This repository has no description
3.7 kB
164 lines
1{
2 lib,
3 ...
4}:
5let
6 ip4 = "95.217.192.59";
7 ip6 = "2a01:4f9:4a:4f1a::2";
8 # acmeChallenge = domain:
9 # pkgs.writeText "_acme-challenge.${domain}.zone" ''
10 # @ 3600 IN SOA _acme-challenge.${domain}. ns1.lassul.us. 2023101213 7200 3600 86400 3600
11
12 # $TTL 600
13
14 # @ IN NS ns1.lassul.us.
15 # '';
16 # dyndns = domain:
17 # pkgs.writeText "${domain}.zone" ''
18 # @ 3600 IN SOA ${domain}. ns1.lassul.us. 2023101213 7200 3600 86400 3600
19
20 # $TTL 300
21
22in
23# @ IN NS ns1.lassul.us.
24# '';
25{
26 #content of the secret
27 #key:
28 #- id: acme
29 # algorithm: hmac-sha256
30 # secret: 00000000000000000000000000000000000000000000
31 #nix-shell -p knot-dns --run 'keymgr -t my_name hmac-sha256'
32 # clanCore.facts.services.knot = {
33 # secret."knot-keys.conf" = {};
34 # generator = ''
35 # ${pkgs.knot-dns}/bin/keymgr -t hmac-sha256
36 # '';
37 # };
38
39 services.knot = {
40 enable = true;
41 # keyFiles = [
42 # config.sops.secrets."knot-keys.conf".path
43 # ];
44 settings = {
45 server = {
46 listen = [
47 "${ip4}@53"
48 "${ip6}@53"
49 ];
50 };
51
52 remote = [
53 {
54 id = "hetzner_ip4_1";
55 address = "213.239.242.238@53";
56 }
57 {
58 id = "hetzner_ip4_2";
59 address = "213.133.105.6@53";
60 }
61 {
62 id = "hetzner_ip4_3";
63 address = "193.47.99.3@53";
64 }
65 {
66 id = "hetzner_ip6_1";
67 address = "2a01:4f8:0:a101::a:1@53";
68 }
69 {
70 id = "hetzner_ip6_2";
71 address = "2a01:4f8:d0a:2004::2@53";
72 }
73 {
74 id = "hetzner_ip6_3";
75 address = "2001:67c:192c::add:a3";
76 }
77 ];
78
79 # to generate TSIG key
80 # for i in host; do keymgr -t $i; done
81 acl = [
82 {
83 id = "hetzner_ip4_1";
84 address = "213.239.242.238";
85 action = "transfer";
86 }
87 {
88 id = "hetzner_ip4_2";
89 address = "213.133.100.103";
90 action = "transfer";
91 }
92 {
93 id = "hetzner_ip4_3";
94 address = "193.47.99.3";
95 action = "transfer";
96 }
97 {
98 id = "hetzner_ip6_1";
99 address = "2a01:4f8:0:a101::a:1";
100 action = "transfer";
101 }
102 {
103 id = "hetzner_ip6_2";
104 address = "2a01:4f8:0:1::5ddc:2";
105 action = "transfer";
106 }
107 {
108 id = "hetzner_ip6_3";
109 address = "2001:67c:192c::add:a3";
110 action = "transfer";
111 }
112 ];
113
114 mod-rrl = [
115 {
116 id = "default";
117 rate-limit = 200;
118 slip = 2;
119 }
120 ];
121
122 policy = [
123 {
124 id = "rsa2k";
125 algorithm = "RSASHA256";
126 ksk-size = 4096;
127 zsk-size = 2048;
128 nsec3 = true;
129 }
130 ];
131
132 zone = [
133 {
134 domain = "lassul.us";
135 file = "${./lassul.us.zone}";
136 notify = [
137 "hetzner_ip4_1"
138 "hetzner_ip4_2"
139 "hetzner_ip4_3"
140 "hetzner_ip6_1"
141 "hetzner_ip6_2"
142 "hetzner_ip6_3"
143 ];
144 acl = [
145 "hetzner_ip4_1"
146 "hetzner_ip4_2"
147 "hetzner_ip4_3"
148 "hetzner_ip6_1"
149 "hetzner_ip6_2"
150 "hetzner_ip6_3"
151 ];
152 dnssec-signing = true;
153 dnssec-policy = "rsa2k";
154 }
155 ];
156 };
157 };
158
159 # disable to enable auto key generation
160 systemd.services.knot.serviceConfig.SystemCallFilter = lib.mkForce [ ];
161
162 networking.firewall.allowedTCPPorts = [ 53 ];
163 networking.firewall.allowedUDPPorts = [ 53 ];
164}