dnscache: remove
This commit is contained in:
parent
d77639d9a7
commit
1369154dbb
|
@ -1,229 +0,0 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
imports = [ <nixpkgs/nixos/modules/profiles/minimal.nix> ];
|
||||
nix.useSandbox = false;
|
||||
nix.maxJobs = lib.mkDefault 4;
|
||||
|
||||
boot.isContainer = true;
|
||||
# /sbin/init
|
||||
boot.loader.initScript.enable = true;
|
||||
boot.loader.grub.enable = false;
|
||||
#boot.supportedFilesystems = ["zfs" "ext2" "ext3" "vfat" "fat32" "bcache" "bcachefs"];
|
||||
|
||||
fileSystems."/" = {
|
||||
fsType = "rootfs";
|
||||
device = "rootfs";
|
||||
};
|
||||
|
||||
networking.hostName = "dnscache"; # Define your hostname.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
networking.useNetworkd = true;
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.eth0.ipv4.addresses = [{
|
||||
address = "172.20.73.8";
|
||||
prefixLength = 26;
|
||||
}];
|
||||
networking.defaultGateway = "172.20.73.1";
|
||||
services.resolved.enable = false;
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Berlin";
|
||||
# Select internationalisation properties.
|
||||
i18n = {
|
||||
defaultLocale = "en_US.UTF-8";
|
||||
supportedLocales = lib.mkForce [ "en_US.UTF-8/UTF-8" ];
|
||||
};
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [ wget vim traceroute tcpdump bind ];
|
||||
|
||||
# Create a few files early before packing tarball for Proxmox
|
||||
# architecture/OS detection.
|
||||
system.extraSystemBuilderCmds = ''
|
||||
mkdir -m 0755 -p $out/bin
|
||||
ln -s ${pkgs.bash}/bin/bash $out/bin/sh
|
||||
mkdir -m 0755 -p $out/sbin
|
||||
ln -s ../init $out/sbin/init
|
||||
'';
|
||||
|
||||
# This value determines the NixOS release with which your system is to be
|
||||
# compatible, in order to avoid breaking some software such as database
|
||||
# servers. You should change this only after NixOS release notes say you
|
||||
# should.
|
||||
system.stateVersion = "19.09"; # Did you read the comment?
|
||||
|
||||
networking.firewall.allowedUDPPorts = [ 53 ];
|
||||
networking.firewall.allowedTCPPorts = [ 22 53 ];
|
||||
# For NixOps:
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
permitRootLogin = "yes";
|
||||
};
|
||||
services.unbound = {
|
||||
enable = true;
|
||||
interfaces = [ "0.0.0.0" "::0" ];
|
||||
allowedAccess = [
|
||||
"fd23:42:c3d2:500::/56"
|
||||
"2a02:8106:208:5200::/56"
|
||||
"2a02:8106:211:e900::/56"
|
||||
"::172.20.72.0/117"
|
||||
"::172.22.99.0/120"
|
||||
"::1/128"
|
||||
"172.20.72.0/21"
|
||||
"10.0.0.0/24"
|
||||
"10.200.0.0/15"
|
||||
"172.22.99.0/24"
|
||||
"127.0.0.0/8"
|
||||
];
|
||||
forwardAddresses = [
|
||||
# Quad9
|
||||
"9.9.9.9@853" # dns.quad9.net
|
||||
"2620:fe::fe@853" # dns.quad9.net
|
||||
"149.112.112.112@853" # dns.quad9.net
|
||||
"2620:fe::9@853" # dns.quad9.net
|
||||
# Cloudflare DNS
|
||||
"1.1.1.1@853" # cloudflare-dns.com
|
||||
"2606:4700:4700::1111@853" # cloudflare-dns.com
|
||||
"1.0.0.1@853" # cloudflare-dns.com
|
||||
''
|
||||
2606:4700:4700::1001@853
|
||||
forward-ssl-upstream: yes'' # cloudflare-dns.com
|
||||
];
|
||||
extraConfig = ''
|
||||
server:
|
||||
domain-insecure: "dn42"
|
||||
domain-insecure: "20.172.in-addr.arpa"
|
||||
domain-insecure: "21.172.in-addr.arpa"
|
||||
domain-insecure: "22.172.in-addr.arpa"
|
||||
domain-insecure: "23.172.in-addr.arpa"
|
||||
domain-insecure: "d.f.ip6.arpa"
|
||||
domain-insecure: "ffdd"
