summaryrefslogtreecommitdiff
path: root/hosts
diff options
context:
space:
mode:
Diffstat (limited to 'hosts')
-rw-r--r--hosts/kay/configuration.nix1
-rw-r--r--hosts/kay/modules/dns/ddns.nix39
-rw-r--r--hosts/kay/modules/dns/default.nix75
-rw-r--r--hosts/kay/modules/dns/sinanmohd.com.zone25
-rw-r--r--hosts/kay/modules/hurricane.nix2
-rw-r--r--hosts/kay/modules/network.nix20
-rw-r--r--hosts/kay/secrets.yaml6
7 files changed, 149 insertions, 19 deletions
diff --git a/hosts/kay/configuration.nix b/hosts/kay/configuration.nix
index ad10a96..7009a2a 100644
--- a/hosts/kay/configuration.nix
+++ b/hosts/kay/configuration.nix
@@ -6,6 +6,7 @@
./modules/network.nix
./modules/www.nix
./modules/sftp.nix
+ ./modules/dns
../../common.nix
];
diff --git a/hosts/kay/modules/dns/ddns.nix b/hosts/kay/modules/dns/ddns.nix
new file mode 100644
index 0000000..5b87968
--- /dev/null
+++ b/hosts/kay/modules/dns/ddns.nix
@@ -0,0 +1,39 @@
+{ pkgs, ... }: {
+ services.pppd.script = {
+ "02-ddns-ipv4" = {
+ runtimeInputs = with pkgs; [ coreutils knot-dns ];
+ type = "ip-up";
+
+ text = ''
+ cat <<- EOF | knsupdate
+ server 2001:470:ee65::1
+ zone sinanmohd.com.
+
+ update delete sinanmohd.com. A
+ update add sinanmohd.com. 180 A $4
+
+ send
+ EOF
+ '';
+ };
+
+ "02-ddns-ipv6" = {
+ runtimeInputs = with pkgs; [ coreutils knot-dns iproute2 gnugrep ];
+ type = "ipv6-up";
+
+ text = ''
+ ipv6="$(ip -6 addr show dev $1 scope global | grep -o '[0-9a-f:]*::1')"
+
+ cat <<- EOF | knsupdate
+ server 2001:470:ee65::1
+ zone sinanmohd.com.
+
+ update delete sinanmohd.com. AAAA
+ update add sinanmohd.com. 180 AAAA $ipv6
+
+ send
+ EOF
+ '';
+ };
+ };
+}
diff --git a/hosts/kay/modules/dns/default.nix b/hosts/kay/modules/dns/default.nix
new file mode 100644
index 0000000..5f287fd
--- /dev/null
+++ b/hosts/kay/modules/dns/default.nix
@@ -0,0 +1,75 @@
+{ config, ... }: let
+ listen_addr = "2001:470:ee65::1";
+in {
+ imports = [ ./ddns.nix ];
+
+ networking.firewall = {
+ allowedTCPPorts = [ 53 ];
+ allowedUDPPorts = [ 53 ];
+ };
+
+ sops.secrets.dns = {
+ owner = config.systemd.services.knot.serviceConfig.User;
+ group = config.systemd.services.knot.serviceConfig.Group;
+ };
+
+ services.knot = {
+ enable = true;
+ keyFiles = [ config.sops.secrets.dns.path ];
+
+ settings = {
+ server.listen = listen_addr;
+
+ remote = [{
+ id = "ns1.he.net";
+ address = [ "2001:470:100::2" "216.218.130.2" ];
+ via = "2001:470:ee65::1";
+ }];
+
+ # generate TSIG key with keymgr -t name
+ acl = [
+ {
+ id = "ns1.he.net";
+ key = "ns1.he.net";
+ address = [ "2001:470:600::2" "216.218.133.2" ];
+ action = "transfer";
+ }
+ {
+ id = "localhost";
+ address = [ listen_addr ];
+ update-type = [ "A" "AAAA" ];
+ action = "update";
+ }
+ ];
+
+ mod-rrl = [{
+ id = "default";
+ rate-limit = 200;
+ slip = 2;
+ }];
+
+ template = [
+ {
+ id = "default";
+ semantic-checks = "on";
+ global-module = "mod-rrl/default";
+ }
+ {
+ id = "master";
+ semantic-checks = "on";
+ notify = [ "ns1.he.net" ];
+ acl = [ "ns1.he.net" "localhost" ];
+ zonefile-sync = "-1";
+ zonefile-load = "difference";
+ }
+ ];
+
+ zone = [{
+ domain = "sinanmohd.com";
+ file = ./sinanmohd.com.zone;
+ template = "master";
+ }];
+ };
+ };
+
+}
diff --git a/hosts/kay/modules/dns/sinanmohd.com.zone b/hosts/kay/modules/dns/sinanmohd.com.zone
new file mode 100644
index 0000000..9cff3c5
--- /dev/null
+++ b/hosts/kay/modules/dns/sinanmohd.com.zone
@@ -0,0 +1,25 @@
+$ORIGIN sinanmohd.com.
