diff options
| author | Isabella Bastaja <isabella@sorre.xyz> | 2026-05-31 23:17:31 +0200 |
|---|---|---|
| committer | Isabella Bastaja <isabella@sorre.xyz> | 2026-06-04 17:08:37 +0200 |
| commit | 721f7b6aecfb35694151c9c0e610f895171d202b (patch) | |
| tree | 4e5d992e10cdf01f8bbc8637308ecd44f466b17c /hosts/sagittarius | |
| parent | bef4a2595033a9e093214b252bb65bb8ca064211 (diff) | |
sagittarius: set up authoritative DNS server for sorre.internal
Diffstat (limited to 'hosts/sagittarius')
| -rw-r--r-- | hosts/sagittarius/network.nix | 2 | ||||
| -rw-r--r-- | hosts/sagittarius/web/default.nix | 1 | ||||
| -rw-r--r-- | hosts/sagittarius/web/dns.nix | 28 |
3 files changed, 31 insertions, 0 deletions
diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix index 32362e6..1b41783 100644 --- a/hosts/sagittarius/network.nix +++ b/hosts/sagittarius/network.nix @@ -47,6 +47,8 @@ icmp type echo-request accept comment "allow ping" icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4." ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client" + + udp dport 53 meta mark 42 accept comment "allow DNS over wireguard" } ''; }; diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix index 2424eaf..da1d41d 100644 --- a/hosts/sagittarius/web/default.nix +++ b/hosts/sagittarius/web/default.nix @@ -7,5 +7,6 @@ ./static.nix ./navidrome.nix ./vaultwarden.nix + ./dns.nix ]; } diff --git a/hosts/sagittarius/web/dns.nix b/hosts/sagittarius/web/dns.nix new file mode 100644 index 0000000..5550c75 --- /dev/null +++ b/hosts/sagittarius/web/dns.nix @@ -0,0 +1,28 @@ +{ flakeRoot, ... }: +let + nsdPort = 5340; +in +{ + services.nsd = { + enable = true; + interfaces = [ "127.0.0.1" ]; + port = nsdPort; + zones."sorre.internal.".data = builtins.readFile (flakeRoot + /etc/dns/sorre.internal.zone); + }; + + services.unbound = { + enable = true; + settings = { + server.interface = "2301:db8:acad:a::1"; + + stub-zone = [ + { + name = "sorre.internal"; + stub-addr = "127.0.0.1@${toString nsdPort}"; + stub-prime = false; # no DNSSEC + stub-first = false; # don't cache NXDOMAIN (to make adding new domains easier) + } + ]; + }; + }; +} |