kay/dns: init

5 files changed, 145 insertions, 16 deletions

diff --git a/hosts/kay/modules/dns/ddns.nix b/hosts/kay/modules/dns/ddns.nix
new file mode 100644
index 0000000..5b87968
--- /dev/null
+++ b/hosts/kay/modules/dns/ddns.nix
@@ -0,0 +1,39 @@
+{ pkgs,  ... }: {
+   services.pppd.script = {
+      "02-ddns-ipv4" = {
+         runtimeInputs = with pkgs; [ coreutils knot-dns ];
+         type = "ip-up";
+
+         text = ''
+            cat <<- EOF | knsupdate
+                    server  2001:470:ee65::1
+                    zone    sinanmohd.com.
+
+                    update  delete  sinanmohd.com.  A
+                    update  add     sinanmohd.com.  180     A       $4
+
+                    send
+            EOF
+         '';
+       };
+
+      "02-ddns-ipv6" = {
+         runtimeInputs = with pkgs; [ coreutils knot-dns iproute2 gnugrep ];
+         type = "ipv6-up";
+
+         text = ''
+            ipv6="$(ip -6 addr show dev $1 scope global | grep -o '[0-9a-f:]*::1')"
+
+            cat <<- EOF | knsupdate
+                    server  2001:470:ee65::1
+                    zone    sinanmohd.com.
+
+                    update  delete  sinanmohd.com.  AAAA
+                    update  add     sinanmohd.com.  180     AAAA    $ipv6
+
+                    send
+            EOF
+         '';
+       };
+    };
+}
diff --git a/hosts/kay/modules/dns/default.nix b/hosts/kay/modules/dns/default.nix
new file mode 100644
index 0000000..5f287fd
--- /dev/null
+++ b/hosts/kay/modules/dns/default.nix
@@ -0,0 +1,75 @@
+{ config, ... }: let
+  listen_addr = "2001:470:ee65::1";
+in {
+  imports = [ ./ddns.nix ];
+
+  networking.firewall = {
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 ];
+  };
+
+  sops.secrets.dns = {
+    owner = config.systemd.services.knot.serviceConfig.User;
+    group = config.systemd.services.knot.serviceConfig.Group;
+  };
+
+  services.knot = {
+    enable = true;
+    keyFiles = [ config.sops.secrets.dns.path ];
+
+    settings = {
+      server.listen = listen_addr;
+
+      remote = [{
+        id = "ns1.he.net";
+        address = [ "2001:470:100::2" "216.218.130.2" ];
+        via = "2001:470:ee65::1";
+      }];
+
+      # generate TSIG key with keymgr -t name
+      acl = [
+        {
+          id = "ns1.he.net";
+          key = "ns1.he.net";
+          address = [ "2001:470:600::2" "216.218.133.2" ];
+          action = "transfer";
+        }
+        {
+          id = "localhost";
+          address = [ listen_addr ];
+          update-type = [ "A" "AAAA" ];
+          action = "update";
+        }
+      ];
+
+      mod-rrl = [{
+        id = "default";
+        rate-limit = 200;
+        slip = 2;
+      }];
+
+      template = [
+        {
+          id = "default";
+          semantic-checks = "on";
+          global-module = "mod-rrl/default";
+        }
+        {
+          id = "master";
+          semantic-checks = "on";
+          notify = [ "ns1.he.net" ];
+          acl = [ "ns1.he.net" "localhost" ];
+          zonefile-sync = "-1";
+          zonefile-load = "difference";
+        }
+      ];
+
+      zone = [{
+        domain = "sinanmohd.com";
+        file = ./sinanmohd.com.zone;
+        template = "master";
+      }];
+    };
+  };
+
+}
diff --git a/hosts/kay/modules/dns/sinanmohd.com.zone b/hosts/kay/modules/dns/sinanmohd.com.zone
new file mode 100644
index 0000000..9cff3c5
--- /dev/null
+++ b/hosts/kay/modules/dns/sinanmohd.com.zone
@@ -0,0 +1,25 @@
+$ORIGIN sinanmohd.com.
+$TTL 2d
+
+@	IN	SOA	ns1	sinan (
+			2024020100 ; serial
+			2h         ; refresh
+			5m         ; retry
+			1d         ; expire
+			5m )       ; nx ttl
+
+	IN	NS	ns1
+	IN	NS	ns2.he.net.
+	IN	NS	ns3.he.net.
+	IN	NS	ns4.he.net.
+	IN	NS	ns5.he.net.
+
+     30	IN	A	127.0.0.1
+     30	IN	AAAA	::1
+
+ns1	IN	AAAA	2001:470:ee65::1
+
+www	IN	CNAME	@
+git	IN	CNAME	@
+bin	IN	CNAME	@
+static	IN	CNAME	@
diff --git a/hosts/kay/modules/hurricane.nix b/hosts/kay/modules/hurricane.nix
index 1e44e2d..bb36628 100644
--- a/hosts/kay/modules/hurricane.nix
+++ b/hosts/kay/modules/hurricane.nix
@@ -91,7 +91,7 @@ in
   };
 
 
-  services.pppd.script."02-${iface}" = {
+  services.pppd.script."01-${iface}" = {
     runtimeInputs = with pkgs; [ curl coreutils iproute2 iputils ];
     text = ''
       wan_ip="$4"
diff --git a/hosts/kay/modules/network.nix b/hosts/kay/modules/network.nix
index 5e1b2ee..929fb1b 100644
--- a/hosts/kay/modules/network.nix
+++ b/hosts/kay/modules/network.nix
@@ -1,11 +1,10 @@
-{ config, pkgs, ... }:
+{ config, ... }:
 
 let
   inetVlan = 722;
   voipVlan = 1849;
   wanInterface = "enp4s0";
   nameServer = "1.0.0.1";
-  domain = config.userdata.domain;
 in
 {
   imports = [
@@ -17,7 +16,6 @@ in
     "ppp/chap-secrets" = {};
     "ppp/pap-secrets" = {};
     "ppp/username" = {};
-    "misc/namecheap.com" = {};
   };
 
   networking = let
@@ -50,8 +48,10 @@ in
         bind-interfaces = true;
       };
     };
+
     pppd = {
       enable = true;
+
       config = ''
         plugin pppoe.so
         debug
@@ -66,27 +66,17 @@ in
         lcp-echo-interval 1
         lcp-echo-failure 5
       '';
+
       peers.bsnl = {
         enable = true;
         autostart = true;
         configFile = config.sops.secrets."ppp/username".path;
       };
+
       secret = {
         chap = config.sops.secrets."ppp/chap-secrets".path;
         pap = config.sops.secrets."ppp/pap-secrets".path;
       };
-      script."01-ddns" = {
-        runtimeInputs = with pkgs; [ curl coreutils ];
-        text = ''
-          wan_ip="$4"
-          api_key="$(cat ${config.sops.secrets."misc/namecheap.com".path})"
-          auth_url="https://dynamicdns.park-your-domain.com/update?host=@&domain=${domain}&password=''${api_key}&ip="
-
-          until curl --silent "$auth_url$wan_ip"; do
-              sleep 1
-          done
-        '';
-      };
     };
   };
 }