diff options
Diffstat (limited to 'hosts/kay/modules')
| -rw-r--r-- | hosts/kay/modules/dns/ddns.nix | 39 | ||||
| -rw-r--r-- | hosts/kay/modules/dns/default.nix | 75 | ||||
| -rw-r--r-- | hosts/kay/modules/dns/sinanmohd.com.zone | 25 | ||||
| -rw-r--r-- | hosts/kay/modules/hurricane.nix | 2 | ||||
| -rw-r--r-- | hosts/kay/modules/network.nix | 20 |
5 files changed, 145 insertions, 16 deletions
diff --git a/hosts/kay/modules/dns/ddns.nix b/hosts/kay/modules/dns/ddns.nix new file mode 100644 index 0000000..5b87968 --- /dev/null +++ b/hosts/kay/modules/dns/ddns.nix @@ -0,0 +1,39 @@ +{ pkgs, ... }: { + services.pppd.script = { + "02-ddns-ipv4" = { + runtimeInputs = with pkgs; [ coreutils knot-dns ]; + type = "ip-up"; + + text = '' + cat <<- EOF | knsupdate + server 2001:470:ee65::1 + zone sinanmohd.com. + + update delete sinanmohd.com. A + update add sinanmohd.com. 180 A $4 + + send + EOF + ''; + }; + + "02-ddns-ipv6" = { + runtimeInputs = with pkgs; [ coreutils knot-dns iproute2 gnugrep ]; + type = "ipv6-up"; + + text = '' + ipv6="$(ip -6 addr show dev $1 scope global | grep -o '[0-9a-f:]*::1')" + + cat <<- EOF | knsupdate + server 2001:470:ee65::1 + zone sinanmohd.com. + + update delete sinanmohd.com. AAAA + update add sinanmohd.com. 180 AAAA $ipv6 + + send + EOF + ''; + }; + }; +} diff --git a/hosts/kay/modules/dns/default.nix b/hosts/kay/modules/dns/default.nix new file mode 100644 index 0000000..5f287fd --- /dev/null +++ b/hosts/kay/modules/dns/default.nix @@ -0,0 +1,75 @@ +{ config, ... }: let + listen_addr = "2001:470:ee65::1"; +in { + imports = [ ./ddns.nix ]; + + networking.firewall = { + allowedTCPPorts = [ 53 ]; + allowedUDPPorts = [ 53 ]; + }; + + sops.secrets.dns = { + owner = config.systemd.services.knot.serviceConfig.User; + group = config.systemd.services.knot.serviceConfig.Group; + }; + + services.knot = { + enable = true; + keyFiles = [ config.sops.secrets.dns.path ]; + + settings = { + server.listen = listen_addr; + + remote = [{ + id = "ns1.he.net"; + address = [ "2001:470:100::2" "216.218.130.2" ]; + via = "2001:470:ee65::1"; + }]; + + # generate TSIG key with keymgr -t name + acl = [ + { + id = "ns1.he.net"; + key = "ns1.he.net"; + address = [ "2001:470:600::2" "216.218.133.2" ]; + action = "transfer"; + } + { + id = "localhost"; + address = [ listen_addr ]; + update-type = [ "A" "AAAA" ]; + action = "update"; + } + ]; + + mod-rrl = [{ + id = "default"; + rate-limit = 200; + slip = 2; + }]; + + template = [ + { + id = "default"; + semantic-checks = "on"; + global-module = "mod-rrl/default"; + } + { + id = "master"; + semantic-checks = "on"; + notify = [ "ns1.he.net" ]; + acl = [ "ns1.he.net" "localhost" ]; + zonefile-sync = "-1"; + zonefile-load = "difference"; + } + ]; + + zone = [{ + domain = "sinanmohd.com"; + file = ./sinanmohd.com.zone; + template = "master"; + }]; + }; + }; + +} diff --git a/hosts/kay/modules/dns/sinanmohd.com.zone b/hosts/kay/modules/dns/sinanmohd.com.zone new file mode 100644 index 0000000..9cff3c5 --- /dev/null +++ b/hosts/kay/modules/dns/sinanmohd.com.zone @@ -0,0 +1,25 @@ +$ORIGIN sinanmohd.com. +$TTL 2d + +@ IN SOA ns1 sinan ( + 2024020100 ; serial + 2h ; refresh + 5m ; retry + 1d ; expire + 5m ) ; nx ttl + + IN NS ns1 + IN NS ns2.he.net. + IN NS ns3.he.net. + IN NS ns4.he.net. + IN NS ns5.he.net. + + 30 IN A 127.0.0.1 + 30 IN AAAA ::1 + +ns1 IN AAAA 2001:470:ee65::1 + +www IN CNAME @ +git IN CNAME @ +bin IN CNAME @ +static IN CNAME @ diff --git a/hosts/kay/modules/hurricane.nix b/hosts/kay/modules/hurricane.nix index 1e44e2d..bb36628 100644 --- a/hosts/kay/modules/hurricane.nix +++ b/hosts/kay/modules/hurricane.nix @@ -91,7 +91,7 @@ in }; - services.pppd.script."02-${iface}" = { + services.pppd.script."01-${iface}" = { runtimeInputs = with pkgs; [ curl coreutils iproute2 iputils ]; text = '' wan_ip="$4" diff --git a/hosts/kay/modules/network.nix b/hosts/kay/modules/network.nix index 5e1b2ee..929fb1b 100644 --- a/hosts/kay/modules/network.nix +++ b/hosts/kay/modules/network.nix @@ -1,11 +1,10 @@ -{ config, pkgs, ... }: +{ config, ... }: let inetVlan = 722; voipVlan = 1849; wanInterface = "enp4s0"; nameServer = "1.0.0.1"; - domain = config.userdata.domain; in { imports = [ @@ -17,7 +16,6 @@ in "ppp/chap-secrets" = {}; "ppp/pap-secrets" = {}; "ppp/username" = {}; - "misc/namecheap.com" = {}; }; networking = let @@ -50,8 +48,10 @@ in bind-interfaces = true; }; }; + pppd = { enable = true; + config = '' plugin pppoe.so debug @@ -66,27 +66,17 @@ in lcp-echo-interval 1 lcp-echo-failure 5 ''; + peers.bsnl = { enable = true; autostart = true; configFile = config.sops.secrets."ppp/username".path; }; + secret = { chap = config.sops.secrets."ppp/chap-secrets".path; pap = config.sops.secrets."ppp/pap-secrets".path; }; - script."01-ddns" = { - runtimeInputs = with pkgs; [ curl coreutils ]; - text = '' - wan_ip="$4" - api_key="$(cat ${config.sops.secrets."misc/namecheap.com".path})" - auth_url="https://dynamicdns.park-your-domain.com/update?host=@&domain=${domain}&password=''${api_key}&ip=" - - until curl --silent "$auth_url$wan_ip"; do - sleep 1 - done - ''; - }; }; }; } |