This repository has no description
3.5 kB
145 lines
1{ pkgs
2, config
3, lib
4, inputs
5, ...
6}:
7let
8 ip4 = "95.217.192.59";
9 ip6 = "2a01:4f9:4a:4f1a::2";
10 # acmeChallenge = domain:
11 # pkgs.writeText "_acme-challenge.${domain}.zone" ''
12 # @ 3600 IN SOA _acme-challenge.${domain}. ns1.lassul.us. 2023101213 7200 3600 86400 3600
13
14 # $TTL 600
15
16 # @ IN NS ns1.lassul.us.
17 # '';
18 # dyndns = domain:
19 # pkgs.writeText "${domain}.zone" ''
20 # @ 3600 IN SOA ${domain}. ns1.lassul.us. 2023101213 7200 3600 86400 3600
21
22 # $TTL 300
23
24 # @ IN NS ns1.lassul.us.
25 # '';
26in
27{
28 #content of the secret
29 #key:
30 #- id: acme
31 # algorithm: hmac-sha256
32 # secret: 00000000000000000000000000000000000000000000
33 #nix-shell -p knot-dns --run 'keymgr -t my_name hmac-sha256'
34 # clanCore.facts.services.knot = {
35 # secret."knot-keys.conf" = {};
36 # generator = ''
37 # ${pkgs.knot-dns}/bin/keymgr -t hmac-sha256
38 # '';
39 # };
40
41 services.knot = {
42 enable = true;
43 # keyFiles = [
44 # config.sops.secrets."knot-keys.conf".path
45 # ];
46 settings = {
47 server = {
48 listen = [ "${ip4}@53" "${ip6}@53" ];
49 };
50
51 remote = [
52 {
53 id = "hetzner_ip4_1";
54 address = "213.239.242.238@53";
55 }
56 {
57 id = "hetzner_ip4_2";
58 address = "213.133.105.6@53";
59 }
60 {
61 id = "hetzner_ip4_3";
62 address = "193.47.99.3@53";
63 }
64 {
65 id = "hetzner_ip6_1";
66 address = "2a01:4f8:0:a101::a:1@53";
67 }
68 {
69 id = "hetzner_ip6_2";
70 address = "2a01:4f8:d0a:2004::2@53";
71 }
72 {
73 id = "hetzner_ip6_3";
74 address = "2001:67c:192c::add:a3";
75 }
76 ];
77
78 # to generate TSIG key
79 # for i in host; do keymgr -t $i; done
80 acl = [
81 {
82 id = "hetzner_ip4_1";
83 address = "213.239.242.238";
84 action = "transfer";
85 }
86 {
87 id = "hetzner_ip4_2";
88 address = "213.133.105.6";
89 action = "transfer";
90 }
91 {
92 id = "hetzner_ip4_3";
93 address = "193.47.99.3";
94 action = "transfer";
95 }
96 {
97 id = "hetzner_ip6_1";
98 address = "2a01:4f8:0:a101::a:1";
99 action = "transfer";
100 }
101 {
102 id = "hetzner_ip6_2";
103 address = "2a01:4f8:d0a:2004::2";
104 action = "transfer";
105 }
106 {
107 id = "hetzner_ip6_3";
108 address = "2001:67c:192c::add:a3";
109 action = "transfer";
110 }
111 ];
112
113 mod-rrl = [{
114 id = "default";
115 rate-limit = 200;
116 slip = 2;
117 }];
118
119 policy = [{
120 id = "rsa2k";
121 algorithm = "RSASHA256";
122 ksk-size = 4096;
123 zsk-size = 2048;
124 nsec3 = true;
125 }];
126
127 zone = [
128 {
129 domain = "lassul.us";
130 file = "${./lassul.us.zone}";
131 notify = [ "hetzner_ip4_1" "hetzner_ip4_2" "hetzner_ip4_3" "hetzner_ip6_1" "hetzner_ip6_2" "hetzner_ip6_3" ];
132 acl = [ "hetzner_ip4_1" "hetzner_ip4_2" "hetzner_ip4_3" "hetzner_ip6_1" "hetzner_ip6_2" "hetzner_ip6_3" ];
133 dnssec-signing = true;
134 dnssec-policy = "rsa2k";
135 }
136 ];
137 };
138 };
139
140 # disable to enable auto key generation
141 systemd.services.knot.serviceConfig.SystemCallFilter = lib.mkForce [];
142
143 networking.firewall.allowedTCPPorts = [ 53 ];
144 networking.firewall.allowedUDPPorts = [ 53 ];
145}