From 92a19e7827591b8077c0583561896a675e095435 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Thu, 4 Jun 2026 17:48:33 +0200
Subject: dns: fix unbound

---
 hosts/sagittarius/web/dns.nix | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

(limited to 'hosts/sagittarius/web/dns.nix')

diff --git a/hosts/sagittarius/web/dns.nix b/hosts/sagittarius/web/dns.nix
index 5550c75..800a321 100644
--- a/hosts/sagittarius/web/dns.nix
+++ b/hosts/sagittarius/web/dns.nix
@@ -6,21 +6,44 @@ in
   services.nsd = {
     enable = true;
     interfaces = [ "127.0.0.1" ];
+    verbosity = 5;
     port = nsdPort;
-    zones."sorre.internal.".data = builtins.readFile (flakeRoot + /etc/dns/sorre.internal.zone);
+    zones."sorre.internal." = {
+      data = builtins.readFile (flakeRoot + /etc/dns/sorre.internal.zone);
+      provideXFR = [ "127.0.0.1 NOKEY" ];
+    };
   };
 
+  services.resolved.enable = false;
   services.unbound = {
     enable = true;
     settings = {
-      server.interface = "2301:db8:acad:a::1";
+      server = {
+        interface = [
+          "127.0.0.1"
+          "2301:db8:acad:a::1"
+        ];
+        verbosity = 5;
+        do-not-query-localhost = false;
+        access-control = [
+          # allow wireguard
+          "2301:db8:acad:a::/64 allow"
+
+          # allow localhost
+          "127.0.0.0/8 allow"
+
+          # block all else
+          "0.0.0.0/0 refuse"
+          "::0/0 refuse"
+        ];
+      };
 
-      stub-zone = [
+      auth-zone = [
         {
-          name = "sorre.internal";
-          stub-addr = "127.0.0.1@${toString nsdPort}";
-          stub-prime = false; # no DNSSEC
-          stub-first = false; # don't cache NXDOMAIN (to make adding new domains easier)
+          name = "sorre.internal.";
+          primary = "127.0.0.1@${toString nsdPort}";
+          fallback-enabled = false;
+          for-downstream = true;
         }
       ];
     };
-- 
cgit v1.3.1