80 lines
2.1 KiB
Nix
80 lines
2.1 KiB
Nix
{ config, hosts, inputs, pkgs, tools, ... }:
|
|
# TODO: is this secure?
|
|
let
|
|
inherit (hosts.${config.networking.hostName}) interfaces;
|
|
inherit (tools.meta) domain;
|
|
dot = config.security.acme.certs."securedns.${domain}";
|
|
in {
|
|
imports = [ ./zones.nix ];
|
|
|
|
networking.firewall = {
|
|
allowedTCPPorts = [ 53 853 ];
|
|
allowedUDPPorts = [ 53 853 ];
|
|
};
|
|
|
|
systemd.services.coredns = {
|
|
after = [ "network-addresses-vstub.service" ];
|
|
serviceConfig.LoadCredential = [
|
|
"dot-cert.pem:${dot.directory}/fullchain.pem"
|
|
"dot-key.pem:${dot.directory}/key.pem"
|
|
];
|
|
};
|
|
security.acme.certs."securedns.${domain}" = {
|
|
group = "nginx";
|
|
webroot = "/var/lib/acme/acme-challenge";
|
|
# using a different ACME provider because Android Private DNS is fucky
|
|
server = "https://api.buypass.com/acme/directory";
|
|
reloadServices = [
|
|
"coredns.service"
|
|
];
|
|
};
|
|
services.coredns = {
|
|
enable = true;
|
|
config = ''
|
|
. {
|
|
bind ${interfaces.vstub.addr}
|
|
hosts ${inputs.self.packages.${pkgs.system}.stevenblack-hosts} {
|
|
fallthrough
|
|
}
|
|
chaos "Private Void DNS" info@privatevoid.net
|
|
forward . 127.0.0.1
|
|
}
|
|
tls://.:853 {
|
|
bind ${interfaces.primary.addr}
|
|
tls {$CREDENTIALS_DIRECTORY}/dot-cert.pem {$CREDENTIALS_DIRECTORY}/dot-key.pem
|
|
hosts ${inputs.self.packages.${pkgs.system}.stevenblack-hosts} {
|
|
fallthrough
|
|
}
|
|
chaos "Private Void DNS" info@privatevoid.net
|
|
forward . ${interfaces.primary.addr}
|
|
}
|
|
'';
|
|
};
|
|
|
|
services.bind = {
|
|
enable = true;
|
|
# TODO: un-hardcode all ip addresses
|
|
listenOn = [ interfaces.primary.addr "127.0.0.1" ];
|
|
ipv4Only = true;
|
|
|
|
cacheNetworks = [ "10.0.0.0/8" ];
|
|
extraConfig = ''
|
|
acl "trusted" {
|
|
127.0.0.0/8;
|
|
::1/128;
|
|
${interfaces.vstub.addr}/32;
|
|
10.100.0.0/16;
|
|
10.10.0.0/16;
|
|
};
|
|
acl "publicservers" {
|
|
116.202.226.86/32;
|
|
};
|
|
'';
|
|
extraOptions = ''
|
|
recursion yes;
|
|
allow-recursion { trusted; ${interfaces.primary.addr}/32; };
|
|
dnssec-validation no;
|
|
'';
|
|
};
|
|
}
|