From 1639b9467c64402434d41e426fd9e2f9ba8fdd9a Mon Sep 17 00:00:00 2001 From: sinanmohd Date: Tue, 30 Jan 2024 09:40:21 +0530 Subject: kay/dns: init --- hosts/kay/configuration.nix | 1 + hosts/kay/modules/dns/ddns.nix | 39 +++++++++++++++++ hosts/kay/modules/dns/default.nix | 75 ++++++++++++++++++++++++++++++++ hosts/kay/modules/dns/sinanmohd.com.zone | 25 +++++++++++ hosts/kay/modules/hurricane.nix | 2 +- hosts/kay/modules/network.nix | 20 +++------ hosts/kay/secrets.yaml | 6 +-- 7 files changed, 149 insertions(+), 19 deletions(-) create mode 100644 hosts/kay/modules/dns/ddns.nix create mode 100644 hosts/kay/modules/dns/default.nix create mode 100644 hosts/kay/modules/dns/sinanmohd.com.zone diff --git a/hosts/kay/configuration.nix b/hosts/kay/configuration.nix index ad10a96..7009a2a 100644 --- a/hosts/kay/configuration.nix +++ b/hosts/kay/configuration.nix @@ -6,6 +6,7 @@ ./modules/network.nix ./modules/www.nix ./modules/sftp.nix + ./modules/dns ../../common.nix ]; diff --git a/hosts/kay/modules/dns/ddns.nix b/hosts/kay/modules/dns/ddns.nix new file mode 100644 index 0000000..5b87968 --- /dev/null +++ b/hosts/kay/modules/dns/ddns.nix @@ -0,0 +1,39 @@ +{ pkgs, ... }: { + services.pppd.script = { + "02-ddns-ipv4" = { + runtimeInputs = with pkgs; [ coreutils knot-dns ]; + type = "ip-up"; + + text = '' + cat <<- EOF | knsupdate + server 2001:470:ee65::1 + zone sinanmohd.com. + + update delete sinanmohd.com. A + update add sinanmohd.com. 180 A $4 + + send + EOF + ''; + }; + + "02-ddns-ipv6" = { + runtimeInputs = with pkgs; [ coreutils knot-dns iproute2 gnugrep ]; + type = "ipv6-up"; + + text = '' + ipv6="$(ip -6 addr show dev $1 scope global | grep -o '[0-9a-f:]*::1')" + + cat <<- EOF | knsupdate + server 2001:470:ee65::1 + zone sinanmohd.com. + + update delete sinanmohd.com. AAAA + update add sinanmohd.com. 180 AAAA $ipv6 + + send + EOF + ''; + }; + }; +} diff --git a/hosts/kay/modules/dns/default.nix b/hosts/kay/modules/dns/default.nix new file mode 100644 index 0000000..5f287fd --- /dev/null +++ b/hosts/kay/modules/dns/default.nix @@ -0,0 +1,75 @@ +{ config, ... }: let + listen_addr = "2001:470:ee65::1"; +in { + imports = [ ./ddns.nix ]; + + networking.firewall = { + allowedTCPPorts = [ 53 ]; + allowedUDPPorts = [ 53 ]; + }; + + sops.secrets.dns = { + owner = config.systemd.services.knot.serviceConfig.User; + group = config.systemd.services.knot.serviceConfig.Group; + }; + + services.knot = { + enable = true; + keyFiles = [ config.sops.secrets.dns.path ]; + + settings = { + server.listen = listen_addr; + + remote = [{ + id = "ns1.he.net"; + address = [ "2001:470:100::2" "216.218.130.2" ]; + via = "2001:470:ee65::1"; + }]; + + # generate TSIG key with keymgr -t name + acl = [ + { + id = "ns1.he.net"; + key = "ns1.he.net"; + address = [ "2001:470:600::2" "216.218.133.2" ]; + action = "transfer"; + } + { + id = "localhost"; + address = [ listen_addr ]; + update-type = [ "A" "AAAA" ]; + action = "update"; + } + ]; + + mod-rrl = [{ + id = "default"; + rate-limit = 200; + slip = 2; + }]; + + template = [ + { + id = "default"; + semantic-checks = "on"; + global-module = "mod-rrl/default"; + } + { + id = "master"; + semantic-checks = "on"; + notify = [ "ns1.he.net" ]; + acl = [ "ns1.he.net" "localhost" ]; + zonefile-sync = "-1"; + zonefile-load = "difference"; + } + ]; + + zone = [{ + domain = "sinanmohd.com"; + file = ./sinanmohd.com.zone; + template = "master"; + }]; + }; + }; + +} diff --git a/hosts/kay/modules/dns/sinanmohd.com.zone b/hosts/kay/modules/dns/sinanmohd.com.zone new file mode 100644 index 0000000..9cff3c5 --- /dev/null +++ b/hosts/kay/modules/dns/sinanmohd.com.zone @@ -0,0 +1,25 @@ +$ORIGIN sinanmohd.com. +$TTL 2d + +@ IN SOA ns1 sinan ( + 2024020100 ; serial + 2h ; refresh + 5m ; retry + 1d ; expire + 5m ) ; nx ttl + + IN NS ns1 + IN NS ns2.he.net. + IN NS ns3.he.net. + IN NS ns4.he.net. + IN NS ns5.he.net. + + 30 IN A 127.0.0.1 + 30 IN AAAA ::1 + +ns1 IN AAAA 2001:470:ee65::1 + +www IN CNAME @ +git IN CNAME @ +bin IN CNAME @ +static IN CNAME @ diff --git a/hosts/kay/modules/hurricane.nix b/hosts/kay/modules/hurricane.nix index 1e44e2d..bb36628 100644 --- a/hosts/kay/modules/hurricane.nix +++ b/hosts/kay/modules/hurricane.nix @@ -91,7 +91,7 @@ in }; - services.pppd.script."02-${iface}" = { + services.pppd.script."01-${iface}" = { runtimeInputs = with pkgs; [ curl coreutils iproute2 iputils ]; text = '' wan_ip="$4" diff --git a/hosts/kay/modules/network.nix b/hosts/kay/modules/network.nix index 5e1b2ee..929fb1b 100644 --- a/hosts/kay/modules/network.nix +++ b/hosts/kay/modules/network.nix @@ -1,11 +1,10 @@ -{ config, pkgs, ... }: +{ config, ... }: let inetVlan = 722; voipVlan = 1849; wanInterface = "enp4s0"; nameServer = "1.0.0.1"; - domain = config.userdata.domain; in { imports = [ @@ -17,7 +16,6 @@ in "ppp/chap-secrets" = {}; "ppp/pap-secrets" = {}; "ppp/username" = {}; - "misc/namecheap.com" = {}; }; networking = let @@ -50,8 +48,10 @@ in bind-interfaces = true; }; }; + pppd = { enable = true; + config = '' plugin pppoe.so debug @@ -66,27 +66,17 @@ in lcp-echo-interval 1 lcp-echo-failure 5 ''; + peers.bsnl = { enable = true; autostart = true; configFile = config.sops.secrets."ppp/username".path; }; + secret = { chap = config.sops.secrets."ppp/chap-secrets".path; pap = config.sops.secrets."ppp/pap-secrets".path; }; - script."01-ddns" = { - runtimeInputs = with pkgs; [ curl coreutils ]; - text = '' - wan_ip="$4" - api_key="$(cat ${config.sops.secrets."misc/namecheap.com".path})" - auth_url="https://dynamicdns.park-your-domain.com/update?host=@&domain=${domain}&password=''${api_key}&ip=" - - until