use dns.nix voor zone file generation

nixos/modules/dns/default.nix

@@ -0,0 +1,65 @@
+{ pkgs, lib, config, dns, ... }:
+let
+  cfg = config.lab.dns;
+  publicIpv4 = "192.145.57.90";
+  kunisZoneFile = pkgs.writeTextFile {
+    name = "kunis-zone-file";
+    text = (dns.lib.toString "kun.is" (import ./zones/kun.is.nix { inherit dns publicIpv4; }));
+  };
+
+  geokunis2nlZoneFile = pkgs.writeTextFile {
+    name = "geokunis2nl-zone-file";
+    text = (dns.lib.toString "geokunis2.nl" (import ./zones/geokunis2.nl.nix { inherit dns publicIpv4; }));
+  };
+in
+{
+  options.lab.dns.enable = lib.mkOption {
+    default = false;
+    type = lib.types.bool;
+    description = ''
+      Whether to enable an authoritative DNS server and DNSmasq for DMZ network.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall = {
+      allowedTCPPorts = [ 53 ];
+      allowedUDPPorts = [ 53 ];
+    };
+
+    services.bind = {
+      enable = true;
+      forwarders = [ ];
+      # TODO: disable ipv6 for now, as the hosts themselves lack routes it seems.
+      ipv4Only = true;
+
+      extraOptions = ''
+        allow-transfer { none; }; 
+        allow-recursion { none; };
+        version "No dice.";
+      '';
+
+      zones = {
+        "kun.is" = {
+          master = true;
+          file = kunisZoneFile;
+          allowQuery = [ "any" ];
+          extraConfig = ''
+            notify yes;
+            allow-update { none; };
+          '';
+        };
+
+        "geokunis2.nl" = {
+          master = true;
+          file = geokunis2nlZoneFile;
+          allowQuery = [ "any" ];
+          extraConfig = ''
+            notify yes;
+            allow-update { none; };
+          '';
+        };
+      };
+    };
+  };
+}

nixos/modules/dns/zones/geokunis2.nl.nix

@@ -0,0 +1,47 @@
+{ publicIpv4, dns }:
+with dns.lib.combinators;
+
+{
+  SOA = {
+    nameServer = "ns";
+    adminEmail = "hostmaster@geokunis2.nl";
+    serial = 1704580936;
+  };
+
+  NS = [
+    "ns.geokunis2.nl."
+    "ns0.transip.net."
+    "ns1.transip.nl."
+    "ns2.transip.eu."
+  ];
+
+  MX = [ (mx.mx 10 "mail.geokunis2.nl.") ];
+
+  A = [ publicIpv4 ];
+  AAAA = [ "2a0d:6e00:1a77:30:b62e:99ff:fe77:1bda" ];
+  CAA = letsEncrypt "caa@geokunis2.nl";
+
+  subdomains = {
+    mail.A = [ publicIpv4 ];
+    wg4.A = [ publicIpv4 ];
+    wg6.AAAA = [ "2a0d:6e00:1a77::1" ];
+    tuindersweijde.A = [ publicIpv4 ];
+    inbucket.A = [ publicIpv4 ];
+    kms.A = [ publicIpv4 ];
+
+    wg = {
+      A = [ publicIpv4 ];
+      AAAA = [ "2a0d:6e00:1a77::1" ];
+    };
+
+    ns = {
+      A = [ publicIpv4 ];
+      AAAA = [ "2a0d:6e00:1a77:30:c8fe:c0ff:feff:ee07" ];
+    };
+
+    cyberchef = {
+      A = [ publicIpv4 ];
+      AAAA = [ "2a0d:6e00:1a77:30:c8fe:c0ff:feff:ee03" ];
+    };
+  };
+}

nixos/modules/dns/zones/kun.is.nix

@@ -0,0 +1,28 @@
+{ publicIpv4, dns }:
+with dns.lib.combinators;
+
+{
+  CAA = letsEncrypt "caa@kun.is";
+
+  SOA = {
+    nameServer = "ns1";
+    adminEmail = "webmaster@kun.is";
+    serial = 1704580936;
+  };
+
+  NS = [
+    "ns1.kun.is."
+    "ns2.kun.is."
+  ];
+
+  MX = [
+    (mx.mx 10 "mail.kun.is.")
+  ];
+
+  subdomains = {
+    ns.A = [ publicIpv4 ];
+    ns1.A = [ publicIpv4 ];
+    ns2.A = [ publicIpv4 ];
+    "*".A = [ publicIpv4 ];
+  };
+}