mirror of
https://github.com/nmasur/dotfiles
synced 2024-12-26 05:54:54 +00:00
72 lines
2.1 KiB
Nix
72 lines
2.1 KiB
Nix
# Bind is a DNS service. This allows me to resolve public domains locally so
|
|
# when I'm at home, I don't have to travel over the Internet to reach my
|
|
# server.
|
|
|
|
# To set this on all home machines, I point my router's DNS resolver to the
|
|
# local IP address of the machine running this service (swan).
|
|
|
|
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
|
|
localIp = "192.168.1.218";
|
|
localServices = [
|
|
config.hostnames.stream
|
|
config.hostnames.content
|
|
config.hostnames.books
|
|
config.hostnames.download
|
|
];
|
|
mkRecord = service: "${service} A ${localIp}";
|
|
localRecords = lib.concatLines (map mkRecord localServices);
|
|
|
|
in {
|
|
|
|
config = lib.mkIf config.services.bind.enable {
|
|
|
|
# Normally I block all requests not coming from Cloudflare, so I have to also
|
|
# allow my local network.
|
|
caddy.cidrAllowlist = [ "192.168.0.0/16" ];
|
|
|
|
services.bind = {
|
|
|
|
# Allow requests coming from these IPs. This way I don't somehow get
|
|
# spammed with DNS requests coming from the Internet.
|
|
cacheNetworks = [ "127.0.0.0/24" "192.168.0.0/16" ];
|
|
|
|
# When making normal DNS requests, forward them to Cloudflare to resolve.
|
|
forwarders = [ "1.1.1.1" "1.0.0.1" ];
|
|
|
|
ipv4Only = true;
|
|
|
|
# Use rpz zone as an override
|
|
extraOptions = ''response-policy { zone "rpz"; };'';
|
|
|
|
zones = {
|
|
rpz = {
|
|
master = true;
|
|
file = pkgs.writeText "db.rpz" ''
|
|
$TTL 60 ; 1 minute
|
|
@ IN SOA localhost. root.localhost. (
|
|
2023071800 ; serial
|
|
1h ; refresh
|
|
30m ; retry
|
|
1w ; expire
|
|
30m ; minimum ttl
|
|
)
|
|
IN NS localhost.
|
|
localhost A 127.0.0.1
|
|
${localRecords}
|
|
'';
|
|
};
|
|
};
|
|
|
|
};
|
|
|
|
# We must allow DNS traffic to hit our machine as well
|
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
|
|
};
|
|
|
|
}
|