update dns-dhcp module to explicitly distinguish between local domain (dnsmasq) overrides and proper dns overrides with unbound. fixed dns overrides and imported them for poweredge and poweredge-pro. cleaned up router-hosts.nix on poweredgeHEADmaster

5 files changed, 124 insertions, 99 deletions

diff --git a/hosts/poweredge-pro/dhcp-hosts.nix b/hosts/poweredge-pro/dhcp-hosts.nix
new file mode 100644
index 0000000..643ae10
--- /dev/null
+++ b/hosts/poweredge-pro/dhcp-hosts.nix
@@ -0,0 +1,26 @@
+let
+	localResolution.localDomain = "pls.lan";
+	dhcp = {
+		inherit staticLeases;
+		defaultGateway = "192.168.77.1";
+		localhostIp    = "192.168.77.2";
+		rangeStart     = "192.168.77.50";
+		rangeEnd       = "192.168.77.250";
+	};
+	staticLeases = {
+		devel             = { macAddress = "00:a0:98:79:81:5a"; staticIp = "192.168.77.3";   };
+		mailcow           = { macAddress = "00:a0:98:79:20:a2"; staticIp = "192.168.77.7";   };
+		tjkeller          = { macAddress = "00:a0:98:62:cf:86"; staticIp = "192.168.77.8";   };
+		filebrowser       = { macAddress = "02:00:00:00:77:12"; staticIp = "192.168.77.12";  };
+		WIN-BGBGC27B1PF   = { macAddress = "d8:9e:f3:1c:f0:1c"; staticIp = "192.168.77.30";  };  # DACS
+		DESKTOP-CQ4UIF9   = { macAddress = "08:bf:b8:3f:bd:48"; staticIp = "192.168.77.31";  };  # Kyle
+		WIN-6FVMAFOID4G   = { macAddress = "00:a0:98:58:10:85"; staticIp = "192.168.77.33";  };  # QB
+		office-precision  = { macAddress = "48:4d:7e:f8:96:47"; staticIp = "192.168.77.34";  };
+		XRX9C934E85D0A3   = { macAddress = "9c:93:4e:85:d0:a3"; staticIp = "192.168.77.40";  };  # Xerox
+		nvr               = { macAddress = "98:8b:0a:cf:4f:5e"; staticIp = "192.168.77.176"; };
+	};
+in {
+	services._router.dnsDhcpConfig = {
+		inherit localResolution dhcp;
+	};
+}
diff --git a/hosts/poweredge-pro/dns-overrides.nix b/hosts/poweredge-pro/dns-overrides.nix
index 3bcdb90..0ed161c 100644
--- a/hosts/poweredge-pro/dns-overrides.nix
+++ b/hosts/poweredge-pro/dns-overrides.nix
@@ -1,32 +1,12 @@
 let
-	localResolution.localDomain = "pls.lan";
-	dhcp = {
-		inherit staticLeases;
-		defaultGateway = "192.168.77.1";
-		localhostIp    = "192.168.77.2";
-		rangeStart     = "192.168.77.50";
-		rangeEnd       = "192.168.77.250";
-	};
-	staticLeases = {
-		devel             = { macAddress = "00:a0:98:79:81:5a"; staticIp = "192.168.77.3";   };
-		mailcow           = { macAddress = "00:a0:98:79:20:a2"; staticIp = "192.168.77.7";   };
-		tjkeller          = { macAddress = "00:a0:98:62:cf:86"; staticIp = "192.168.77.8";   };
-		filebrowser       = { macAddress = "02:00:00:00:77:12"; staticIp = "192.168.77.12";  };
-		WIN-BGBGC27B1PF   = { macAddress = "d8:9e:f3:1c:f0:1c"; staticIp = "192.168.77.30";  };  # DACS
-		DESKTOP-CQ4UIF9   = { macAddress = "08:bf:b8:3f:bd:48"; staticIp = "192.168.77.31";  };  # Kyle
-		WIN-6FVMAFOID4G   = { macAddress = "00:a0:98:58:10:85"; staticIp = "192.168.77.33";  };  # QB
-		office-precision  = { macAddress = "48:4d:7e:f8:96:47"; staticIp = "192.168.77.34";  };
