home/nixos-servers
home/nixos-servers
Archived
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

move dnsmasq to kubernetes

Browse source
This commit is contained in:
Pim Kunis 2024-04-11 23:17:01 +02:00
parent ffc8db4f03
commit 218bee6c17
8 changed files with 66 additions and 160 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/modules/networking/default.nix
View file

@ -1,8 +1,6 @@
{ lib, config, machine, ... }:
let cfg = config.lab.networking;
in {
imports = [ ./dmz_services ];
options.lab.networking = {
dmz = {
allowConnectivity = lib.mkOption {

31
nix/modules/networking/dmz_services/default.nix
View file

@ -1,31 +0,0 @@
{ lib, config, ... }@inputs:
let
cfg = config.lab.networking.dmz.services;
in
{
options.lab.networking.dmz.services.enable = lib.mkOption {
default = false;
type = lib.types.bool;
description = ''
Whether to enable an authoritative DNS server and DNSmasq for DMZ network.
'';
};
config = lib.mkIf cfg.enable {
# TODO Remove this; make this explicit in the machine config.
lab.networking.dmz.allowConnectivity = true;
# TODO: listen only on dmz interface, make this portable between physical and VM.
networking.firewall = {
allowedTCPPorts = [ 53 5353 ];
allowedUDPPorts = [ 53 67 5353 ];
};
services = {
dnsmasq = {
enable = true;
settings = import ./dnsmasq.nix inputs;
};
};
};
}

46
nix/modules/networking/dmz_services/dnsmasq.nix
View file

@ -1,46 +0,0 @@
{ config, ... }:
let
cfg = config.lab.networking;
in
{
no-resolv = true;
local = "/dmz/";
dhcp-fqdn = true;
no-hosts = true;
expand-hosts = true;
domain = "dmz";
dhcp-authoritative = true;
ra-param = "*,0,0";
alias = "${cfg.public.ipv4.router},192.168.30.128";
log-dhcp = true;
log-queries = true;
port = "5353";
host-record = [
"hermes.dmz,${cfg.dmz.ipv4.services},${cfg.dmz.ipv6.services}"
];
server = [
cfg.dmz.ipv4.router
"/kun.is/192.168.30.134"
];
dhcp-range = [
"192.168.30.50,192.168.30.127,15m"
"2a0d:6e00:1a77:30::,ra-stateless,ra-names"
];
dhcp-host = [
"b8:27:eb:b9:ab:e2,esrom"
];
dhcp-option = [
"3,${cfg.dmz.ipv4.router}"
"option:dns-server,${cfg.dmz.ipv4.router}"
"option6:dns-server,[2a02:58:19a:30::1]"
];
address = [
"/kms.kun.is/192.168.30.129"
"/ssh.git.kun.is/192.168.30.132"
];
}

51
nix/modules/networking/dmz_services/zones/kun.is.nix
View file

@ -1,51 +0,0 @@
{ config, dns, ... }:
with dns.lib.combinators;
let
cfg = config.lab.networking;
in
{
CAA = letsEncrypt "caa@kun.is";
SOA = {
nameServer = "ns1";
adminEmail = "webmaster@kun.is";
serial = 2024021702;
};
NS = [
"ns1.kun.is."
"ns2.kun.is."
];
MX = [
(mx.mx 10 "mail.kun.is.")
];
TXT = [
(with spf; soft [ "include:spf.glasnet.nl" ])
];
subdomains = rec {
"*".A = [ cfg.public.ipv4.router ];
ns = host cfg.public.ipv4.router cfg.dmz.ipv6.services;
ns1 = ns;
ns2 = ns;
# Override because wg is on opnsense so ipv6 differs from "cfg.dmz.ipv6.services"
wg = host cfg.public.ipv4.router cfg.dmz.ipv6.router;
#for SMTP2GO to be able send emails from kun.is domain
em670271 = {
CNAME = [ "return.smtp2go.net." ];
};
"s670271._domainkey" = {
CNAME = [ "dkim.smtp2go.net." ];
};
link = {
CNAME = [ "track.smtp2go.net." ];
};
};
}