refresh
+			5m         ; retry
+			1d         ; expire
+			5m )       ; nx ttl
+
+	IN	NS	ns1
+	IN	NS	ns2.he.net.
+	IN	NS	ns3.he.net.
+	IN	NS	ns4.he.net.
+	IN	NS	ns5.he.net.
+
+     30	IN	A	127.0.0.1
+     30	IN	AAAA	::1
+
+ns1	IN	AAAA	2001:470:ee65::1
+
+www	IN	CNAME	@
+git	IN	CNAME	@
+bin	IN	CNAME	@
+static	IN	CNAME	@
diff --git a/hosts/kay/modules/hurricane.nix b/hosts/kay/modules/hurricane.nix
index 1e44e2d..bb36628 100644
--- a/hosts/kay/modules/hurricane.nix
+++ b/hosts/kay/modules/hurricane.nix
@@ -91,7 +91,7 @@ in
   };
 
 
-  services.pppd.script."02-${iface}" = {
+  services.pppd.script."01-${iface}" = {
     runtimeInputs = with pkgs; [ curl coreutils iproute2 iputils ];
     text = ''
       wan_ip="$4"
diff --git a/hosts/kay/modules/network.nix b/hosts/kay/modules/network.nix
index 5e1b2ee..929fb1b 100644
--- a/hosts/kay/modules/network.nix
+++ b/hosts/kay/modules/network.nix
@@ -1,11 +1,10 @@
-{ config, pkgs, ... }:
+{ config, ... }:
 
 let
   inetVlan = 722;
   voipVlan = 1849;
   wanInterface = "enp4s0";
   nameServer = "1.0.0.1";
-  domain = config.userdata.domain;
 in
 {
   imports = [
@@ -17,7 +16,6 @@ in
     "ppp/chap-secrets" = {};
     "ppp/pap-secrets" = {};
     "ppp/username" = {};
-    "misc/namecheap.com" = {};
   };
 
