This repository has no description
2configs: init dns config
author
lassulus
date
(Oct 15, 2023, 9:46 AM CEST)
commit
fad436d0
fad436d0e19d3d95b8089dc65cc59e70d90e3db2
parent
a66c0b1f
a66c0b1f1b1b72b7bceaa45952addb88d9ad3dd7
+200
+142
2configs/dns/knot.nix
+142
2configs/dns/knot.nix
···
1
+
{ pkgs
2
+
, config
3
+
, lib
4
+
, inputs
5
+
, ...
6
+
}:
7
+
let
8
+
ip4 = "95.217.192.59";
9
+
ip6 = "2a01:4f9:4a:4f1a::2";
10
+
# acmeChallenge = domain:
11
+
# pkgs.writeText "_acme-challenge.${domain}.zone" ''
12
+
# @ 3600 IN SOA _acme-challenge.${domain}. ns1.lassul.us. 2023101213 7200 3600 86400 3600
13
+
14
+
# $TTL 600
15
+
16
+
# @ IN NS ns1.lassul.us.
17
+
# '';
18
+
# dyndns = domain:
19
+
# pkgs.writeText "${domain}.zone" ''
20
+
# @ 3600 IN SOA ${domain}. ns1.lassul.us. 2023101213 7200 3600 86400 3600
21
+
22
+
# $TTL 300
23
+
24
+
# @ IN NS ns1.lassul.us.
25
+
# '';
26
+
in
27
+
{
28
+
#content of the secret
29
+
#key:
30
+
#- id: acme
31
+
# algorithm: hmac-sha256
32
+
# secret: 00000000000000000000000000000000000000000000
33
+
#nix-shell -p knot-dns --run 'keymgr -t my_name hmac-sha256'
34
+
# clanCore.secrets.knot = {
35
+
# secrets."knot-keys.conf" = {};
36
+
# generator = ''
37
+
# ${pkgs.knot-dns}/bin/keymgr -t hmac-sha256
38
+
# '';
39
+
# };
40
+
41
+
services.knot = {
42
+
enable = true;
43
+
# keyFiles = [
44
+
# config.sops.secrets."knot-keys.conf".path
45
+
# ];
46
+
settings = {
47
+
server = {
48
+
listen = [ "${ip4}@53" "${ip6}@53" ];
49
+
};
50
+
51
+
remote = [
52
+
{
53
+
id = "hetzner_ip4_1";
54
+
address = "213.239.242.238@53";
55
+
}
56
+
{
57
+
id = "hetzner_ip4_2";
58
+
address = "213.133.105.6@53";
59
+
}
60
+
{
61
+
id = "hetzner_ip4_3";
62
+
address = "193.47.99.3@53";
63
+
}
64
+
{
65
+
id = "hetzner_ip6_1";
66
+
address = "2a01:4f8:0:a101::a:1@53";
67
+
}
68
+
{
69
+
id = "hetzner_ip6_2";
70
+
address = "2a01:4f8:d0a:2004::2@53";
71
+
}
72
+
{
73
+
id = "hetzner_ip6_3";
74
+
address = "2001:67c:192c::add:a3";
75
+
}
76
+
];
77
+
78
+
# to generate TSIG key
79
+
# for i in host; do keymgr -t $i; done
80
+
acl = [
81
+
{
82
+
id = "hetzner_ip4_1";
83
+
address = "213.239.242.238";
84
+
action = "transfer";
85
+
}
86
+
{
87
+
id = "hetzner_ip4_2";
88
+
address = "213.133.105.6";
89
+
action = "transfer";
90
+
}
91
+
{
92
+
id = "hetzner_ip4_3";
93
+
address = "193.47.99.3";
94
+
action = "transfer";
95
+
}
96
+
{
97
+
id = "hetzner_ip6_1";
98
+
address = "2a01:4f8:0:a101::a:1";
99
+
action = "transfer";
100
+
}
101
+
{
102
+
id = "hetzner_ip6_2";
103
+
address = "2a01:4f8:d0a:2004::2";
104
+
action = "transfer";
105
+
}
106
+
{
107
+
id = "hetzner_ip6_3";
108
+
address = "2001:67c:192c::add:a3";
109
+
action = "transfer";
110
+
}
111
+
];
112
