From 721f7b6aecfb35694151c9c0e610f895171d202b Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sun, 31 May 2026 23:17:31 +0200
Subject: sagittarius: set up authoritative DNS server for sorre.internal

---
 wireguard.nix | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

(limited to 'wireguard.nix')

diff --git a/wireguard.nix b/wireguard.nix
index 8709647..b26d13a 100644
--- a/wireguard.nix
+++ b/wireguard.nix
@@ -8,6 +8,9 @@ let
   wgPort = 51820; # Common port used on all peers
   firewallMark = 42;
 
+  # The topology is hub-and-spoke/star
+  # sagittarius is the hub == 2301:db8:acad:a::1
+  # it hosts authoritative DNS and spokes do keepalive with it.
   hosts = {
     sagittarius = {
       address = "2301:db8:acad:a::1/128";
@@ -33,14 +36,14 @@ let
     };
   generatedPeers = lib.attrsets.mapAttrsToList generatePeer peers;
 
-  stripNetmask = addr: lib.strings.removeSuffix "/128" addr;
-  generatedHosts = lib.attrsets.mapAttrs' (hostname: value: {
-    name = stripNetmask value.address;
-    value = [
-      hostname
-      "${hostname}.internal"
-    ];
-  }) peers;
+  # stripNetmask = addr: lib.strings.removeSuffix "/128" addr;
+  # generatedHosts = lib.attrsets.mapAttrs' (hostname: value: {
+  #   name = stripNetmask value.address;
+  #   value = [
+  #     hostname
+  #     "${hostname}.internal"
+  #   ];
+  # }) peers;
 in
 {
   sops.secrets."wireguard-${hostname}-pk" = {
@@ -51,7 +54,10 @@ in
     format = "binary";
   };
 
-  networking.hosts = generatedHosts;
+  networking.nameservers = [
+    "2301:db8:acad:a::1" # see the zonefile in etc/dns
+  ];
+
   systemd.network = {
     enable = true;
 
-- 
cgit v1.3.1