-		XRX9C934E85D0A3   = { macAddress = "9c:93:4e:85:d0:a3"; staticIp = "192.168.77.40";  };  # Xerox
-		nvr               = { macAddress = "98:8b:0a:cf:4f:5e"; staticIp = "192.168.77.176"; };
-	};
-	dns.hostOverrides = {
-		"docs.chexx.net"    = "192.168.77.3";
-		"files.chexx.net"   = "192.168.77.12";
-		"vault.chexx.net"   = "192.168.77.3";
-		"wg-easy.chexx.net" = "192.168.77.3";
+	dns.overrides.records = {
+		"docs.chexx.net"     = { recordType = "A"; value = "192.168.77.3";  };
+		"files.chexx.net"    = { recordType = "A"; value = "192.168.77.12"; };
+		"vault.chexx.net"    = { recordType = "A"; value = "192.168.77.3";  };
+		"wg-easy.chexx.net"  = { recordType = "A"; value = "192.168.77.3";  };
 	};
 in {
 	services._router.dnsDhcpConfig = {
-		inherit localResolution dhcp dns;
+		inherit dns;
 	};
 }
diff --git a/hosts/poweredge-pro/dns.nix b/hosts/poweredge-pro/dns.nix
index fb22afb..511f9e2 100644
--- a/hosts/poweredge-pro/dns.nix
+++ b/hosts/poweredge-pro/dns.nix
@@ -14,6 +14,7 @@
 			imports = [
 				../../nixos/services/router
 				#./router-hosts.nix  # Contains dhcp config + static leases + overrides
+				./dhcp-hosts.nix
 				./dns-overrides.nix
 			];
 
diff --git a/hosts/poweredge/router-hosts.nix b/hosts/poweredge/router-hosts.nix
index 2a08558..b53b2a1 100644
--- a/hosts/poweredge/router-hosts.nix
+++ b/hosts/poweredge/router-hosts.nix
@@ -9,76 +9,38 @@ let
 	};
 	staticLeases = {
 		# Network
-		idrac-7N94GK2 = {
-			macAddress = "50:9a:4c:5d:c3:7c";
-			staticIp = "192.168.1.2";
-		};
-		OpenWrt-Attic = {
-			macAddress = "34:98:b5:60:5e:be";
-			staticIp = "192.168.1.3";
-		};
-		OpenWrt-Basement = {
-			macAddress = "8c:3b:ad:35:c7:8c";
-			staticIp = "192.168.1.4";
-		};
-		ArcherC54 = {
-			macAddress = "12:eb:b6:13:f9:e2";
-			staticIp = "192.168.1.5";
-		};
+		idrac-7N94GK2     = { macAddress = "50:9a:4c:5d:c3:7c"; staticIp = "192.168.1.2";   };
+		OpenWrt-Attic     = { macAddress = "34:98:b5:60:5e:be"; staticIp = "192.168.1.3";   };
+		OpenWrt-Basement  = { macAddress = "8c:3b:ad:35:c7:8c"; staticIp = "192.168.1.4";   };
+		ArcherC54         = { macAddress = "14:eb:b6:13:f9:e0"; staticIp = "192.168.1.5";   };
 		# Desktops
-		T495 = {
-			macAddress = "04:33:c2:9d:34:74";
-			staticIp = "192.168.1.11";
-		};
-		optiplex = {
-			macAddress = "e4:54:e8:bc:ba:05";
-			staticIp = "192.168.1.12";
-		};
-		X230 = {
-			macAddress = "84:3a:4b:60:34:c4";
-			staticIp = "192.168.1.13";
-		};
+		T495              = { macAddress = "04:33:c2:9d:34:74"; staticIp = "192.168.1.11";  };
+		optiplex          = { macAddress = "e4:54:e8:bc:ba:05"; staticIp = "192.168.1.12";  };
+		X230              = { macAddress = "84:3a:4b:60:34:c4"; staticIp = "192.168.1.13";  };
+		# Appliances
+		# TODO add epson printer
+		p1s               = { macAddress = "3c:0f:02:d5:23:64"; staticIp = "192.168.1.39";  };
+		gnuslashprinter   = { macAddress = "00:23:24:5b:f0:6d"; staticIp = "192.168.1.40";  };
 		# Services
-		gnuslashprinter = {
-			macAddress = "00:23:24:5b:f0:6d";
-			staticIp = "192.168.1.40";
-		};