+
113
+
mod-rrl = [{
114
+
id = "default";
115
+
rate-limit = 200;
116
+
slip = 2;
117
+
}];
118
+
119
+
policy = [{
120
+
id = "default";
121
+
algorithm = "RSASHA256";
122
+
ksk-size = 4096;
123
+
zsk-size = 2048;
124
+
}];
125
+
126
+
127
+
template = [
128
+
];
129
+
zone = [
130
+
{
131
+
domain = "lassul.us";
132
+
file = "${./lassul.us.zone}";
133
+
notify = [ "hetzner_ip4_1" "hetzner_ip4_2" "hetzner_ip4_3" "hetzner_ip6_1" "hetzner_ip6_2" "hetzner_ip6_3" ];
134
+
acl = [ "hetzner_ip4_1" "hetzner_ip4_2" "hetzner_ip4_3" "hetzner_ip6_1" "hetzner_ip6_2" "hetzner_ip6_3" ];
135
+
}
136
+
];
137
+
};
138
+
};
139
+
140
+
networking.firewall.allowedTCPPorts = [ 53 ];
141
+
networking.firewall.allowedUDPPorts = [ 53 ];
142
+
}
+58
2configs/dns/lassul.us.zone
+58
2configs/dns/lassul.us.zone
···
1
+
@ 3600 IN SOA lassul.us. ns1.lassul.us. 2023101214 7200 3600 86400 3600
2
+
3
+
;;@ 3600 IN NS ns1
4
+
@ 3600 IN NS ns1
5
+
@ 3600 IN NS oxygen.ns.hetzner.com.
6
+
@ 3600 IN NS hydrogen.ns.hetzner.com.
7
+
@ 3600 IN NS helium.ns.hetzner.de.
8
+
9
+
$TTL 600
10
+
11
+
;; NS Records
12
+
he IN NS oxygen.ns.hetzner.com.
13
+
he IN NS hydrogen.ns.hetzner.com.
14
+
he IN NS helium.ns.hetzner.de.
15
+
16
+
@ IN A 95.216.1.150
17
+
@ IN AAAA 2a01:4f9:2a:1e9::1
18
+
prism IN A 95.216.1.150
19
+
4.prism IN A 95.216.1.150
20
+
prism IN AAAA 2a01:4f9:2a:1e9::1
21
+
6.prism IN AAAA 2a01:4f9:2a:1e9::1
22
+
neoprism IN A 95.217.192.59
23
+
4.neoprism IN A 95.217.192.59
24
+
neoprism IN AAAA 2a01:4f9:4a:4f1a::2
25
+
6.neoprism IN AAAA 2a01:4f9:4a:4f1a::2
26
+
27
+
* IN CNAME www
28
+
29
+
ns1 IN CNAME neoprism
30
+
www IN CNAME prism
31
+
cache IN CNAME prism
32
+
cgit IN CNAME prism
33
+
pad IN CNAME prism
34
+
codi IN CNAME prism
35
+
go IN CNAME prism
36
+
lol IN CNAME prism
37
+
matrix IN CNAME prism
38
+
paste IN CNAME prism
39
+
radio IN CNAME prism
40
+
jitsi IN CNAME prism
41
+
streaming IN CNAME prism
42
+
flix IN CNAME prism
43
+
flex IN CNAME prism
44
+
flux IN CNAME prism
45
+
testing IN CNAME prism
46
+
schrott IN CNAME prism
47
+
48
+
;; Mail
49
+
@ IN MX 3 mail
50
+
mail IN A 95.216.1.150
51
+
mail IN AAAA 2a01:4f9:2a:1e9::1
52
+
imap IN A 95.216.1.150
53
+
imap IN AAAA 2a01:4f9:2a:1e9::1
54
+
smtp._tls IN TXT "v=TLSRPTv1;rua=mailto:postmaster@lassul.us"
55
+
;
56
+
default._domainkey IN TXT "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDUv3DMndFellqu208feABEzT/PskOfTSdJCOF/HELBR0PHnbBeRoeHEm9XAcOe/Mz2t/ysgZ6JFXeFxCtoM5fG20brUMRzsVRxb9Ur5cEvOYuuRrbChYcKa+fopu8pYrlrqXD3miHISoy6ErukIYCRpXWUJHi1TlNQhLWFYqAaywIDAQAB"
57
+
_dmarc IN TXT "v=DMARC1; p=none; adkim=r; aspf=r; rua=mailto:postmaster@lassul.us; ruf=mailto:postmaster@lassul.us; pct=100"
58
+
@ IN TXT "v=spf1 mx -al"