nixos-servers/nixos/modules/networking/dmz/default.nix

69 lines
1.6 KiB
Nix
Raw Normal View History

{ pkgs, lib, config, dns, ... }@inputs:
2024-01-07 19:24:12 +00:00
let
2024-01-07 22:06:27 +00:00
cfg = config.lab.networking.dmzServices;
2024-01-07 19:24:12 +00:00
kunisZoneFile = pkgs.writeTextFile {
name = "kunis-zone-file";
text = (dns.lib.toString "kun.is" (import ./zones/kun.is.nix inputs));
2024-01-07 19:24:12 +00:00
};
geokunis2nlZoneFile = pkgs.writeTextFile {
name = "geokunis2nl-zone-file";
text = (dns.lib.toString "geokunis2.nl" (import ./zones/geokunis2.nl.nix inputs));
2024-01-07 19:24:12 +00:00
};
in
{
2024-01-07 22:06:27 +00:00
options.lab.networking.dmzServices.enable = lib.mkOption {
2024-01-07 19:24:12 +00:00
default = false;
type = lib.types.bool;
description = ''
Whether to enable an authoritative DNS server and DNSmasq for DMZ network.
'';
};
config = lib.mkIf cfg.enable {
2024-01-13 16:33:14 +00:00
lab.networking.allowDMZConnectivity = true;
networking.firewall.interfaces.${config.lab.networking.dmzBridgeName} = {
allowedTCPPorts = [ 53 5353 ];
allowedUDPPorts = [ 53 67 5353 ];
2024-01-07 19:24:12 +00:00
};
services = {
bind = {
enable = true;
forwarders = [ ];
2024-01-07 19:24:12 +00:00
extraOptions = ''
2024-01-14 18:31:17 +00:00
allow-transfer { none; };
allow-recursion { none; };
2024-01-14 18:31:17 +00:00
version none;
notify no;
'';
2024-01-07 19:24:12 +00:00
zones = {
"kun.is" = {
master = true;
file = kunisZoneFile;
allowQuery = [ "any" ];
};
"geokunis2.nl" = {
master = true;
file = geokunis2nlZoneFile;
allowQuery = [ "any" ];
2024-01-14 18:31:17 +00:00
slaves = [
"87.253.155.96/27"
"157.97.168.160/27"
];
};
2024-01-07 19:24:12 +00:00
};
};
dnsmasq = {
enable = true;
settings = import ./dnsmasq.nix inputs;
2024-01-07 19:24:12 +00:00
};
};
};
}