-		immich = {
-			macAddress = "02:00:00:00:00:01";
-			staticIp = "192.168.1.41";
-		};
-		jellyfin = {
-			macAddress = "02:00:00:00:00:02";
-			staticIp = "192.168.1.42";
-		};
-		gitea = {
-			macAddress = "02:00:00:00:00:03";
-			staticIp = "192.168.1.43";
-		};
-		bitcoind = {
-			macAddress = "02:00:00:00:00:04";
-			staticIp = "192.168.1.44";
-		};
-		filebrowser = {
-			macAddress = "02:00:00:00:00:05";
-			staticIp = "192.168.1.45";
-		};
-		grafana = {
-			macAddress = "02:00:00:00:00:06";
-			staticIp = "192.168.1.46";
-		};
-		transmission = {
-			macAddress = "02:00:00:00:00:07";
-			staticIp = "192.168.1.47";
-		};
+		immich            = { macAddress = "02:00:00:00:00:01"; staticIp = "192.168.1.41";  };
+		jellyfin          = { macAddress = "02:00:00:00:00:02"; staticIp = "192.168.1.42";  };
+		gitea             = { macAddress = "02:00:00:00:00:03"; staticIp = "192.168.1.43";  };
+		bitcoind          = { macAddress = "02:00:00:00:00:04"; staticIp = "192.168.1.44";  };
+		filebrowser       = { macAddress = "02:00:00:00:00:05"; staticIp = "192.168.1.45";  };
+		grafana           = { macAddress = "02:00:00:00:00:06"; staticIp = "192.168.1.46";  };
+		transmission      = { macAddress = "02:00:00:00:00:07"; staticIp = "192.168.1.47";  };
 	};
-	dns.hostOverrides = {
-		"router.${localDomain}"     = "192.168.1.1";
+	localDomainOverrides = {
+		"router.${localDomain}"     = "192.168.1.1";  # FIXME ping router on separate host returns 127.0.0.2
 		"poweredge.${localDomain}"  = "192.168.1.10";
 	};
 in {
+	imports = [ ../poweredge-pro/dns-overrides.nix ];
 	services._router.dnsDhcpConfig = {
-		inherit localDomain dhcp dns;
+		inherit dhcp;
+		localResolution = {
+			inherit localDomain localDomainOverrides;
+		};
 	};
 	networking.hosts."192.168.1.1" = [ "router.${localDomain}" "router" ];
 }
diff --git a/nixos/services/router/dns-dhcp.nix b/nixos/services/router/dns-dhcp.nix
index e27e6a1..edc9895 100644
--- a/nixos/services/router/dns-dhcp.nix
+++ b/nixos/services/router/dns-dhcp.nix
@@ -28,15 +28,41 @@ in {
 		enable = lib.mkEnableOption "enable pre-configured unbound(outbound) + dnsmasq(local) dns(+dhcp) server";
 		#enableUnbound = lib.mkEnableOption "enable unbound as outbound dns server";
 		dns = {
-			hostOverrides = lib.mkOption {
-				type = lib.types.attrsOf lib.types.str;
-				default = {};
-				example = {
-					"poweredge.home.lan" = "192.168.1.10";
-					"router.home.lan" = "192.168.1.1";
-					"example.com" = "192.168.1.100";
+			overrides = {
+				zones = lib.mkOption {
+					type = lib.types.attrsOf (lib.types.enum [ "transparent" "typetransparent" "static" "redirect" ]);
+					default = {};
+					description = "local zones and how names without local data are handled";
+				};
+				records = lib.mkOption {
+					type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
+						options = {
+							name = lib.mkOption {
+								type = lib.types.str;
+								default = name;
+								description = "record name. defaults to the attribute key";
+							};