+$TTL 2d
+
+@ IN SOA ns1 sinan (
+ 2024020100 ; serial
+ 2h ; refresh
+ 5m ; retry
+ 1d ; expire
+ 5m ) ; nx ttl
+
+ IN NS ns1
+ IN NS ns2.he.net.
+ IN NS ns3.he.net.
+ IN NS ns4.he.net.
+ IN NS ns5.he.net.
+
+ 30 IN A 127.0.0.1
+ 30 IN AAAA ::1
+
+ns1 IN AAAA 2001:470:ee65::1
+
+www IN CNAME @
+git IN CNAME @
+bin IN CNAME @
+static IN CNAME @
diff --git a/hosts/kay/modules/hurricane.nix b/hosts/kay/modules/hurricane.nix
index 1e44e2d..bb36628 100644
--- a/hosts/kay/modules/hurricane.nix
+++ b/hosts/kay/modules/hurricane.nix
@@ -91,7 +91,7 @@ in
};
- services.pppd.script."02-${iface}" = {
+ services.pppd.script."01-${iface}" = {
runtimeInputs = with pkgs; [ curl coreutils iproute2 iputils ];
text = ''
wan_ip="$4"
diff --git a/hosts/kay/modules/network.nix b/hosts/kay/modules/network.nix
index 5e1b2ee..929fb1b 100644
--- a/hosts/kay/modules/network.nix
+++ b/hosts/kay/modules/network.nix
@@ -1,11 +1,10 @@
-{ config, pkgs, ... }:
+{ config, ... }:
let
inetVlan = 722;
voipVlan = 1849;
wanInterface = "enp4s0";
nameServer = "1.0.0.1";
- domain = config.userdata.domain;
in
{
imports = [
@@ -17,7 +16,6 @@ in
"ppp/chap-secrets" = {};
"ppp/pap-secrets" = {};
"ppp/username" = {};
- "misc/namecheap.com" = {};
};
networking = let
@@ -50,8 +48,10 @@ in
bind-interfaces = true;
};
};
+
pppd = {
enable = true;
+
config = ''
plugin pppoe.so
debug
@@ -66,27 +66,17 @@ in
lcp-echo-interval 1
lcp-echo-failure 5
'';
+
peers.bsnl = {
enable = true;
autostart = true;
configFile = config.sops.secrets."ppp/username".path;
};
+
secret = {
chap = config.sops.secrets."ppp/chap-secrets".path;
pap = config.sops.secrets."ppp/pap-secrets".path;
};
- script."01-ddns" = {
- runtimeInputs = with pkgs; [ curl coreutils ];
- text = ''
- wan_ip="$4"
- api_key="$(cat ${config.sops.secrets."misc/namecheap.com".path})"
- auth_url="https://dynamicdns.park-your-domain.com/update?host=@&domain=${domain}&password=''${api_key}&ip="
-
- until curl --silent "$auth_url$wan_ip"; do
- sleep 1
- done
- '';
- };
};
};
}
diff --git a/hosts/kay/secrets.yaml b/hosts/kay/secrets.yaml
index ac5d61e..11bebda 100644
--- a/hosts/kay/secrets.yaml
+++ b/hosts/kay/secrets.yaml
@@ -6,11 +6,11 @@ hurricane:
username: ENC[AES256_GCM,data:pe3igN9AIbc1,iv:stBkppjkDC9nvV/fHaEtfs6KskoiqqEKxCp/KC+Xxeo=,tag:pH5CJXOOp/is7dQmt6wlog==,type:str]
