kay/dns: init

3 files changed, 139 insertions, 0 deletions

diff --git a/hosts/kay/modules/dns/ddns.nix b/hosts/kay/modules/dns/ddns.nix
new file mode 100644
index 0000000..5b87968
--- /dev/null
+++ b/hosts/kay/modules/dns/ddns.nix
@@ -0,0 +1,39 @@
+{ pkgs,  ... }: {
+   services.pppd.script = {
+      "02-ddns-ipv4" = {
+         runtimeInputs = with pkgs; [ coreutils knot-dns ];
+         type = "ip-up";
+
+         text = ''
+            cat <<- EOF | knsupdate
+                    server  2001:470:ee65::1
+                    zone    sinanmohd.com.
+
+                    update  delete  sinanmohd.com.  A
+                    update  add     sinanmohd.com.  180     A       $4
+
+                    send
+            EOF
+         '';
+       };
+
+      "02-ddns-ipv6" = {
+         runtimeInputs = with pkgs; [ coreutils knot-dns iproute2 gnugrep ];
+         type = "ipv6-up";
+
+         text = ''
+            ipv6="$(ip -6 addr show dev $1 scope global | grep -o '[0-9a-f:]*::1')"
+
+            cat <<- EOF | knsupdate
+                    server  2001:470:ee65::1
+                    zone    sinanmohd.com.
+
+                    update  delete  sinanmohd.com.  AAAA
+                    update  add     sinanmohd.com.  180     AAAA    $ipv6
+
+                    send
+            EOF
+         '';
+       };
+    };
+}
diff --git a/hosts/kay/modules/dns/default.nix b/hosts/kay/modules/dns/default.nix
new file mode 100644
index 0000000..5f287fd
--- /dev/null
+++ b/hosts/kay/modules/dns/default.nix
@@ -0,0 +1,75 @@
+{ config, ... }: let
+  listen_addr = "2001:470:ee65::1";
+in {
+  imports = [ ./ddns.nix ];
+
+  networking.firewall = {
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 ];
+  };
+
+  sops.secrets.dns = {
+    owner = config.systemd.services.knot.serviceConfig.User;
+    group = config.systemd.services.knot.serviceConfig.Group;
+  };
+
+  services.knot = {
+    enable = true;
+    keyFiles = [ config.sops.secrets.dns.path ];
+
+    settings = {
+      server.listen = listen_addr;
+
+      remote = [{
+        id = "ns1.he.net";
+        address = [ "2001:470:100::2" "216.218.130.2" ];
+        via = "2001:470:ee65::1";
+      }];
+
+      # generate TSIG key with keymgr -t name
+      acl = [
+        {
+          id = "ns1.he.net";
+          key = "ns1.he.net";
+          address = [ "2001:470:600::2" "216.218.133.2" ];
+          action = "transfer";
+        }
+        {
+          id = "localhost";
+          address = [ listen_addr ];
+          update-type = [ "A" "AAAA" ];
+          action = "update";
+        }
+      ];
+
+      mod-rrl = [{
+        id = "default";
+        rate-limit = 200;
+        slip = 2;
+      }];
+
+      template = [
+        {
+          id = "default";
+          semantic-checks = "on";
+          global-module = "mod-rrl/default";
+        }
+        {
+          id = "master";
+          semantic-checks = "on";
+          notify = [ "ns1.he.net" ];
+          acl = [ "ns1.he.net" "localhost" ];
+          zonefile-sync = "-1";
+          zonefile-load = "difference";
+        }
+      ];
+
+      zone = [{
+        domain = "sinanmohd.com";
+        file = ./sinanmohd.com.zone;
+        template = "master";
+      }];
+    };
+  };
+
+}
diff --git a/hosts/kay/modules/dns/sinanmohd.com.zone b/hosts/kay/modules/dns/sinanmohd.com.zone
new file mode 100644
index 0000000..9cff3c5
--- /dev/null
+++ b/hosts/kay/modules/dns/sinanmohd.com.zone
@@ -0,0 +1,25 @@
+$ORIGIN sinanmohd.com.
+$TTL 2d
+
+@	IN	SOA	ns1	sinan (
+			2024020100 ; serial
+			2h         ; refresh
+			5m         ; retry
+			1d         ; expire
+			5m )       ; nx ttl
+
+	IN	NS	ns1
+	IN	NS	ns2.he.net.
+	IN	NS	ns3.he.net.
+	IN	NS	ns4.he.net.
+	IN	NS	ns5.he.net.
+
+     30	IN	A	127.0.0.1
+     30	IN	AAAA	::1
+
+ns1	IN	AAAA	2001:470:ee65::1
+
+www	IN	CNAME	@
+git	IN	CNAME	@
+bin	IN	CNAME	@
+static	IN	CNAME	@