nixos-config/systems/funi/services/dns.nix at d390b1e8f3422907c6de9a115e9ffd6ec597dcf4 · nevivurn/nixos-config · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
{ pkgs, inputs, ... }:

with inputs;

{
  # unbound as a simple, validating, recursive DNS server
  services.unbound = {
    enable = true;
    resolveLocalQueries = false;
    settings = {
      server = {
        interface = [ "127.0.0.1@5353" ];
      };
    };
  };

  # dnsmasq as forwarding DNS + DHCP + some filtering
  services.dnsmasq = {
    enable = true;
    resolveLocalQueries = false;

    settings = {
      server = [ "127.0.0.1#5353" "/nevi.network/" ];
      address = [
        "/funi.nevi.network/192.168.2.1"
        "/funi.nevi.network/fdbc:ba6a:38de::1"

        "/tianyi.home.nevi.network/10.42.42.2"
        "/tianyi.home.nevi.network/fdbc:ba6a:38de:1::2"
      ];
      cname = [
        "matrix.nevi.network,athebyne.nevi.network"
      ];
      interface = "br-lan";
      bind-interfaces = true;

      interface-name = [
        "public.nevi.network,enp1s0/4"
      ];

      addn-hosts = [ "/secrets/dnsmasq-hosts" ];

      # public names are cached in unbound and client-side
      cache-size = 0;

      no-resolv = true;
      expand-hosts = true;
      localise-queries = true;
      proxy-dnssec = true;
      no-hosts = true;

      stop-dns-rebind = true;
      domain-needed = true;
      bogus-priv = true;

      dhcp-range = [
        "192.168.2.100,192.168.2.254"
        "fdbc:ba6a:38de:0:1::,fdbc:ba6a:38de::ffff:ffff:ffff:ffff"
      ];
      dhcp-host = [
        "92:ef:6d:2b:7b:cf,192.168.2.10,athebyne.nevi.network"
        "a8:a1:59:6f:4d:54,192.168.2.11,athebyne-boot.nevi.network"
        "id:00:02:00:00:ab:11:df:85:50:1e:9b:2a:af:84,[fdbc:ba6a:38de::10],athebyne.nevi.network"
      ];
      enable-ra = true;

      dhcp-option = [
        "option:ntp-server,0.0.0.0"
        "option6:ntp-server,[fd00::]"
      ];

      domain = "nevi.network";
      dhcp-fqdn = true;

      conf-file = (pkgs.runCommand "dnsmasq-hosts" { } ''
        < ${self.packages.${pkgs.system}.hosts}/hosts \
            grep ^0.0.0.0 \
          | awk '{print $2}' \
          | tail -n+2 \
        > hosts
        awk '{print "local=/" $0 "/"}' hosts >> $out
        awk '{print "address=/" $0 "/0.0.0.0"}' hosts >> $out
      '').outPath;
    };
  };
  systemd.services.dnsmasq = {
    after = [ "network-online.target" ];
    wants = [ "network-online.target" ];
  };

  networking.firewall.interfaces."br-lan" = {
    allowedTCPPorts = [ 53 ];
    allowedUDPPorts = [ 53 67 547 ];
  };
}