update_key: ENC[AES256_GCM,data:wwd+QWTgKEqstY5d2eWBnWJYq2EisTTaa/Ow4WwBNkyh5FYP+7PEyg==,iv:b93JvsfWppqlJtZxGAa3xbXgLEFs0A5Seq5pNjTnRW4=,tag:+W1t1M+Mm4LopVbcI1x+eg==,type:str]
tunnel_id: ENC[AES256_GCM,data:WUDOxjmA,iv:W8k0pyrAQz+UWtm76uvmzodJ2lZG4ioxrVMWjX1kIVM=,tag:2Q25MXzlptg/rc0HQ1k6rg==,type:str]
+dns: ENC[AES256_GCM,data:Pa6Oo7UFDqo5ZN+eyz9MKy0p4KU1ePTpWQ+R8PuSFO9JjFt/I86ru/qSKyymIzhJcjj5hXMT2LPjk4MH8BWaO39ACsPDSD09xA6e1GO0rvsvtB9cffuz/GnfveyHmev+7xzdriD4IHqINPE=,iv:zuSfHnmxrjFCX3DJSRxLDs/3IVBRnkn3crar1pCW1EU=,tag:rZ0TlMMsOCF3Shunx8PnfA==,type:str]
matrix-sinanmohd.com:
key: ENC[AES256_GCM,data:xsSYua3g+ySUVBtfVZ2uZR4761MC5LeJGxmcgf+dWb5+tBSmgzAQL9FFcl7GLzhTmvlq13lARUr599wShS/C9IyMVGOOT9A8hxLFF9Kak64hmM7ERGrwbmzBY1mdTtvibJqzHaeybUVIMbDagczF54zpjDGLmdC5V84wduPFCndSA5FW+4Hhqw==,iv:KJtqrGNPgMDR6Sg/fOUzVAiwnPZwve9wpVfDQPc4g/c=,tag:E2jlbt5WbRA9wu16Lr69Bg==,type:str]
sliding_sync: ENC[AES256_GCM,data:ubFeb/OgYYHaIHVky6KS3icORbpqf7PO3p8bONA8mwG8vU1LB0TDqVm6vQTa8G9pe96JzJ8+IAgSZafG9PaEJc/Bpj53aWRFO3HEV0Pj,iv:P8VD8utVEwNoeQEZUdS2R9GuDe20nKiXYCfKJl0Id3E=,tag:VksV/4IaKN0C2g/alw6r4Q==,type:str]
misc:
- namecheap.com: ENC[AES256_GCM,data:DADZZitG7oLHKJzEJgVe8dFuDFWgISrby8yOYj1XwZ0=,iv:WGof33ezbBpFmnWTWS9gzDayJpz2BVMTPsShYY+nuXY=,tag:pXWXkqqcXx746xu/0XhNtQ==,type:str]
wireguard: ENC[AES256_GCM,data:kbUtxJv3xSmikJWgtu87TSo5N8tUb2BiH3dH3oOV36waYyXI3bp2aBeAl1k=,iv:yB4UIyMDNRS+JmSnt9XuBhNRTLz+k0FqkK4ofjosRto=,tag:BDSD9SfQuQppKT4+6Cu65w==,type:str]
sops:
kms: []
@@ -36,8 +36,8 @@ sops:
OXgwSml4bkc1dnloNUFsRGFFcXFHc2cK26l2eiKbZUkogmAXoha6HTUs3YFKixYz
bTkpKKyOAIIin3YM975wwvkCuWNG4tbnHBHQFh5JGK2OEyLDXuV7Pg==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2024-01-09T06:00:27Z"
- mac: ENC[AES256_GCM,data:PcxMwCjDMaL07OT8rtYxNDHmuL15AcTw5jrR/Z1Xu1FZGmc3SK0kr0nithHx+4hhqeq4dkk/w33WHrtW6ZAcu10PoO1jgzntN/PgzRRFcpGgf9VUShUpLp8NLK7yCABzCQNCqrRclgTeqsdUITONqf6ZjzHDhrvF+JxIGpdIWs4=,iv:2uSV2fWd+pDVOt3jZRXYs1YOO3F3aYsVOL5y9mDPSCc=,tag:6n6cuEljItK67O1oig7C8Q==,type:str]
+ lastmodified: "2024-02-01T06:10:26Z"
+ mac: ENC[AES256_GCM,data:6Gow3dOvqseuuNbpztmm3yNU+6DKo+2LPqigO1cDhmKB509RN/T9GqDQEk/uC/aOyYeYSWrQY3EzZYOXiXgyiH2hurYV8WXGAAjssXog9YaVcC+OiXXv2zDRV8o8VKigc0hlrZJuN8FeL0qxrorojBft0QR/6JhGpV+s1jvS/8o=,iv:wV/WKfl2HPFHX3aoIdMpuK5frVs9imeO6LI0igYi2+Q=,tag:IXs92PzvwQM3FGaHW/qU8Q==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1