Init

modules/bind9/default.nix

@@ -0,0 +1,153 @@
+{ config, lib, globals, dns, ... }:
+let
+  kunisZone = dns.lib.toString "kun.is" (import ./kun.is.zone.nix globals dns);
+in
+{
+  options.bind9.enable = lib.mkEnableOption "bind9";
+
+  config = lib.mkIf config.bind9.enable {
+    kubernetes.resources = {
+      configMaps = {
+        bind9-env.data.TZ = "Europe/Amsterdam";
+
+        bind9-config.data = {
+          # TODO: this was copied from nix's generated bind config
+          # Is there a way to generate this without actually running the nixos module?
+          config = ''
+            acl cachenetworks {  127.0.0.0/24;  };
+            acl badnetworks {  };
+
+            options {
+              listen-on {  any;  };
+              listen-on-v6 {  any;  };
+              allow-query { cachenetworks; };
+              blackhole { badnetworks; };
+              forward first;
+              forwarders {  };
+              directory "/run/named";
+              pid-file "/run/named/named.pid";
+              allow-transfer { none; };
+              allow-recursion { none; };
+              version none;
+              notify no;
+            };
+
+            zone "kun.is" {
+              type master;
+              file "/etc/bind/kun.is.zone";
+              allow-transfer {  };
+              allow-query { any; };
+            };
+          '';
+
+          kunis-zone = kunisZone;
+        };
+      };
+
+      deployments.bind9.spec = {
+        selector.matchLabels.app = "bind9";
+
+        template = {
+          metadata.labels.app = "bind9";
+
+          spec = {
+            containers = {
+              bind9-udp = {
+                image = globals.images.bind9;
+                envFrom = [{ configMapRef.name = "bind9-env"; }];
+
+                ports.dns-udp = {
+                  containerPort = 53;
+                  protocol = "UDP";
+                };
+
+                volumeMounts = [
+                  {
+                    name = "config";
+                    mountPath = "/etc/bind/named.conf";
+                    subPath = "config";
+                  }
+                  {
+                    name = "config";
+                    mountPath = "/etc/bind/kun.is.zone";
+                    subPath = "kunis-zone";
+                  }
+                ];
+              };
+
+              bind9-tcp = {
+                image = globals.images.bind9;
+                envFrom = [{ configMapRef.name = "bind9-env"; }];
+
+                ports.dns-tcp = {
+                  containerPort = 53;
+                  protocol = "TCP";
+                };
+
+                volumeMounts = [
+                  {
+                    name = "config";
+                    mountPath = "/etc/bind/named.conf";
+                    subPath = "config";
+                  }
+                  {
+                    name = "config";
+                    mountPath = "/etc/bind/kun.is.zone";
+                    subPath = "kunis-zone";
+                  }
+                ];
+              };
+            };
+
+            volumes = [{
+              name = "config";
+              configMap.name = "bind9-config";
+            }];
+          };
+        };
+      };
+
+      services = {
+        bind9-udp = {
+          metadata.annotations = {
+            "metallb.universe.tf/loadBalancerIPs" = "${globals.bind9IPv4},${globals.bind9Ipv6}";
+            "metallb.universe.tf/allow-shared-ip" = "dns";
+          };
+
+          spec = {
+            type = "LoadBalancer";
+            selector.app = "bind9";
+            ipFamilies = [ "IPv4" "IPv6" ];
+            ipFamilyPolicy = "RequireDualStack";
+
+            ports.dns = {
+              port = 53;
+              targetPort = "dns-udp";
+              protocol = "UDP";
+            };
+          };
+        };
+
+        bind9-tcp = {
+          metadata.annotations = {
+            "metallb.universe.tf/loadBalancerIPs" = "${globals.bind9IPv4},${globals.bind9Ipv6}";
+            "metallb.universe.tf/allow-shared-ip" = "dns";
+          };
+
+          spec = {
+            type = "LoadBalancer";
+            selector.app = "bind9";
+            ipFamilies = [ "IPv4" "IPv6" ];
+            ipFamilyPolicy = "RequireDualStack";
+
+            ports.dns = {
+              port = 53;
+              targetPort = "dns-tcp";
+              protocol = "TCP";
+            };
+          };
+        };
+      };
+    };
+  };
+}

modules/bind9/kun.is.zone.nix

@@ -0,0 +1,52 @@
+globals: dns: with dns.lib.combinators; {
+  CAA = letsEncrypt "caa@kun.is";
+
+  SOA = {
+    nameServer = "ns1";
+    adminEmail = "webmaster.kun.is";
+    serial = 2024041301;
+  };
+
+  NS = [
+    "ns1.kun.is."
+    "ns2.kun.is."
+  ];
+
+  MX = [
+    (mx.mx 10 "mail.kun.is.")
+  ];
+
+  TXT = [
+    (with spf; soft [ "include:spf.glasnet.nl" ])
+  ];
+
+  subdomains = rec {
+    "*".A = [ globals.routerPublicIPv4 ];
+
+    ns = {
+      A = [ globals.routerPublicIPv4 ];
+      AAAA = [ ];
+    };
+
+    ns1 = ns;
+    ns2 = ns;
+
+    wg = {
+      A = [ globals.routerPublicIPv4 ];
+      AAAA = [ ];
+    };
+
+    #for SMTP2GO to be able send emails from kun.is domain
+    em670271 = {
+      CNAME = [ "return.smtp2go.net." ];
+    };
+
+    "s670271._domainkey" = {
+      CNAME = [ "dkim.smtp2go.net." ];
+    };
+
+    link = {
+      CNAME = [ "track.smtp2go.net." ];
+    };
+  };
+}