This repository has no description
5.0 kB
205 lines
1{
2 lib,
3 ...
4}:
5let
6 ip4 = "95.217.192.59";
7 ip6 = "2a01:4f9:4a:4f1a::2";
8 # acmeChallenge = domain:
9 # pkgs.writeText "_acme-challenge.${domain}.zone" ''
10 # @ 3600 IN SOA _acme-challenge.${domain}. ns1.lassul.us. 2023101213 7200 3600 86400 3600
11
12 # $TTL 600
13
14 # @ IN NS ns1.lassul.us.
15 # '';
16 # dyndns = domain:
17 # pkgs.writeText "${domain}.zone" ''
18 # @ 3600 IN SOA ${domain}. ns1.lassul.us. 2023101213 7200 3600 86400 3600
19
20 # $TTL 300
21
22in
23# @ IN NS ns1.lassul.us.
24# '';
25{
26 #content of the secret
27 #key:
28 #- id: acme
29 # algorithm: hmac-sha256
30 # secret: 00000000000000000000000000000000000000000000
31 #nix-shell -p knot-dns --run 'keymgr -t my_name hmac-sha256'
32 # clanCore.vars.generators.knot = {
33 # files."knot-keys.conf" = {};
34 # generator = ''
35 # ${pkgs.knot-dns}/bin/keymgr -t hmac-sha256
36 # '';
37 # };
38
39 services.knot = {
40 enable = true;
41 # keyFiles = [
42 # config.sops.secrets."knot-keys.conf".path
43 # ];
44 settings = {
45 server = {
46 listen = [
47 "${ip4}@53"
48 "${ip6}@53"
49 ];
50 };
51
52 remote = [
53 {
54 id = "hetzner_ip4_1";
55 address = "213.239.242.238@53";
56 }
57 {
58 id = "hetzner_ip4_2";
59 address = "213.133.100.103@53";
60 }
61 {
62 id = "hetzner_ip4_3";
63 address = "193.47.99.3@53";
64 }
65 {
66 id = "hetzner_ip6_1";
67 address = "2a01:4f8:0:a101::a:1@53";
68 }
69 {
70 id = "hetzner_ip6_2";
71 address = "2a01:4f8:0:1::5ddc:2@53";
72 }
73 {
74 id = "hetzner_ip6_3";
75 address = "2001:67c:192c::add:a3";
76 }
77 ];
78
79 # to generate TSIG key
80 # for i in host; do keymgr -t $i; done
81 acl = [
82 {
83 id = "hetzner_ip4_1";
84 address = "213.239.242.238";
85 action = "transfer";
86 }
87 {
88 id = "hetzner_ip4_2";
89 address = "213.133.100.103";
90 action = "transfer";
91 }
92 {
93 id = "hetzner_ip4_3";
94 address = "193.47.99.3";
95 action = "transfer";
96 }
97 {
98 id = "hetzner_ip6_1";
99 address = "2a01:4f8:0:a101::a:1";
100 action = "transfer";
101 }
102 {
103 id = "hetzner_ip6_2";
104 address = "2a01:4f8:0:1::5ddc:2";
105 action = "transfer";
106 }
107 {
108 id = "hetzner_ip6_3";
109 address = "2001:67c:192c::add:a3";
110 action = "transfer";
111 }
112 ];
113
114 mod-rrl = [
115 {
116 id = "default";
117 rate-limit = 200;
118 slip = 2;
119 }
120 ];
121
122 policy = [
123 {
124 id = "rsa2k";
125 algorithm = "RSASHA256";
126 ksk-size = 4096;
127 zsk-size = 2048;
128 nsec3 = true;
129 }
130 ];
131
132 template = [
133 {
134 id = "default";
135 semantic-checks = "on";
136 global-module = "mod-rrl/default";
137 }
138 {
139 id = "master";
140 semantic-checks = "on";
141 notify = [
142 "hetzner_ip4_1"
143 "hetzner_ip4_2"
144 "hetzner_ip4_3"
145 "hetzner_ip6_1"
146 "hetzner_ip6_2"
147 "hetzner_ip6_3"
148 ];
149 acl = [
150 "hetzner_ip4_1"
151 "hetzner_ip4_2"
152 "hetzner_ip4_3"
153 "hetzner_ip6_1"
154 "hetzner_ip6_2"
155 "hetzner_ip6_3"
156 ];
157 zonefile-sync = "-1";
158 zonefile-load = "difference-no-serial";
159 serial-policy = "dateserial";
160 journal-content = "all";
161 }
162 ];
163
164 zone = [
165 {
166 domain = "lassul.us";
167 file = "${./lassul.us.zone}";
168 notify = [
169 "hetzner_ip4_1"
170 "hetzner_ip4_2"
171 "hetzner_ip4_3"
172 "hetzner_ip6_1"
173 "hetzner_ip6_2"
174 "hetzner_ip6_3"
175 ];
176 acl = [
177 "hetzner_ip4_1"
178 "hetzner_ip4_2"
179 "hetzner_ip4_3"
180 "hetzner_ip6_1"
181 "hetzner_ip6_2"
182 "hetzner_ip6_3"
183 ];
184 dnssec-signing = true;
185 dnssec-policy = "rsa2k";
186 # Disable zone file syncing since the zone file is in the read-only Nix store
187 # This prevents "flush event failed" errors when knot tries to write DNSSEC updates
188 zonefile-sync = "-1";
189 # Load zone changes from journal instead of rewriting the zone file
190 # Required when DNSSEC signing is enabled with read-only zone files
191 # Use difference-no-serial to auto-increment serial based on serial-policy
192 zonefile-load = "difference-no-serial";
193 serial-policy = "dateserial";
194 journal-content = "all";
195 }
196 ];
197 };
198 };
199
200 # disable to enable auto key generation
201 systemd.services.knot.serviceConfig.SystemCallFilter = lib.mkForce [ ];
202
203 networking.firewall.allowedTCPPorts = [ 53 ];
204 networking.firewall.allowedUDPPorts = [ 53 ];
205}