summaryrefslogblamecommitdiff
path: root/hosts/kay/modules/dns/default.nix
blob: 28e48c5f44b14c375f804011c7833b1c4be19cad (plain) (tree) 
1639b94






















858795d






















1639b94
































858795d


1639b94








a02000c











1639b94




1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

77
78

79
80
81
82
83
84
85
86

87
88
89
90
91
92
93
94
95
96
97

98
99
100
101






















                                                             





















                                                            































                                                          

                                             







                                             










                                                         



      
{ config, ... }: let
  listen_addr = "2001:470:ee65::1";
in {
  imports = [ ./ddns.nix ];

  networking.firewall = {
    allowedTCPPorts = [ 53 ];
    allowedUDPPorts = [ 53 ];
  };

  sops.secrets.dns = {
    owner = config.systemd.services.knot.serviceConfig.User;
    group = config.systemd.services.knot.serviceConfig.Group;
  };

  services.knot = {
    enable = true;
    keyFiles = [ config.sops.secrets.dns.path ];

    settings = {
      server.listen = listen_addr;

      remote = [
        {
          id = "ns1.he.net";
          address = [ "2001:470:100::2" "216.218.130.2" ];
          via = "2001:470:ee65::1";
        }
        {
          id = "m.gtld-servers.net";
          address = [ "2001:501:b1f9::30"  "192.55.83.30" ];
        }
      ];

      submission = [{
        id = "gtld-servers.net";
        parent = "m.gtld-servers.net";
      }];

      policy = [{
        id = "gtld-servers.net";
        algorithm = "ecdsap384sha384";
        ksk-lifetime = "365d";
        ksk-submission = "gtld-servers.net";
      }];

      # generate TSIG key with keymgr -t name
      acl = [
        {
          id = "ns1.he.net";
          key = "ns1.he.net";
          address = [ "2001:470:600::2" "216.218.133.2" ];
          action = "transfer";
        }
        {
          id = "localhost";
          address = [ listen_addr ];
          update-type = [ "A" "AAAA" ];
          action = "update";
        }
      ];

      mod-rrl = [{
        id = "default";
        rate-limit = 200;
        slip = 2;
      }];

      template = [
        {
          id = "default";
          semantic-checks = "on";
          global-module = "mod-rrl/default";
        }
        {
          id = "master";
          dnssec-signing = "on";
          dnssec-policy = "gtld-servers.net";
          semantic-checks = "on";
          notify = [ "ns1.he.net" ];
          acl = [ "ns1.he.net" "localhost" ];
          zonefile-sync = "-1";
          zonefile-load = "difference";
        }
      ];

      zone = [
        {
          domain = "sinanmohd.com";
          file = ./sinanmohd.com.zone;
          template = "master";
        }
        {
          domain = "5.6.e.e.0.7.4.0.1.0.0.2.ip6.arpa";
          file = ./5.6.e.e.0.7.4.0.1.0.0.2.ip6.arpa.zone;
        }
      ];
    };
  };

}