dnscache: init
This commit is contained in:
parent
638bbf38a9
commit
b5f680be04
|
@ -0,0 +1,184 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ <nixpkgs/nixos/modules/profiles/minimal.nix>
|
||||
];
|
||||
nix.useSandbox = false;
|
||||
nix.maxJobs = lib.mkDefault 4;
|
||||
|
||||
boot.isContainer = true;
|
||||
# /sbin/init
|
||||
boot.loader.initScript.enable = true;
|
||||
boot.loader.grub.enable = false;
|
||||
#boot.supportedFilesystems = ["zfs" "ext2" "ext3" "vfat" "fat32" "bcache" "bcachefs"];
|
||||
|
||||
fileSystems."/" = { fsType = "rootfs"; device = "rootfs"; };
|
||||
|
||||
networking.hostName = "dnscache"; # Define your hostname.
|
||||
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
networking.useNetworkd = true;
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.eth0.useDHCP = true;
|
||||
services.resolved.enable = false;
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Berlin";
|
||||
# Select internationalisation properties.
|
||||
i18n = {
|
||||
defaultLocale = "en_US.UTF-8";
|
||||
supportedLocales = lib.mkForce [ "en_US.UTF-8/UTF-8" ];
|
||||
};
|
||||
|
||||
# List packages installed in system profile. To search, run:
|
||||
# $ nix search wget
|
||||
environment.systemPackages = with pkgs; [
|
||||
wget vim
|
||||
traceroute tcpdump bind
|
||||
];
|
||||
|
||||
# Create a few files early before packing tarball for Proxmox
|
||||
# architecture/OS detection.
|
||||
system.extraSystemBuilderCmds =
|
||||
''
|
||||
mkdir -m 0755 -p $out/bin
|
||||
ln -s ${pkgs.bash}/bin/bash $out/bin/sh
|
||||
mkdir -m 0755 -p $out/sbin
|
||||
ln -s ../init $out/sbin/init
|
||||
'';
|
||||
|
||||
# This value determines the NixOS release with which your system is to be
|
||||
# compatible, in order to avoid breaking some software such as database
|
||||
# servers. You should change this only after NixOS release notes say you
|
||||
# should.
|
||||
system.stateVersion = "19.09"; # Did you read the comment?
|
||||
|
||||
networking.firewall.allowedUDPPorts = [ 53 ];
|
||||
networking.firewall.allowedTCPPorts = [ 22 53 ];
|
||||
# For NixOps:
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
permitRootLogin = "yes";
|
||||
};
|
||||
services.unbound = {
|
||||
enable = true;
|
||||
interfaces = [ "0.0.0.0" "::0" ];
|
||||
allowedAccess = [
|
||||
"fd23:42:c3d2:500::/56"
|
||||
"2a02:8106:208:5200::/56"
|
||||
"2a02:8106:211:e900::/56"
|
||||
"::172.20.72.0/117"
|
||||
"::172.22.99.0/120"
|
||||
"::1/128"
|
||||
"172.20.72.0/21"
|
||||
"10.0.0.0/24"
|
||||
"172.22.99.0/24"
|
||||
"127.0.0.0/8"
|
||||
];
|
||||
forwardAddresses = [
|
||||
# Quad9
|
||||
"9.9.9.9@853" #dns.quad9.net
|
||||
"2620:fe::fe@853" #dns.quad9.net
|
||||
"149.112.112.112@853" #dns.quad9.net
|
||||
"2620:fe::9@853" #dns.quad9.net
|
||||
# Cloudflare DNS
|
||||
"1.1.1.1@853" #cloudflare-dns.com
|
||||
"2606:4700:4700::1111@853" #cloudflare-dns.com
|
||||
"1.0.0.1@853" #cloudflare-dns.com
|
||||
"2606:4700:4700::1001@853" #cloudflare-dns.com
|
||||
];
|
||||
extraConfig = ''
|
||||
server:
|
||||
ssl-upstream: yes
