fabianhauser/dotfiles
1
0
Fork 0
Code Issues 4 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Switch router roles to services

Browse source
This commit is contained in:
Fabian Hauser 2020-05-17 13:47:27 +00:00
parent 1628359fbd
commit fad59bbb27
5 changed files with 892 additions and 761 deletions
Download patch file Download diff file Expand all files Collapse all files

61
role/router-dns/default.nix
View file

@ -1,27 +1,46 @@
{ internalRouterIP, networkIdIP, revIpDomain, internalPrefixLength? 24, localDomain, }:
{ config, lib, pkgs, ... }:
let pkgs = import <nixpkgs> { };
with lib;
let routerCfg = config.services.router;
dhcpCfg = config.services.router.dhcp;
cfg = config.services.router.recursiveDns;
with lib.lists; with builtins; revIpDomain = concatStringsSep "." reverseList take 3 split "\." networkIdIp;
in {
services.unbound = {
enable = true;
interfaces = [ "127.0.0.1" internalRouterIP ];
allowedAccess = [ "127.0.0.0/24" "${networkIdIP}/${toString internalPrefixLength}" ];
extraConfig = ''
# Custom configuration (leave this note to assure indentation!)
do-not-query-localhost: no
private-domain: "${localDomain}."
domain-insecure: "${localDomain}."
private-domain: "${revIpDomain}.in-addr.arpa."
domain-insecure: "${revIpDomain}.in-addr.arpa."
local-zone: "${revIpDomain}.in-addr.arpa" transparent
options.services.router.recursiveDns = {
enable = mkEnableOption "router recursive dns service";
forward-zone:
name: "${localDomain}."
forward-addr: 127.0.0.1@5553
networkIdIp = mkOption {
type = types.str;
example = "192.168.0.0";
description = ''
Network ID IP of local network.
'';
};
};
forward-zone:
name: "${revIpDomain}.in-addr.arpa."
forward-addr: 127.0.0.1@5553
'';
config = mkIf cfg.enable {
services.unbound = {
enable = true;
interfaces = [ "127.0.0.1" routerCfg.internalRouterIP ];
allowedAccess = [ "127.0.0.0/24" "${cfg.networkIdIp}/${toString routerCfg.internalPrefixLength}" ];
extraConfig = mkIf dhcpCfg.enable ''
# Custom configuration (leave this note to assure indentation!)
do-not-query-localhost: no
private-domain: "${dhcpCfg.localDomain}."
domain-insecure: "${dhcpCfg.localDomain}."
private-domain: "${revIpDomain}.in-addr.arpa."
domain-insecure: "${revIpDomain}.in-addr.arpa."
local-zone: "${revIpDomain}.in-addr.arpa" transparent
forward-zone:
name: "${dhcpCfg.localDomain}."
forward-addr: 127.0.0.1@${dhcpCfg.lanLocalDnsPort}
forward-zone:
name: "${revIpDomain}.in-addr.arpa."
forward-addr: 127.0.0.1@${dhcpCfg.lanLocalDnsPort}
'';
};
};
}