100 lines
2.2 KiB
Nix
Executable file
100 lines
2.2 KiB
Nix
Executable file
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.dns-server;
|
|
in
|
|
with lib;
|
|
{
|
|
options.dns-server = {
|
|
enable = mkEnableOption "PowerDNS server and PowerDNS Recursor";
|
|
openFirewall = mkOption {
|
|
type = types.bool;
|
|
default = true;
|
|
description = ''
|
|
Open 53 port in firewall
|
|
'';
|
|
};
|
|
|
|
webAdmin = {
|
|
enable = mkEnableOption "Enable PowerDNS Admin";
|
|
saltFile = mkOption {
|
|
type = types.path;
|
|
description = ''
|
|
Slat value for serialization, can be generated with `openssl rand -hex 16`
|
|
'';
|
|
};
|
|
apiSecretFile = mkOption {
|
|
type = types.path;
|
|
description = ''
|
|
The file content should be
|
|
```
|
|
YOUR_PASSWORD
|
|
```
|
|
'';
|
|
};
|
|
};
|
|
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
networking.firewall = mkIf cfg.openFirewall {
|
|
allowedTCPPorts = [ 53 ];
|
|
allowedUDPPorts = [ 53 ];
|
|
};
|
|
|
|
services = {
|
|
powerdns = {
|
|
enable = true;
|
|
extraConfig = ''
|
|
launch=gpgsql
|
|
webserver-password=$WEB_PASSWORD
|
|
api=yes
|
|
api-key=$WEB_PASSWORD
|
|
gpgsql-host=/var/run/postgresql
|
|
gpgsql-dbname=pdns
|
|
gpgsql-user=pdns
|
|
webserver=yes
|
|
local-port=5359
|
|
'';
|
|
secretFile = config.sops.secrets.powerdns.path;
|
|
};
|
|
|
|
pdns-recursor = {
|
|
enable = true;
|
|
forwardZones = {
|
|
"net.dn" = "127.0.0.1:5359";
|
|
};
|
|
forwardZonesRecurse = {
|
|
"" = "8.8.8.8;8.8.4.4";
|
|
};
|
|
dnssecValidation = "off";
|
|
dns.allowFrom = [
|
|
"127.0.0.0/8"
|
|
"10.0.0.0/24"
|
|
"192.168.100.0/24"
|
|
"::1/128"
|
|
"fc00::/7"
|
|
"fe80::/10"
|
|
];
|
|
};
|
|
|
|
powerdns-admin = {
|
|
enable = true;
|
|
secretKeyFile = config.sops.secrets."powerdns-admin/secret".path;
|
|
saltFile = config.sops.secrets."powerdns-admin/salt".path;
|
|
config =
|
|
# python
|
|
''
|
|
import cachelib
|
|
|
|
SESSION_TYPE = 'cachelib'
|
|
SESSION_CACHELIB = cachelib.simple.SimpleCache()
|
|
SQLALCHEMY_DATABASE_URI = 'postgresql://powerdnsadmin@/powerdnsadmin?host=localhost'
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|