diff --git a/hosts/vulpes/core/secrets.nix b/hosts/vulpes/core/secrets.nix index 93a349c..1ff8c86 100644 --- a/hosts/vulpes/core/secrets.nix +++ b/hosts/vulpes/core/secrets.nix @@ -108,13 +108,6 @@ in # vaultwarden_env_file = { }; # - # Hickory - # - awoo-ren_zonekey = { - group = "hickory_secrets"; - mode = "0440"; - }; - # # Grafana # grafana_secret_key = { diff --git a/hosts/vulpes/infra/dns.nix b/hosts/vulpes/infra/dns.nix index e351855..2527cd9 100644 --- a/hosts/vulpes/infra/dns.nix +++ b/hosts/vulpes/infra/dns.nix @@ -63,10 +63,6 @@ let ; Netbird netbird IN A ${pm.net.ipv4.sand-archives.addr} netbird IN AAAA ${pm.net.ipv6.sand-archives.addr} - proxy.netbird IN A ${pm.net.ipv4.sand-archives.addr} - proxy.netbird IN AAAA ${pm.net.ipv6.sand-archives.addr} - *.proxy.netbird IN A ${pm.net.ipv4.sand-archives.addr} - *.proxy.netbird IN AAAA ${pm.net.ipv6.sand-archives.addr} cockpit IN A ${pm.net.ipv4.sand-archives.addr} cockpit IN AAAA ${pm.net.ipv6.sand-archives.addr} @@ -84,6 +80,8 @@ let code IN A ${pm.net.ipv4.sand-archives.addr} code IN AAAA ${pm.net.ipv6.sand-archives.addr} + *.code IN A ${pm.net.ipv4.sand-archives.addr} + *.code IN AAAA ${pm.net.ipv6.sand-archives.addr} s3 IN A ${pm.net.ipv4.sand-archives.addr} s3 IN AAAA ${pm.net.ipv6.sand-archives.addr} @@ -172,202 +170,37 @@ in ]; }; - hickory-dns = { + bind = { enable = true; - settings = { - listen_port = 5300; - prometheus_listen_addr = "0.0.0.0:5334"; - zones = [ - - # - # Revisit recursive resolver at a later date once bugs have been fixed - # - - # { - # zone = "."; - # zone_type = "External"; - # stores = [ - # { - # type = "recursor"; - # roots = root_hint; - # dnssec_policy.ValidateWithStaticKey.path = root_dnssec_keys; - # } - # ]; - # } - { - zone = "awoo.ren"; - zone_type = "Primary"; - file = null; - nx_proof_kind = "nsec"; - - stores = [ - { - type = "file"; - zone_path = awoo-ren_zonefile; - } - # { - # type = "sqlite"; - # zone_path = awoo-ren_zonefile; - # journal_path = "/var/lib/hickory-dns/awoo.ren.sqlite"; - # allow_update = true; - # tsig_keys = [ - # { - # name = "caddy_key"; - # key_file = pkgs.runCommand "tsig_caddy_key" { } '' - # printf '%s' "${pm.srv.bind.caddy_key}" | base64 -d > $out - # ''; - # algorithm = "hmac-sha512"; - # } - # ]; - # } - ]; - - keys = [ - { - key_path = config.sops.secrets.awoo-ren_zonekey.path; - algorithm = "ED25519"; - signer_name = "awoo.ren"; - } - ]; - } - { - zone = "fennie.eu"; - zone_type = "Primary"; - file = null; - nx_proof_kind = "nsec"; - - stores = [ - { - type = "file"; - zone_path = pkgs.writeText "fennie.eu" '' - $ORIGIN fennie.eu. - $TTL 5m - @ IN SOA ns1.fennie.eu. pup.fennie.eu. ( - 2026022201 ; serial - 3h ; refresh - 1h ; retry - 1w ; expire - 1h ) ; negative cache TTL - - IN NS ns1.fennie.eu. - IN NS ns2.fennie.eu. - - ; Base domain and name server - ns1 IN A ${pm.net.ipv4.sand-archives.addr} - ns1 IN AAAA ${pm.net.ipv6.sand-archives.addr} - ns2 