move authoritative DNS to smrk, improve config
1 file changed, 5 insertions(+), 19 deletions(-)
changed files
M system/roles/auth-dns.nix → system/roles/auth-dns.nix
@@ -1,28 +1,17 @@ { config, pkgs, - lib, ... }: let - inherit (lib.lists) flatten; - inherit (lib.strings) concatStringsSep; - he = { - notify = "216.218.130.2"; - axfr = [ - "216.218.133.2" - "2001:470:600::2" - ]; - }; - iplist = ips: concatStringsSep "," (flatten ips); - domain = config.networking.domain; in { - age.secrets.powerdns.file = ../../secrets/powerdns.age; imports = [ ../settings/programs/sqlite.nix ]; + + age.secrets.powerdns.file = ../../secrets/powerdns.age; networking.firewall = { allowedTCPPorts = [ 53 ];@@ -33,20 +22,17 @@ services.powerdns = { enable = true; secretFile = config.age.secrets.powerdns.path; extraConfig = '' + local-address=:: launch=gsqlite3 dnsupdate=yes allow-dnsupdate-from=0.0.0.0/0,::/0 - only-notify= - also-notify=${iplist [ he.notify ]} - allow-axfr-ips=${iplist [ he.axfr ]} expand-alias=yes - outgoing-axfr-expand-alias=yes - resolver=1.1.1.1 + outgoing-axfr-expand-alias=yes # needed with DNSSEC + resolver=127.0.0.53 log-dns-details=no log-dns-queries=no loglevel=5 primary=yes - send-signed-notify=no default-api-rectify=yes default-soa-edit=inception-increment