diff options
| -rw-r--r-- | etc/dns/sorre.internal.zone | 20 | ||||
| -rw-r--r-- | hosts/sagittarius/network.nix | 2 | ||||
| -rw-r--r-- | hosts/sagittarius/web/default.nix | 1 | ||||
| -rw-r--r-- | hosts/sagittarius/web/dns.nix | 28 | ||||
| -rw-r--r-- | wireguard.nix | 24 |
5 files changed, 66 insertions, 9 deletions
diff --git a/etc/dns/sorre.internal.zone b/etc/dns/sorre.internal.zone new file mode 100644 index 0000000..90572a9 --- /dev/null +++ b/etc/dns/sorre.internal.zone @@ -0,0 +1,20 @@ +$ORIGIN sorre.internal. +$TTL 3600 + +;; Nameservers/DNS setup +@ IN SOA ns1.sorre.internal. hostmaster.sorre.interal. ( + 20260604 ; serial (YYYYMMDD format) + 3600 ; refresh + 600 ; retry + 604800 ; expire + 3600 ; negative cache TTL + ) +@ IN NS ns1 +ns1 IN AAAA 2301:db8:acad:a::1 + +;; Hosts +sagittarius IN AAAA 2301:db8:acad:a::1 +nyaan IN AAAA 2301:db8:acad:a::2 + +;; Services +valutwarden IN CNAME sagittarius diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix index 32362e6..1b41783 100644 --- a/hosts/sagittarius/network.nix +++ b/hosts/sagittarius/network.nix @@ -47,6 +47,8 @@ icmp type echo-request accept comment "allow ping" icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4." ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client" + + udp dport 53 meta mark 42 accept comment "allow DNS over wireguard" } ''; }; diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix index 2424eaf..da1d41d 100644 --- a/hosts/sagittarius/web/default.nix +++ b/hosts/sagittarius/web/default.nix @@ -7,5 +7,6 @@ ./static.nix ./navidrome.nix ./vaultwarden.nix + ./dns.nix ]; } diff --git a/hosts/sagittarius/web/dns.nix b/hosts/sagittarius/web/dns.nix new file mode 100644 index 0000000..5550c75 --- /dev/null +++ b/hosts/sagittarius/web/dns.nix @@ -0,0 +1,28 @@ +{ flakeRoot, ... }: +let + nsdPort = 5340; +in +{ + services.nsd = { + enable = true; + interfaces = [ "127.0.0.1" ]; + port = nsdPort; + zones."sorre.internal.".data = builtins.readFile (flakeRoot + /etc/dns/sorre.internal.zone); + }; + + services.unbound = { + enable = true; + settings = { + server.interface = "2301:db8:acad:a::1"; + + stub-zone = [ + { + name = "sorre.internal"; + stub-addr = "127.0.0.1@${toString nsdPort}"; + stub-prime = false; # no DNSSEC + stub-first = false; # don't cache NXDOMAIN (to make adding new domains easier) + } + ]; + }; + }; +} diff --git a/wireguard.nix b/wireguard.nix index 8709647..b26d13a 100644 --- a/wireguard.nix +++ b/wireguard.nix @@ -8,6 +8,9 @@ let wgPort = 51820; # Common port used on all peers firewallMark = 42; + # The topology is hub-and-spoke/star + # sagittarius is the hub == 2301:db8:acad:a::1 + # it hosts authoritative DNS and spokes do keepalive with it. hosts = { sagittarius = { address = "2301:db8:acad:a::1/128"; @@ -33,14 +36,14 @@ let }; generatedPeers = lib.attrsets.mapAttrsToList generatePeer peers; - stripNetmask = addr: lib.strings.removeSuffix "/128" addr; - generatedHosts = lib.attrsets.mapAttrs' (hostname: value: { - name = stripNetmask value.address; - value = [ - hostname - "${hostname}.internal" - ]; - }) peers; + # stripNetmask = addr: lib.strings.removeSuffix "/128" addr; + # generatedHosts = lib.attrsets.mapAttrs' (hostname: value: { + # name = stripNetmask value.address; + # value = [ + # hostname + # "${hostname}.internal" + # ]; + # }) peers; in { sops.secrets."wireguard-${hostname}-pk" = { @@ -51,7 +54,10 @@ in format = "binary"; }; - networking.hosts = generatedHosts; + networking.nameservers = [ + "2301:db8:acad:a::1" # see the zonefile in etc/dns + ]; + systemd.network = { enable = true; |