IN A ${pm.net.ipv4.sand-archives.addr} - ns2 IN AAAA ${pm.net.ipv6.sand-archives.addr} - @ IN A ${pm.net.ipv4.sand-archives.addr} - @ IN AAAA ${pm.net.ipv6.sand-archives.addr} - ''; - } - # { - # type = "sqlite"; - # zone_path = awoo-ren_zonefile; - # journal_path = "/var/lib/hickory-dns/awoo.ren.sqlite"; - # allow_update = true; - # tsig_keys = [ - # { - # name = "caddy_key"; - # key_file = pkgs.runCommand "tsig_caddy_key" { } '' - # printf '%s' "${pm.srv.bind.caddy_key}" | base64 -d > $out - # ''; - # algorithm = "hmac-sha512"; - # } - # ]; - # } - ]; - - keys = [ - { - key_path = config.sops.secrets.awoo-ren_zonekey.path; - algorithm = "ED25519"; - signer_name = "fennie.eu"; - } - ]; - } - { - zone = "killuaa.dev"; - zone_type = "Primary"; - file = null; - nx_proof_kind = "nsec"; - stores = [ - { - type = "file"; - zone_path = pkgs.writeText "zone_killuaa.dev" '' - $ORIGIN killuaa.dev. - $TTL 1h - @ IN SOA ns.killuaa.dev. roufpup.killuaa.dev. ( - 2026022201 ; serial - 3h ; refresh - 1h ; retry - 1w ; expire - 1h ) ; negative cache TTL - - IN NS ns.killuaa.dev. - - ns IN A ${pm.net.ipv4.sand-archives.addr} - ns IN AAAA ${pm.net.ipv6.sand-archives.addr} - @ IN A ${pm.net.ipv4.sand-archives.addr} - @ IN AAAA ${pm.net.ipv6.sand-archives.addr} - - ; Tuta - - @ IN MX 10 mail.tutanota.de. - @ IN TXT "t-verify=3971cf62a080f647ea848e037ac87776" - @ IN TXT "v=spf1 include:spf.tutanota.de -all" - _dmarc IN TXT "v=DMARC1; p=quarantine; adkim=s" - s1._domainkey IN CNAME s1.domainkey.tutanota.de. - s2._domainkey IN CNAME s2.domainkey.tutanota.de. - _mta-sts IN CNAME mta-sts.tutanota.de. - mta-sts IN CNAME mta-sts.tutanota.de. - - ; Domain verificaitons - - _atproto IN TXT "did=did:plc:e6e4lgy3nzdshjbpmjvnkbfd" - _fluxer IN TXT "fluxer-verification=a83d4bbb46d22050a732b4ea17b0ecba76589d60e9abcc9a2d727e021e53d435" - - git IN A ${pm.net.ipv4.sand-archives.addr} - git IN AAAA ${pm.net.ipv6.sand-archives.addr} - code IN A ${pm.net.ipv4.sand-archives.addr} - *.code IN A ${pm.net.ipv4.sand-archives.addr} - fluxer IN A ${pm.net.ipv4.sand-archives.addr} - - netbird IN A ${pm.net.ipv4.sand-archives.addr} - netbird IN AAAA ${pm.net.ipv6.sand-archives.addr} - auth IN A ${pm.net.ipv4.sand-archives.addr} - - ente IN A ${pm.net.ipv4.sand-archives.addr} - api.ente IN A ${pm.net.ipv4.sand-archives.addr} - albums.ente IN A ${pm.net.ipv4.sand-archives.addr} - s3.garage IN A ${pm.net.ipv4.sand-archives.addr} - - media IN A ${pm.net.ipv4.sand-archives.addr} - media IN AAAA ${pm.net.ipv6.sand-archives.addr} - seerr IN A ${pm.net.ipv4.sand-archives.addr} - anisonarr IN A ${pm.net.ipv4.sand-archives.addr} - aniradarr IN A ${pm.net.ipv4.sand-archives.addr} - showsonarr IN A ${pm.net.ipv4.sand-archives.addr} - movieradarr IN A ${pm.net.ipv4.sand-archives.addr} - prowlarr IN A ${pm.net.ipv4.sand-archives.addr} - torrent IN A 0.0.0.0 - - yap IN A ${pm.net.ipv4.sand-archives.addr} - - ntfy