|
||||
domain-insecure: "dn42"
|
||||
domain-insecure: "20.172.in-addr.arpa"
|
||||
domain-insecure: "21.172.in-addr.arpa"
|
||||
domain-insecure: "22.172.in-addr.arpa"
|
||||
domain-insecure: "23.172.in-addr.arpa"
|
||||
domain-insecure: "d.f.ip6.arpa"
|
||||
local-zone: "20.172.in-addr.arpa." nodefault
|
||||
local-zone: "21.172.in-addr.arpa." nodefault
|
||||
local-zone: "22.172.in-addr.arpa." nodefault
|
||||
local-zone: "23.172.in-addr.arpa." nodefault
|
||||
local-zone: "d.f.ip6.arpa." nodefault
|
||||
|
||||
remote-control:
|
||||
control-enable: yes
|
||||
server-key-file: /var/lib/unbound/unbound_server.key
|
||||
server-cert-file: /var/lib/unbound/unbound_server.pem
|
||||
control-key-file: /var/lib/unbound/unbound_control.key
|
||||
control-cert-file: /var/lib/unbound/unbound_control.pem
|
||||
|
||||
|
||||
forward-zone:
|
||||
name: "dn42"
|
||||
forward-addr: fd42:d42:d42:53::1
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "20.172.in-addr.arpa"
|
||||
forward-addr: fd42:d42:d42:53::1
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "21.172.in-addr.arpa"
|
||||
forward-addr: fd42:d42:d42:53::1
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "22.172.in-addr.arpa"
|
||||
forward-addr: fd42:d42:d42:53::1
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "23.172.in-addr.arpa"
|
||||
forward-addr: fd42:d42:d42:53::1
|
||||
forward-addr: 172.23.0.53
|
||||
|
||||
forward-zone:
|
||||
name: "d.f.ip6.arpa"
|
||||
forward-addr: fd42:d42:d42:53::1
|
||||
forward-addr: 172.23.0.53
|
||||
'';
|
||||
};
|
||||
|
||||
services.collectd = {
|
||||
enable = true;
|
||||
autoLoadPlugin = true;
|
||||
buildMinimalPackage = true;
|
||||
plugins = {
|
||||
cpu = "";
|
||||
memory = "";
|
||||
interface = "";
|
||||
load = "";
|
||||
exec =
|
||||
let
|
||||
unboundScript = builtins.toFile "unbound.rb" ''
|
||||
loop do
|
||||
`/run/current-system/sw/bin/unbound-control -c /var/lib/unbound/unbound.conf stats_noreset`
|
||||
.lines
|
||||
.filter { |l| l =~ /^total\./ }
|
||||
.each { |l|
|
||||
if l =~ /total\.(.+?)=([\d\.]+)/
|
||||
name = $1
|
||||
value = $2.to_f
|
||||
ty = (name =~ /\.avg$/ || name =~ /\.median$/ || name =~ /\.max$/ || name =~ /\.min$/) ? "gauge" : "derive"
|
||||
puts "PUTVAL dnscache/unbound/#{ty}-#{name} N:#{value}"
|
||||
end
|
||||
}
|
||||
|
||||
sleep 10
|
||||
end
|
||||
'';
|
||||
in ''
|
||||
Exec "collectd" "${pkgs.ruby}/bin/ruby" "${unboundScript}"
|
||||
'';
|
||||
network = ''
|
||||
Server "grafana.hq.c3d2.de" "25826"
|
||||
'';
|
||||
};
|
||||
extraConfig = ''
|
||||
Interval 10
|
||||
'';
|
||||
};
|
||||
}
|
13
hq.nixops
13
hq.nixops
|
@ -151,4 +151,17 @@
|
|||
};
|
||||
};
|
||||
|
||||
"dnscache" = {
|
||||
deployment.nix_path = {
|
||||
nixpkgs = "https://nixos.org/channels/nixos-unstable/nixexprs.tar.xz";
|
||||
};
|
||||
imports = [
|
||||
hosts/containers/dnscache/configuration.nix
|
||||
];
|
||||
deployment = {
|
||||
targetHost = "dnscache.serv.zentralwerk.org";
|
||||
storeKeysOnMachine = true;
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue