change nixos -> nix

nix/modules/networking/dmz_services/default.nix

@@ -0,0 +1,73 @@
+# TODO: we should split this into DHCP and DNS
+# This decoupling makes it easier to put one service on another host.
+{ pkgs, lib, config, dns, ... }@inputs:
+let
+  cfg = config.lab.networking.dmz.services;
+
+  kunisZoneFile = pkgs.writeTextFile {
+    name = "kunis-zone-file";
+    text = (dns.lib.toString "kun.is" (import ./zones/kun.is.nix inputs));
+  };
+
+  geokunis2nlZoneFile = pkgs.writeTextFile {
+    name = "geokunis2nl-zone-file";
+    text = (dns.lib.toString "geokunis2.nl" (import ./zones/geokunis2.nl.nix inputs));
+  };
+in
+{
+  options.lab.networking.dmz.services.enable = lib.mkOption {
+    default = false;
+    type = lib.types.bool;
+    description = ''
+      Whether to enable an authoritative DNS server and DNSmasq for DMZ network.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    # TODO Remove this; make this explicit in the machine config.
+    lab.networking.dmz.allowConnectivity = true;
+
+    # TODO: listen only on dmz interface, make this portable between physical and VM.
+    networking.firewall = {
+      allowedTCPPorts = [ 53 5353 ];
+      allowedUDPPorts = [ 53 67 5353 ];
+    };
+
+    services = {
+      bind = {
+        enable = true;
+        forwarders = [ ];
+
+        extraOptions = ''
+          allow-transfer { none; };
+          allow-recursion { none; };
+          version none;
+          notify no;
+        '';
+
+        zones = {
+          "kun.is" = {
+            master = true;
+            file = kunisZoneFile;
+            allowQuery = [ "any" ];
+          };
+
+          "geokunis2.nl" = {
+            master = true;
+            file = geokunis2nlZoneFile;
+            allowQuery = [ "any" ];
+            slaves = [
+              "87.253.155.96/27"
+              "157.97.168.160/27"
+            ];
+          };
+        };
+      };
+
+      dnsmasq = {
+        enable = true;
+        settings = import ./dnsmasq.nix inputs;
+      };
+    };
+  };
+}