IN A ${pm.net.ipv4.sand-archives.addr} - mollysocket IN A ${pm.net.ipv4.sand-archives.addr} - - vaultwarden IN A ${pm.net.ipv4.sand-archives.addr} - - syncthing IN A ${pm.net.ipv4.sand-archives.addr} - - cockpit IN A ${pm.net.ipv4.sand-archives.addr} - pgadmin IN A ${pm.net.ipv4.sand-archives.addr} - ''; - } - ]; - } - ]; + cacheNetworks = [ + "127.0.0.0/24" + "::1/128" + ]; + listenOn = [ "any" ]; + listenOnPort = 5300; + forward = "only"; + forwarders = [ ]; + ipv4Only = true; + extraConfig = '' + key "caddy_key" { + algorithm hmac-sha512; + secret "${pm.srv.bind.caddy_key}"; + }; + ''; + zones = { + "awoo.ren" = { + master = true; + allowQuery = [ + "any" + ]; + extraConfig = '' + update-policy { + grant caddy_key wildcard *.awoo.ren. TXT; + }; + journal "/var/lib/named/awoo.ren.jnl"; + ''; + file = awoo-ren_zonefile; + }; }; }; @@ -435,21 +268,19 @@ in }; }; - users.groups = { - hickory_secrets = { - name = "hickory_secrets"; - }; - }; - systemd = { - services = { - hickory-dns = { - serviceConfig = { - SupplementaryGroups = [ - "hickory_secrets" - ]; - }; + services.bind = { + serviceConfig = { + ReadWritePaths = [ + "/var/lib/named" + "/run/named" + "-/nix/store" + ]; }; }; + + tmpfiles.rules = [ + "d /var/lib/named 0755 named named -" + ]; }; } diff --git a/hosts/vulpes/infra/proxy.nix b/hosts/vulpes/infra/proxy.nix index f782a6c..f6e5026 100644 --- a/hosts/vulpes/infra/proxy.nix +++ b/hosts/vulpes/infra/proxy.nix @@ -45,6 +45,29 @@ in acmeCA = "https://acme-v02.api.letsencrypt.org/directory"; email = "pup@awoo.ren"; logFormat = lib.mkForce "level DEBUG"; + globalConfig = '' + acme_dns rfc2136 { + key_name "caddy_key" + key_alg "hmac-sha512" + key "${pm.srv.bind.caddy_key}" + server "127.0.0.1:5300" + } + + on_demand_tls { + ask http://127.0.0.1:30500 + } + ''; + + extraConfig = '' + http://:30500 { + respond "Gay sex" + } + + http://:5041 { + rewrite * /tangled_hook + reverse_proxy localhost:5040 + } + ''; virtualHosts = { # @@ -176,8 +199,12 @@ in }; "code.awoo.ren" = { + serverAliases = [ "*.code.awoo.ren" ]; extraConfig = '' reverse_proxy http://127.0.0.1:3300 + tls { + on_demand + } ''; }; @@ -283,13 +310,6 @@ in } ''; }; - }; - extraConfig = '' - http://:5041 { - rewrite * /tangled_hook - reverse_proxy localhost:5040 - } - ''; }; } diff --git a/hosts/work/default.nix b/hosts/work/default.nix index 97ae1d3..e94f3a4 100644 --- a/hosts/work/default.nix +++ b/hosts/work/default.nix @@ -7,7 +7,7 @@ { imports = [ args.pins.nix-index.nixosModules.nix-index - /home/roufpup/repos/fluxer/nix/module + # /home/roufpup/repos/fluxer/nix/module ] ++ (args.pup_lib.module_imports ./core) ++ (args.pup_lib.module_imports ./users); @@ -15,7 +15,7 @@ time.timeZone = "Europe/Amsterdam"; i18n.defaultLocale = "en_US.UTF-8"; - services.fluxer.settings.domain = "chat.awoo.ren"; + # services.fluxer.settings.domain = "chat.awoo.ren"; environment = { enableAllTerminfo = true;