dns: fix unbound

2 files changed, 31 insertions, 8 deletions

diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix
index 1b41783..d201590 100644
--- a/hosts/sagittarius/network.nix
+++ b/hosts/sagittarius/network.nix
@@ -48,7 +48,7 @@
               icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
               ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
 
-              udp dport 53 meta mark 42 accept comment "allow DNS over wireguard"
+              iifname "wg0" udp dport 53 accept comment "allow DNS over wireguard"
             }
         '';
       };
diff --git a/hosts/sagittarius/web/dns.nix b/hosts/sagittarius/web/dns.nix
index 5550c75..800a321 100644
--- a/hosts/sagittarius/web/dns.nix
+++ b/hosts/sagittarius/web/dns.nix
@@ -6,21 +6,44 @@ in
   services.nsd = {
     enable = true;
     interfaces = [ "127.0.0.1" ];
+    verbosity = 5;
     port = nsdPort;
-    zones."sorre.internal.".data = builtins.readFile (flakeRoot + /etc/dns/sorre.internal.zone);
+    zones."sorre.internal." = {
+      data = builtins.readFile (flakeRoot + /etc/dns/sorre.internal.zone);
+      provideXFR = [ "127.0.0.1 NOKEY" ];
+    };
   };
 
+  services.resolved.enable = false;
   services.unbound = {
     enable = true;
     settings = {
-      server.interface = "2301:db8:acad:a::1";
+      server = {
+        interface = [
+          "127.0.0.1"
+          "2301:db8:acad:a::1"
+        ];
+        verbosity = 5;
+        do-not-query-localhost = false;
+        access-control = [
+          # allow wireguard
+          "2301:db8:acad:a::/64 allow"
+
+          # allow localhost
+          "127.0.0.0/8 allow"
+
+          # block all else
+          "0.0.0.0/0 refuse"
+          "::0/0 refuse"
+        ];
+      };
 
-      stub-zone = [
+      auth-zone = [
         {
-          name = "sorre.internal";
-          stub-addr = "127.0.0.1@${toString nsdPort}";
-          stub-prime = false; # no DNSSEC
-          stub-first = false; # don't cache NXDOMAIN (to make adding new domains easier)
+          name = "sorre.internal.";
+          primary = "127.0.0.1@${toString nsdPort}";
+          fallback-enabled = false;
+          for-downstream = true;
         }
       ];
     };