diff options
Diffstat (limited to 'hosts/sagittarius/web/dns.nix')
| -rw-r--r-- | hosts/sagittarius/web/dns.nix | 37 |
1 files changed, 30 insertions, 7 deletions
diff --git a/hosts/sagittarius/web/dns.nix b/hosts/sagittarius/web/dns.nix index 5550c75..800a321 100644 --- a/hosts/sagittarius/web/dns.nix +++ b/hosts/sagittarius/web/dns.nix @@ -6,21 +6,44 @@ in services.nsd = { enable = true; interfaces = [ "127.0.0.1" ]; + verbosity = 5; port = nsdPort; - zones."sorre.internal.".data = builtins.readFile (flakeRoot + /etc/dns/sorre.internal.zone); + zones."sorre.internal." = { + data = builtins.readFile (flakeRoot + /etc/dns/sorre.internal.zone); + provideXFR = [ "127.0.0.1 NOKEY" ]; + }; }; + services.resolved.enable = false; services.unbound = { enable = true; settings = { - server.interface = "2301:db8:acad:a::1"; + server = { + interface = [ + "127.0.0.1" + "2301:db8:acad:a::1" + ]; + verbosity = 5; + do-not-query-localhost = false; + access-control = [ + # allow wireguard + "2301:db8:acad:a::/64 allow" + + # allow localhost + "127.0.0.0/8 allow" + + # block all else + "0.0.0.0/0 refuse" + "::0/0 refuse" + ]; + }; - stub-zone = [ + auth-zone = [ { - name = "sorre.internal"; - stub-addr = "127.0.0.1@${toString nsdPort}"; - stub-prime = false; # no DNSSEC - stub-first = false; # don't cache NXDOMAIN (to make adding new domains easier) + name = "sorre.internal."; + primary = "127.0.0.1@${toString nsdPort}"; + fallback-enabled = false; + for-downstream = true; } ]; }; |