Das Netzwerk in der Riesaer Str. 32
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
network/nix/lib/dns.nix

232 lines
7.0 KiB

{ pkgs, config }:
let
lib = pkgs.lib;
in
rec {
ns = "dns.serv.zentralwerk.org";
internalNS = [ ns ];
# public servers (slaves)
publicNS = [ "ns.c3d2.de" "ns.spaceboyz.net" ];
dynamicReverseZones = [
"73.20.172.in-addr.arpa"
"74.20.172.in-addr.arpa"
"75.20.172.in-addr.arpa"
"76.20.172.in-addr.arpa"
"77.20.172.in-addr.arpa"
"78.20.172.in-addr.arpa"
"79.20.172.in-addr.arpa"
"99.22.172.in-addr.arpa"
];
localZones =
let
# ip6.arpa aggregation size in CIDR bits
reverseZone6Size = 56;
hosts4Records = hosts4:
builtins.attrValues (
builtins.mapAttrs (name: addr: {
inherit name;
type = "A";
data = addr;
}) hosts4
);
hosts6Records = hosts6:
builtins.attrValues (
builtins.mapAttrs (name: addr: {
inherit name;
type = "AAAA";
data = addr;
}) hosts6
);
# generate zones only for nets with hosts
namedNets = lib.filterAttrs (name: { hosts4, hosts6, dynamicDomain, ... }:
(hosts4 != [] && hosts6 != []) ||
dynamicDomain
) config.site.net;
# converts an IPv4 address to its reverse DNS form
ipv4ToReverse = ipv4:
builtins.concatStringsSep "." (
lib.reverseList (
builtins.filter builtins.isString (
builtins.split "\\." ipv4
)
)
) + ".in-addr.arpa";
# `{ "1,0.0.127.in-addr.arpa" = "lo.core.zentralwerk.dn42"; }`
reverseHosts4 = builtins.foldl' (result: { hosts4, domainName, ... }:
builtins.foldl' (result: host: result // {
"${ipv4ToReverse hosts4.${host}}" = "${host}.${domainName}";
}) result (builtins.attrNames hosts4)
) {} (builtins.attrValues namedNets);
# `[ "0.0.127.in-addr.arpa" ]`
reverseZones4 = lib.unique (
builtins.attrNames (
builtins.foldl' (result: rname:
let
zone = builtins.head (
builtins.match "[[:digit:]]+\\.(.+)" rname
);
in result // {
"${zone}" = true;
}
) {} (builtins.attrNames reverseHosts4)
) ++ dynamicReverseZones
);
# turns `::` into `0000:0000:0000:0000:0000:0000:0000:0000`
expandIpv6 = ipv6:
if lib.hasPrefix "::" ipv6
then expandIpv6 "0${ipv6}"
else if lib.hasSuffix "::" ipv6
then expandIpv6 "${ipv6}0"
else let
words = builtins.filter builtins.isString (
builtins.split ":" ipv6
);
fillWordCount = 8 - builtins.length words;
fillWords = n:
if n >= 0
then [ "0000" ] ++ fillWords (n - 1)
else [];
words' = builtins.concatMap (word:
if word == ""
then fillWords fillWordCount
else [ word ]
) words;
leftPad = padding: target: s:
if builtins.stringLength s < target
then leftPad padding target "${padding}${s}"
else s;
words'' = map (leftPad "0" 4) words';
in
builtins.concatStringsSep ":" words'';
# turns `::1` into `1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa`
ipv6ToReverse = ipv6:
builtins.concatStringsSep "." (
lib.reverseList (
lib.stringToCharacters (
builtins.replaceStrings [":"] [""] (expandIpv6 ipv6)
)
)
) + ".ip6.arpa";
# `{ dn42 = { "...ip6.arpa" = "lo.core.zentralwerk.dn42"; }; }`
reverseHosts6 = builtins.foldl' (result: net: lib.recursiveUpdate result (
builtins.mapAttrs (ctx: hosts:
builtins.foldl' (result: host:
let
domain =
if ctx == "dn42"
then namedNets.${net}.domainName
else if builtins.match "up.*" ctx != null
then "${net}.zentralwerk.org"
else throw "Invalid IPv6 context: ${ctx}";
in
lib.recursiveUpdate result {
"${ipv6ToReverse hosts.${host}}" = "${host}.${domain}";
}
) {} (builtins.attrNames hosts)
) namedNets.${net}.hosts6
)) {} (builtins.attrNames namedNets);
# `{ dn42 = [ "....ip6.arpa" ]; }`
reverseZones6 = builtins.mapAttrs (ctx: reverseHosts6ctx:
builtins.attrNames (
builtins.foldl' (result: rname: result // {
"${builtins.substring ((128 - reverseZone6Size) / 2) (72 - ((128 - reverseZone6Size) / 2)) rname}" = true;
}) {} (builtins.attrNames reverseHosts6ctx)
)
) reverseHosts6;
in [ {
name = "zentralwerk.org";
ns = publicNS;
records = [];
} {
name = "zentralwerk.dn42";
ns = internalNS;
records = [ {
name = "ipa";
type = "A";
data = config.site.net.serv.hosts4.ipa;
} ];
} {
name = "dyn.zentralwerk.org";
ns = publicNS;
records = [ {
name = "upstream1";
type = "A";
data = "24.134.104.53";
} {
name = "upstream2";
type = "A";
data = "24.134.252.105";
} ];
} ] ++ builtins.concatLists (
builtins.attrValues (
builtins.mapAttrs (net: { dynamicDomain, hosts4, hosts6, extraRecords, ... }: [
{
name = "${net}.zentralwerk.dn42";
ns = internalNS;
records =
lib.optionals (hosts6 ? dn42) (hosts6Records hosts6.dn42) ++
extraRecords;
}
{
name = "${net}.zentralwerk.org";
ns = publicNS;
records =
hosts4Records hosts4 ++
lib.optionals (hosts6 ? up4) (hosts6Records hosts6.up4) ++
extraRecords;
dynamic = dynamicDomain;
}
]) namedNets
)
) ++ map (zone: {
name = zone;
ns = internalNS;
records =
map (reverse: {
name = builtins.head (
builtins.match "([[:digit:]]+)\\..*" reverse
);
type = "PTR";
data = "${reverseHosts4.${reverse}}.";
}) (
builtins.filter (lib.hasSuffix ".${zone}")
(builtins.attrNames reverseHosts4)
);
dynamic = builtins.elem zone dynamicReverseZones;
}) reverseZones4
++ builtins.concatMap (ctx:
map (zone: {
name = zone;
ns =
if ctx == "dn42"
then internalNS
else if builtins.match "up.*" ctx != null
then publicNS
else throw "Invalid IPv6 context: ${ctx}";
records =
map (reverse: {
name = builtins.substring 0 ((128 - reverseZone6Size) / 2 - 1) reverse;
type = "PTR";
data = "${reverseHosts6.${ctx}.${reverse}}.";
}) (
builtins.filter (lib.hasSuffix ".${zone}")
(builtins.attrNames reverseHosts6.${ctx})
);
}) reverseZones6.${ctx}
) (builtins.attrNames reverseZones6);
}