dnscache: remove
This commit is contained in:
parent
d77639d9a7
commit
1369154dbb
|
@ -1,229 +0,0 @@
|
||||||
{ config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [ <nixpkgs/nixos/modules/profiles/minimal.nix> ];
|
|
||||||
nix.useSandbox = false;
|
|
||||||
nix.maxJobs = lib.mkDefault 4;
|
|
||||||
|
|
||||||
boot.isContainer = true;
|
|
||||||
# /sbin/init
|
|
||||||
boot.loader.initScript.enable = true;
|
|
||||||
boot.loader.grub.enable = false;
|
|
||||||
#boot.supportedFilesystems = ["zfs" "ext2" "ext3" "vfat" "fat32" "bcache" "bcachefs"];
|
|
||||||
|
|
||||||
fileSystems."/" = {
|
|
||||||
fsType = "rootfs";
|
|
||||||
device = "rootfs";
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.hostName = "dnscache"; # Define your hostname.
|
|
||||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
|
||||||
networking.useNetworkd = true;
|
|
||||||
networking.useDHCP = false;
|
|
||||||
networking.interfaces.eth0.ipv4.addresses = [{
|
|
||||||
address = "172.20.73.8";
|
|
||||||
prefixLength = 26;
|
|
||||||
}];
|
|
||||||
networking.defaultGateway = "172.20.73.1";
|
|
||||||
services.resolved.enable = false;
|
|
||||||
|
|
||||||
# Set your time zone.
|
|
||||||
time.timeZone = "Europe/Berlin";
|
|
||||||
# Select internationalisation properties.
|
|
||||||
i18n = {
|
|
||||||
defaultLocale = "en_US.UTF-8";
|
|
||||||
supportedLocales = lib.mkForce [ "en_US.UTF-8/UTF-8" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# List packages installed in system profile. To search, run:
|
|
||||||
# $ nix search wget
|
|
||||||
environment.systemPackages = with pkgs; [ wget vim traceroute tcpdump bind ];
|
|
||||||
|
|
||||||
# Create a few files early before packing tarball for Proxmox
|
|
||||||
# architecture/OS detection.
|
|
||||||
system.extraSystemBuilderCmds = ''
|
|
||||||
mkdir -m 0755 -p $out/bin
|
|
||||||
ln -s ${pkgs.bash}/bin/bash $out/bin/sh
|
|
||||||
mkdir -m 0755 -p $out/sbin
|
|
||||||
ln -s ../init $out/sbin/init
|
|
||||||
'';
|
|
||||||
|
|
||||||
# This value determines the NixOS release with which your system is to be
|
|
||||||
# compatible, in order to avoid breaking some software such as database
|
|
||||||
# servers. You should change this only after NixOS release notes say you
|
|
||||||
# should.
|
|
||||||
system.stateVersion = "19.09"; # Did you read the comment?
|
|
||||||
|
|
||||||
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
||||||
networking.firewall.allowedTCPPorts = [ 22 53 ];
|
|
||||||
# For NixOps:
|
|
||||||
services.openssh = {
|
|
||||||
enable = true;
|
|
||||||
permitRootLogin = "yes";
|
|
||||||
};
|
|
||||||
services.unbound = {
|
|
||||||
enable = true;
|
|
||||||
interfaces = [ "0.0.0.0" "::0" ];
|
|
||||||
allowedAccess = [
|
|
||||||
"fd23:42:c3d2:500::/56"
|
|
||||||
"2a02:8106:208:5200::/56"
|
|
||||||
"2a02:8106:211:e900::/56"
|
|
||||||
"::172.20.72.0/117"
|
|
||||||
"::172.22.99.0/120"
|
|
||||||
"::1/128"
|
|
||||||
"172.20.72.0/21"
|
|
||||||
"10.0.0.0/24"
|
|
||||||
"10.200.0.0/15"
|
|
||||||
"172.22.99.0/24"
|
|
||||||
"127.0.0.0/8"
|
|
||||||
];
|
|
||||||
forwardAddresses = [
|
|
||||||
# Quad9
|
|
||||||
"9.9.9.9@853" # dns.quad9.net
|
|
||||||
"2620:fe::fe@853" # dns.quad9.net
|
|
||||||
"149.112.112.112@853" # dns.quad9.net
|
|
||||||
"2620:fe::9@853" # dns.quad9.net
|
|
||||||
# Cloudflare DNS
|
|
||||||
"1.1.1.1@853" # cloudflare-dns.com
|
|
||||||
"2606:4700:4700::1111@853" # cloudflare-dns.com
|
|
||||||
"1.0.0.1@853" # cloudflare-dns.com
|
|
||||||
''
|
|
||||||
2606:4700:4700::1001@853
|
|
||||||
forward-ssl-upstream: yes'' # cloudflare-dns.com
|
|
||||||
];
|
|
||||||
extraConfig = ''
|
|
||||||
server:
|
|
||||||
domain-insecure: "dn42"
|
|
||||||
domain-insecure: "20.172.in-addr.arpa"
|
|
||||||
domain-insecure: "21.172.in-addr.arpa"
|
|
||||||
domain-insecure: "22.172.in-addr.arpa"
|
|
||||||
domain-insecure: "23.172.in-addr.arpa"
|
|
||||||
domain-insecure: "d.f.ip6.arpa"
|
|
||||||
domain-insecure: "ffdd"
|
|
||||||
domain-insecure: "200.10.in-addr.arpa"