curl --silent "$auth_url$wan_ip"; do - sleep 1 - done - ''; - }; }; }; } diff --git a/hosts/kay/secrets.yaml b/hosts/kay/secrets.yaml index ac5d61e..11bebda 100644 --- a/hosts/kay/secrets.yaml +++ b/hosts/kay/secrets.yaml @@ -6,11 +6,11 @@ hurricane: username: ENC[AES256_GCM,data:pe3igN9AIbc1,iv:stBkppjkDC9nvV/fHaEtfs6KskoiqqEKxCp/KC+Xxeo=,tag:pH5CJXOOp/is7dQmt6wlog==,type:str] update_key: ENC[AES256_GCM,data:wwd+QWTgKEqstY5d2eWBnWJYq2EisTTaa/Ow4WwBNkyh5FYP+7PEyg==,iv:b93JvsfWppqlJtZxGAa3xbXgLEFs0A5Seq5pNjTnRW4=,tag:+W1t1M+Mm4LopVbcI1x+eg==,type:str] tunnel_id: ENC[AES256_GCM,data:WUDOxjmA,iv:W8k0pyrAQz+UWtm76uvmzodJ2lZG4ioxrVMWjX1kIVM=,tag:2Q25MXzlptg/rc0HQ1k6rg==,type:str] +dns: ENC[AES256_GCM,data:Pa6Oo7UFDqo5ZN+eyz9MKy0p4KU1ePTpWQ+R8PuSFO9JjFt/I86ru/qSKyymIzhJcjj5hXMT2LPjk4MH8BWaO39ACsPDSD09xA6e1GO0rvsvtB9cffuz/GnfveyHmev+7xzdriD4IHqINPE=,iv:zuSfHnmxrjFCX3DJSRxLDs/3IVBRnkn3crar1pCW1EU=,tag:rZ0TlMMsOCF3Shunx8PnfA==,type:str] matrix-sinanmohd.com: key: ENC[AES256_GCM,data:xsSYua3g+ySUVBtfVZ2uZR4761MC5LeJGxmcgf+dWb5+tBSmgzAQL9FFcl7GLzhTmvlq13lARUr599wShS/C9IyMVGOOT9A8hxLFF9Kak64hmM7ERGrwbmzBY1mdTtvibJqzHaeybUVIMbDagczF54zpjDGLmdC5V84wduPFCndSA5FW+4Hhqw==,iv:KJtqrGNPgMDR6Sg/fOUzVAiwnPZwve9wpVfDQPc4g/c=,tag:E2jlbt5WbRA9wu16Lr69Bg==,type:str] sliding_sync: ENC[AES256_GCM,data:ubFeb/OgYYHaIHVky6KS3icORbpqf7PO3p8bONA8mwG8vU1LB0TDqVm6vQTa8G9pe96JzJ8+IAgSZafG9PaEJc/Bpj53aWRFO3HEV0Pj,iv:P8VD8utVEwNoeQEZUdS2R9GuDe20nKiXYCfKJl0Id3E=,tag:VksV/4IaKN0C2g/alw6r4Q==,type:str] misc: - namecheap.com: ENC[AES256_GCM,data:DADZZitG7oLHKJzEJgVe8dFuDFWgISrby8yOYj1XwZ0=,iv:WGof33ezbBpFmnWTWS9gzDayJpz2BVMTPsShYY+nuXY=,tag:pXWXkqqcXx746xu/0XhNtQ==,type:str] wireguard: ENC[AES256_GCM,data:kbUtxJv3xSmikJWgtu87TSo5N8tUb2BiH3dH3oOV36waYyXI3bp2aBeAl1k=,iv:yB4UIyMDNRS+JmSnt9XuBhNRTLz+k0FqkK4ofjosRto=,tag:BDSD9SfQuQppKT4+6Cu65w==,type:str] sops: kms: [] @@ -36,8 +36,8 @@ sops: OXgwSml4bkc1dnloNUFsRGFFcXFHc2cK26l2eiKbZUkogmAXoha6HTUs3YFKixYz bTkpKKyOAIIin3YM975wwvkCuWNG4tbnHBHQFh5JGK2OEyLDXuV7Pg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-01-09T06:00:27Z" - mac: ENC[AES256_GCM,data:PcxMwCjDMaL07OT8rtYxNDHmuL15AcTw5jrR/Z1Xu1FZGmc3SK0kr0nithHx+4hhqeq4dkk/w33WHrtW6ZAcu10PoO1jgzntN/PgzRRFcpGgf9VUShUpLp8NLK7yCABzCQNCqrRclgTeqsdUITONqf6ZjzHDhrvF+JxIGpdIWs4=,iv:2uSV2fWd+pDVOt3jZRXYs1YOO3F3aYsVOL5y9mDPSCc=,tag:6n6cuEljItK67O1oig7C8Q==,type:str] + lastmodified: "2024-02-01T06:10:26Z" + mac: ENC[AES256_GCM,data:6Gow3dOvqseuuNbpztmm3yNU+6DKo+2LPqigO1cDhmKB509RN/T9GqDQEk/uC/aOyYeYSWrQY3EzZYOXiXgyiH2hurYV8WXGAAjssXog9YaVcC+OiXXv2zDRV8o8VKigc0hlrZJuN8FeL0qxrorojBft0QR/6JhGpV+s1jvS/8o=,iv:wV/WKfl2HPFHX3aoIdMpuK5frVs9imeO6LI0igYi2+Q=,tag:IXs92PzvwQM3FGaHW/qU8Q==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1 -- cgit v1.2.3