extract powerdns configuration to role
2 files changed, 72 insertions(+), 55 deletions(-)
changed files
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -32,6 +32,7 @@ ./linde-hardware.nix ../roles/server.nix ../roles/reverse-proxy.nix + ../roles/auth-dns.nix ../roles/binary-cache.nix ../roles/forgejo-runner.nix ../roles/goatcounter.nix@@ -41,7 +42,6 @@ ../roles/sso.nix ../settings/services/git-server.nix ]; age.secrets = { - powerdns.file = ../../secrets/powerdns.age; redis-website.file = ../../secrets/redis-website.age; cifs-jellyfin.file = ../../secrets/cifs-jellyfin.age; ntfy.file = ../../secrets/ntfy.age;@@ -55,7 +55,6 @@ environment.localBinInPath = true; environment.systemPackages = with pkgs; [ cifs-utils lsof - pdns litecli knot-dns@@ -281,51 +280,9 @@ # Before changing this value read the documentation for this option # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). system.stateVersion = "23.05"; # Did you read the comment? - services.powerdns = - let - inherit (lib.lists) flatten; - inherit (lib.strings) concatStringsSep; - he = { - notify = "216.218.130.2"; - axfr = [ - "216.218.133.2" - "2001:470:600::2" - ]; - }; - iplist = ips: concatStringsSep "," (flatten ips); - in - { - enable = true; - secretFile = config.age.secrets.powerdns.path; - extraConfig = '' - launch=gsqlite3 - dnsupdate=yes - allow-dnsupdate-from=0.0.0.0/0,::/0 - only-notify= - also-notify=${iplist [ he.notify ]} - allow-axfr-ips=${iplist [ he.axfr ]} - expand-alias=yes - outgoing-axfr-expand-alias=yes - resolver=1.1.1.1 - local-address=${net-ip4} ${net-ip6} - log-dns-details=no - log-dns-queries=no - loglevel=5 - primary=yes - send-signed-notify=no - - default-api-rectify=yes - default-soa-edit=inception-increment - - api=yes - # replaced by secretFile/envsubst - api-key=$API_KEY - - gsqlite3-database=/var/db/pdns/zones.db - gsqlite3-pragma-foreign-keys=yes - gsqlite3-dnssec=yes - ''; - }; + services.powerdns.extraConfig = '' + local-address=${net-ip4} ${net-ip6} + ''; services.postfix = { enable = true;@@ -404,14 +361,6 @@ let inherit (import ../../lib/caddy.nix { inherit lib; }) security-headers; in { - "pdns.${domain}" = { - extraConfig = '' - log { - output discard - } - reverse_proxy 127.0.0.1:8081 - ''; - }; "files.${domain}" = { extraConfig = '' encode zstd gzip
A system/roles/auth-dns.nix
@@ -0,0 +1,68 @@ +{ + config, + pkgs, + lib, + ... +}: +let + inherit (lib.lists) flatten; + inherit (lib.strings) concatStringsSep; + he = { + notify = "216.218.130.2"; + axfr = [ + "216.218.133.2" + "2001:470:600::2" + ]; + }; + iplist = ips: concatStringsSep "," (flatten ips); + + domain = config.networking.domain; +in +{ + age.secrets.powerdns.file = ../../secrets/powerdns.age; + + services.powerdns = { + enable = true; + secretFile = config.age.secrets.powerdns.path; + extraConfig = '' + launch=gsqlite3 + dnsupdate=yes + allow-dnsupdate-from=0.0.0.0/0,::/0 + only-notify= + also-notify=${iplist [ he.notify ]} + allow-axfr-ips=${iplist [ he.axfr ]} + expand-alias=yes + outgoing-axfr-expand-alias=yes + resolver=1.1.1.1 + log-dns-details=no + log-dns-queries=no + loglevel=5 + primary=yes + send-signed-notify=no + + default-api-rectify=yes + default-soa-edit=inception-increment + + api=yes + # replaced by secretFile/envsubst + api-key=$API_KEY + + gsqlite3-database=/var/db/pdns/zones.db + gsqlite3-pragma-foreign-keys=yes + gsqlite3-dnssec=yes + ''; + }; + + environment.systemPackages = [ pkgs.pdns ]; + + services.caddy.virtualHosts = { + "pdns.${domain}" = { + extraConfig = '' + log { + output discard + } + reverse_proxy 127.0.0.1:8081 + ''; + }; + }; +}