|
||||
domain-insecure: "200.10.in-addr.arpa"
|
||||
local-zone: "20.172.in-addr.arpa." nodefault
|
||||
local-zone: "21.172.in-addr.arpa." nodefault
|
||||
local-zone: "22.172.in-addr.arpa." nodefault
|
||||
local-zone: "23.172.in-addr.arpa." nodefault
|
||||
local-zone: "d.f.ip6.arpa." nodefault
|
||||
local-zone: "ffdd." nodefault
|
||||
local-zone: "200.10.in-addr.arpa." nodefault
|
||||
|
||||
remote-control:
|
||||
control-enable: yes
|
||||
server-key-file: /var/lib/unbound/unbound_server.key
|
||||
server-cert-file: /var/lib/unbound/unbound_server.pem
|
||||
control-key-file: /var/lib/unbound/unbound_control.key
|
||||
control-cert-file: /var/lib/unbound/unbound_control.pem
|
||||
|
||||
forward-zone:
|
||||
name: "99.22.172.in-addr.arpa"
|
||||
forward-host: "ns.c3d2.de"
|
||||
|
||||
forward-zone:
|
||||
name: "zentralwerk.dn42"
|
||||
forward-host: "dns.serv.zentralwerk.org"
|
||||
|
||||
forward-zone:
|
||||
name: "72.20.172.in-addr.arpa"
|
||||
forward-host: "dns.serv.zentralwerk.org"
|
||||
|
||||
forward-zone:
|
||||
name: "73.20.172.in-addr.arpa"
|
||||
forward-host: "dns.serv.zentralwerk.org"
|
||||
|
||||
forward-zone:
|
||||
name: "74.20.172.in-addr.arpa"
|
||||
forward-host: "dns.serv.zentralwerk.org"
|
||||
|
||||
forward-zone:
|
||||
name: "75.20.172.in-addr.arpa"
|
||||
forward-host: "dns.serv.zentralwerk.org"
|
||||
|
||||
forward-zone:
|
||||
name: "76.20.172.in-addr.arpa"
|
||||
forward-host: "dns.serv.zentralwerk.org"
|
||||
|
||||
forward-zone:
|
||||
name: "77.20.172.in-addr.arpa"
|
||||
forward-host: "dns.serv.zentralwerk.org"
|
||||
|
||||
forward-zone:
|
||||
name: "dn42"
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "20.172.in-addr.arpa"
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "21.172.in-addr.arpa"
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "22.172.in-addr.arpa"
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "23.172.in-addr.arpa"
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "d.f.ip6.arpa"
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "ffdd"
|
||||
forward-addr: 10.200.0.4
|
||||
forward-addr: 10.200.0.16
|
||||
|
||||
forward-zone:
|
||||
name: "200.10.in-addr.arpa"
|
||||
forward-addr: 10.200.0.4
|
||||
forward-addr: 10.200.0.16
|
||||
'';
|
||||
};
|
||||
|
||||
services.collectd = {
|
||||
enable = true;
|
||||
autoLoadPlugin = true;
|
||||
plugins = {
|
||||
cpu = "";
|
||||
memory = "";
|
||||
interface = "";
|
||||
load = "";
|
||||
exec = let
|
||||
unboundScript = builtins.toFile "unbound.rb" ''
|
||||
loop do
|
||||
`/run/current-system/sw/bin/unbound-control -c /var/lib/unbound/unbound.conf stats_noreset`
|
||||
.lines
|
||||
.filter { |l| l =~ /^total\./ }
|
||||
.each { |l|
|
||||
if l =~ /total\.(.+?)=([\d\.]+)/
|
||||
name = $1
|
||||
value = $2.to_f
|
||||
if name =~ /\.avg$/ || name =~ /\.median$/ || name =~ /\.max$/ || name =~ /\.min$/
|
||||
ty = "gauge"
|
||||
else
|
||||
ty = "derive"
|
||||
value = value.to_i
|
||||
end
|
||||
puts "PUTVAL dnscache/unbound/#{ty}-#{name} N:#{value}"
|
||||
end
|
||||
}
|
||||
|
||||
sleep 10
|
||||
end
|
||||
'';
|
||||
in ''
|
||||
Exec "collectd" "${pkgs.ruby}/bin/ruby" "${unboundScript}"
|
||||
'';
|
||||
network = ''
|
||||
Server "grafana.serv.zentralwerk.dn42" "25826"
|
||||
'';
|
||||
};
|
||||
extraConfig = ''
|
||||
Interval 10
|
||||
'';
|
||||
};
|
||||
}
|
Loading…
Reference in New Issue