sagittarius: set up authoritative DNS server for sorre.internal

5 files changed, 66 insertions, 9 deletions

diff --git a/etc/dns/sorre.internal.zone b/etc/dns/sorre.internal.zone
new file mode 100644
index 0000000..90572a9
--- /dev/null
+++ b/etc/dns/sorre.internal.zone
@@ -0,0 +1,20 @@
+$ORIGIN sorre.internal.
+$TTL 3600
+
+;; Nameservers/DNS setup
+@		IN		SOA	ns1.sorre.internal.	hostmaster.sorre.interal. (
+					20260604	; serial (YYYYMMDD format)
+					3600		; refresh
+					600			; retry
+					604800		; expire
+					3600		; negative cache TTL
+				)
+@		IN		NS	ns1
+ns1		IN		AAAA 2301:db8:acad:a::1
+
+;; Hosts
+sagittarius	IN	AAAA	2301:db8:acad:a::1
+nyaan		IN	AAAA	2301:db8:acad:a::2
+
+;; Services
+valutwarden	IN	CNAME	sagittarius
diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix
index 32362e6..1b41783 100644
--- a/hosts/sagittarius/network.nix
+++ b/hosts/sagittarius/network.nix
@@ -47,6 +47,8 @@
               icmp type echo-request accept comment "allow ping"
               icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
               ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
+
+              udp dport 53 meta mark 42 accept comment "allow DNS over wireguard"
             }
         '';
       };
diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
index 2424eaf..da1d41d 100644
--- a/hosts/sagittarius/web/default.nix
+++ b/hosts/sagittarius/web/default.nix
@@ -7,5 +7,6 @@
     ./static.nix
     ./navidrome.nix
     ./vaultwarden.nix
+    ./dns.nix
   ];
 }
diff --git a/hosts/sagittarius/web/dns.nix b/hosts/sagittarius/web/dns.nix
new file mode 100644
index 0000000..5550c75
--- /dev/null
+++ b/hosts/sagittarius/web/dns.nix
@@ -0,0 +1,28 @@
+{ flakeRoot, ... }:
+let
+  nsdPort = 5340;
+in
+{
+  services.nsd = {
+    enable = true;
+    interfaces = [ "127.0.0.1" ];
+    port = nsdPort;
+    zones."sorre.internal.".data = builtins.readFile (flakeRoot + /etc/dns/sorre.internal.zone);
+  };
+
+  services.unbound = {
+    enable = true;
+    settings = {
+      server.interface = "2301:db8:acad:a::1";
+
+      stub-zone = [
+        {
+          name = "sorre.internal";
+          stub-addr = "127.0.0.1@${toString nsdPort}";
+          stub-prime = false; # no DNSSEC
+          stub-first = false; # don't cache NXDOMAIN (to make adding new domains easier)
+        }
+      ];
+    };
+  };
+}
diff --git a/wireguard.nix b/wireguard.nix
index 8709647..b26d13a 100644
--- a/wireguard.nix
+++ b/wireguard.nix
@@ -8,6 +8,9 @@ let
   wgPort = 51820; # Common port used on all peers
   firewallMark = 42;
 
+  # The topology is hub-and-spoke/star
+  # sagittarius is the hub == 2301:db8:acad:a::1
+  # it hosts authoritative DNS and spokes do keepalive with it.
   hosts = {
     sagittarius = {
       address = "2301:db8:acad:a::1/128";
@@ -33,14 +36,14 @@ let
     };
   generatedPeers = lib.attrsets.mapAttrsToList generatePeer peers;
 
-  stripNetmask = addr: lib.strings.removeSuffix "/128" addr;
-  generatedHosts = lib.attrsets.mapAttrs' (hostname: value: {
-    name = stripNetmask value.address;
-    value = [
-      hostname
-      "${hostname}.internal"
-    ];
-  }) peers;
+  # stripNetmask = addr: lib.strings.removeSuffix "/128" addr;
+  # generatedHosts = lib.attrsets.mapAttrs' (hostname: value: {
+  #   name = stripNetmask value.address;
+  #   value = [
+  #     hostname
+  #     "${hostname}.internal"
+  #   ];
+  # }) peers;
 in
 {
   sops.secrets."wireguard-${hostname}-pk" = {
@@ -51,7 +54,10 @@ in
     format = "binary";
   };
 
-  networking.hosts = generatedHosts;
+  networking.nameservers = [
+    "2301:db8:acad:a::1" # see the zonefile in etc/dns
+  ];
+
   systemd.network = {
     enable = true;