|
|
||||||
local-zone: "20.172.in-addr.arpa." nodefault
|
|
||||||
local-zone: "21.172.in-addr.arpa." nodefault
|
|
||||||
local-zone: "22.172.in-addr.arpa." nodefault
|
|
||||||
local-zone: "23.172.in-addr.arpa." nodefault
|
|
||||||
local-zone: "d.f.ip6.arpa." nodefault
|
|
||||||
local-zone: "ffdd." nodefault
|
|
||||||
local-zone: "200.10.in-addr.arpa." nodefault
|
|
||||||
|
|
||||||
remote-control:
|
|
||||||
control-enable: yes
|
|
||||||
server-key-file: /var/lib/unbound/unbound_server.key
|
|
||||||
server-cert-file: /var/lib/unbound/unbound_server.pem
|
|
||||||
control-key-file: /var/lib/unbound/unbound_control.key
|
|
||||||
control-cert-file: /var/lib/unbound/unbound_control.pem
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "99.22.172.in-addr.arpa"
|
|
||||||
forward-host: "ns.c3d2.de"
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "zentralwerk.dn42"
|
|
||||||
forward-host: "dns.serv.zentralwerk.org"
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "72.20.172.in-addr.arpa"
|
|
||||||
forward-host: "dns.serv.zentralwerk.org"
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "73.20.172.in-addr.arpa"
|
|
||||||
forward-host: "dns.serv.zentralwerk.org"
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "74.20.172.in-addr.arpa"
|
|
||||||
forward-host: "dns.serv.zentralwerk.org"
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "75.20.172.in-addr.arpa"
|
|
||||||
forward-host: "dns.serv.zentralwerk.org"
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "76.20.172.in-addr.arpa"
|
|
||||||
forward-host: "dns.serv.zentralwerk.org"
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "77.20.172.in-addr.arpa"
|
|
||||||
forward-host: "dns.serv.zentralwerk.org"
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "dn42"
|
|
||||||
forward-addr: 172.23.0.53
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "20.172.in-addr.arpa"
|
|
||||||
forward-addr: 172.23.0.53
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "21.172.in-addr.arpa"
|
|
||||||
forward-addr: 172.23.0.53
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "22.172.in-addr.arpa"
|
|
||||||
forward-addr: 172.23.0.53
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "23.172.in-addr.arpa"
|
|
||||||
forward-addr: 172.23.0.53
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "d.f.ip6.arpa"
|
|
||||||
forward-addr: 172.23.0.53
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "ffdd"
|
|
||||||
forward-addr: 10.200.0.4
|
|
||||||
forward-addr: 10.200.0.16
|
|
||||||
|
|
||||||
forward-zone:
|
|
||||||
name: "200.10.in-addr.arpa"
|
|
||||||
forward-addr: 10.200.0.4
|
|
||||||
forward-addr: 10.200.0.16
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
services.collectd = {
|
|
||||||
enable = true;
|
|
||||||
autoLoadPlugin = true;
|
|
||||||
plugins = {
|
|
||||||
cpu = "";
|
|
||||||
memory = "";
|
|
||||||
interface = "";
|
|
||||||
load = "";
|
|
||||||
exec = let
|
|
||||||
unboundScript = builtins.toFile "unbound.rb" ''
|
|
||||||
loop do
|
|
||||||
`/run/current-system/sw/bin/unbound-control -c /var/lib/unbound/unbound.conf stats_noreset`
|
|
||||||
.lines
|
|
||||||
.filter { |l| l =~ /^total\./ }
|
|
||||||
.each { |l|
|
|
||||||
if l =~ /total\.(.+?)=([\d\.]+)/
|
|
||||||
name = $1
|
|
||||||
value = $2.to_f
|
|
||||||
if name =~ /\.avg$/ || name =~ /\.median$/ || name =~ /\.max$/ || name =~ /\.min$/
|
|
||||||
ty = "gauge"
|
|
||||||
else
|
|
||||||
ty = "derive"
|
|
||||||
value = value.to_i
|
|
||||||
end
|
|
||||||
puts "PUTVAL dnscache/unbound/#{ty}-#{name} N:#{value}"
|
|
||||||
end
|
|
||||||
}
|
|
||||||
|
|
||||||
sleep 10
|
|
||||||
end
|
|
||||||
'';
|
|
||||||
in ''
|
|
||||||
Exec "collectd" "${pkgs.ruby}/bin/ruby" "${unboundScript}"
|
|
||||||
'';
|
|
||||||
network = ''
|
|
||||||
Server "grafana.serv.zentralwerk.dn42" "25826"
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
extraConfig = ''
|
|
||||||
Interval 10
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
}
|
|
Loading…
Reference in New Issue