   networking = let
@@ -50,8 +48,10 @@ in
         bind-interfaces = true;
       };
     };
+
     pppd = {
       enable = true;
+
       config = ''
         plugin pppoe.so
         debug
@@ -66,27 +66,17 @@ in
         lcp-echo-interval 1
         lcp-echo-failure 5
       '';
+
       peers.bsnl = {
         enable = true;
         autostart = true;
         configFile = config.sops.secrets."ppp/username".path;
       };
+
       secret = {
         chap = config.sops.secrets."ppp/chap-secrets".path;
         pap = config.sops.secrets."ppp/pap-secrets".path;
       };
-      script."01-ddns" = {
-        runtimeInputs = with pkgs; [ curl coreutils ];
-        text = ''
-          wan_ip="$4"
-          api_key="$(cat ${config.sops.secrets."misc/namecheap.com".path})"
-          auth_url="https://dynamicdns.park-your-domain.com/update?host=@&domain=${domain}&password=''${api_key}&ip="
-
-          until curl --silent "$auth_url$wan_ip"; do
-              sleep 1
-          done
-        '';
-      };
     };
   };
 }
diff --git a/hosts/kay/secrets.yaml b/hosts/kay/secrets.yaml
index ac5d61e..11bebda 100644
--- a/hosts/kay/secrets.yaml
+++ b/hosts/kay/secrets.yaml
@@ -6,11 +6,11 @@ hurricane:
     username: ENC[AES256_GCM,data:pe3igN9AIbc1,iv:stBkppjkDC9nvV/fHaEtfs6KskoiqqEKxCp/KC+Xxeo=,tag:pH5CJXOOp/is7dQmt6wlog==,type:str]
     update_key: ENC[AES256_GCM,data:wwd+QWTgKEqstY5d2eWBnWJYq2EisTTaa/Ow4WwBNkyh5FYP+7PEyg==,iv:b93JvsfWppqlJtZxGAa3xbXgLEFs0A5Seq5pNjTnRW4=,tag:+W1t1M+Mm4LopVbcI1x+eg==,type:str]
     tunnel_id: ENC[AES256_GCM,data:WUDOxjmA,iv:W8k0pyrAQz+UWtm76uvmzodJ2lZG4ioxrVMWjX1kIVM=,tag:2Q25MXzlptg/rc0HQ1k6rg==,type:str]
+dns: ENC[AES256_GCM,data:Pa6Oo7UFDqo5ZN+eyz9MKy0p4KU1ePTpWQ+R8PuSFO9JjFt/I86ru/qSKyymIzhJcjj5hXMT2LPjk4MH8BWaO39ACsPDSD09xA6e1GO0rvsvtB9cffuz/GnfveyHmev+7xzdriD4IHqINPE=,iv:zuSfHnmxrjFCX3DJSRxLDs/3IVBRnkn3crar1pCW1EU=,tag:rZ0TlMMsOCF3Shunx8PnfA==,type:str]
 matrix-sinanmohd.com:
     key: ENC[AES256_GCM,data:xsSYua3g+ySUVBtfVZ2uZR4761MC5LeJGxmcgf+dWb5+tBSmgzAQL9FFcl7GLzhTmvlq13lARUr599wShS/C9IyMVGOOT9A8hxLFF9Kak64hmM7ERGrwbmzBY1mdTtvibJqzHaeybUVIMbDagczF54zpjDGLmdC5V84wduPFCndSA5FW+4Hhqw==,iv:KJtqrGNPgMDR6Sg/fOUzVAiwnPZwve9wpVfDQPc4g/c=,tag:E2jlbt5WbRA9wu16Lr69Bg==,type:str]
     sliding_sync: ENC[AES256_GCM,data:ubFeb/OgYYHaIHVky6KS3icORbpqf7PO3p8bONA8mwG8vU1LB0TDqVm6vQTa8G9pe96JzJ8+IAgSZafG9PaEJc/Bpj53aWRFO3HEV0Pj,iv:P8VD8utVEwNoeQEZUdS2R9GuDe20nKiXYCfKJl0Id3E=,tag:VksV/4IaKN0C2g/alw6r4Q==,type:str]
 misc:
-    namecheap.com: ENC[AES256_GCM,data:DADZZitG7oLHKJzEJgVe8dFuDFWgISrby8yOYj1XwZ0=,iv:WGof33ezbBpFmnWTWS9gzDayJpz2BVMTPsShYY+nuXY=,tag:pXWXkqqcXx746xu/0XhNtQ==,type:str]
     wireguard: ENC[AES256_GCM,data:kbUtxJv3xSmikJWgtu87TSo5N8tUb2BiH3dH3oOV36waYyXI3bp2aBeAl1k=,iv:yB4UIyMDNRS+JmSnt9XuBhNRTLz+k0FqkK4ofjosRto=,tag:BDSD9SfQuQppKT4+6Cu65w==,type:str]
 sops:
     kms: []
@@ -36,8 +36,8 @@ sops:
             OXgwSml4bkc1dnloNUFsRGFFcXFHc2cK26l2eiKbZUkogmAXoha6HTUs3YFKixYz
             bTkpKKyOAIIin3YM975wwvkCuWNG4tbnHBHQFh5JGK2OEyLDXuV7Pg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-01-09T06:00:27Z"
-    mac: ENC[AES256_GCM,data:PcxMwCjDMaL07OT8rtYxNDHmuL15AcTw5jrR/Z1Xu1FZGmc3SK0kr0nithHx+4hhqeq4dkk/w33WHrtW6ZAcu10PoO1jgzntN/PgzRRFcpGgf9VUShUpLp8NLK7yCABzCQNCqrRclgTeqsdUITONqf6ZjzHDhrvF+JxIGpdIWs4=,iv:2uSV2fWd+pDVOt3jZRXYs1YOO3F3aYsVOL5y9mDPSCc=,tag:6n6cuEljItK67O1oig7C8Q==,type:str]
+    lastmodified: "2024-02-01T06:10:26Z"
+    mac: ENC[AES256_GCM,data:6Gow3dOvqseuuNbpztmm3yNU+6DKo+2LPqigO1cDhmKB509RN/T9GqDQEk/uC/aOyYeYSWrQY3EzZYOXiXgyiH2hurYV8WXGAAjssXog9YaVcC+OiXXv2zDRV8o8VKigc0hlrZJuN8FeL0qxrorojBft0QR/6JhGpV+s1jvS/8o=,iv:wV/WKfl2HPFHX3aoIdMpuK5frVs9imeO6LI0igYi2+Q=,tag:IXs92PzvwQM3FGaHW/qU8Q==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1