+							recordType = lib.mkOption {
+								type = lib.types.enum [ "A" "AAAA" "CNAME" "TXT" "MX" "SRV" "CAA" "NS" "PTR" ];
+							};
+							value = lib.mkOption {
+								type = lib.types.str;
+							};
+						};
+					}));
+					default = {};
+					example = ''{
+						"files.example.com" = { recordType = "A"; value = "192.168.1.20"; };
+						"git.example.com"   = { recordType = "CNAME"; value = "files.example.com"; };
+						# Same name, second record: use a different key and set name explicitly
+						"files.example.com-v6" = {
+							name = "files.example.com";
+							recordType = "AAAA";
+							value = "fd00::20";
+						};
+					}'';
+					description = "dns override records";
 				};
-				description = "dns overrides for specific hosts";
 			};
 		};
 		dhcp = {
@@ -110,6 +136,16 @@ in {
 				default = cfg.localResolution.localDnsAddress;
 				description = "dns server used to resolve local ptr (reverse dns) queries";
 			};
+			localDomainOverrides = lib.mkOption {
+				type = lib.types.attrsOf lib.types.str;
+				default = {};
+				example = {
+					"poweredge.home.lan" = "192.168.1.10";
+					"router.home.lan" = "192.168.1.1";
+					"example.com" = "192.168.1.100";
+				};
+				description = "dns overrides for specific hosts on the local domain";
+			};
 		};
 		#ipv6 = lib.mkEnableOption "enable ipv6";  # TODO
 	};
@@ -120,7 +156,23 @@ in {
 		services.unbound = {
 			enable = true;
 			settings = {
-				server = {
+				server = let
+					fqdn = n: if lib.hasSuffix "." n then n else "${n}.";
+
+					# Apply fqdn to the last field of a multi-field value (MX, SRV)
+					fqdnLast = v: let
+						parts = lib.splitString " " v;
+					in lib.concatStringsSep " " (lib.init parts ++ [ (fqdn (lib.last parts)) ]);
+
+					formatValue = r: {
+						CNAME = fqdn r.value;
+						NS    = fqdn r.value;
+						PTR   = fqdn r.value;
+						MX    = fqdnLast r.value;
+						SRV   = fqdnLast r.value;
+						TXT   = ''"${r.value}"'';
+					}.${r.recordType} or r.value;
+				in {
 					# Listen on all interfaces (or specify specific IPs)
 					interface = [ "0.0.0.0" ];  # ++ lib.optionals cfg.ipv6 [ "::0" ];
 
@@ -159,6 +211,10 @@ in {
 					use-caps-for-id = false;  # Disables using uppercase characters in the DNS transaction ID, for compatibility
 					edns-buffer-size = 1232;  # Sets the EDNS (Extension mechanisms for DNS) buffer size to 1232 bytes, which is the default for many DNS resolvers
 
+					# Overrides
+					local-zone = lib.mapAttrsToList (zone: type: ''"${fqdn zone}" ${type}'') cfg.dns.overrides.zones;
+					local-data = map (r: "'${fqdn r.name} IN ${r.recordType} ${formatValue r}'") (lib.attrValues cfg.dns.overrides.records);
+
 					# Logging
 					#verbosity = 3;
 					#log-queries = true;
@@ -196,7 +252,7 @@ in {
 			enable = cfg.dhcp.enable;
 			settings = let
 				mkDNSHostOverride = host: ip: "${host},${ip}";
-				dnsHostOverrides = lib.mapAttrsToList (host: ip: mkDNSHostOverride host ip) cfg.dns.hostOverrides;
+				dnsHostOverrides = lib.mapAttrsToList (host: ip: mkDNSHostOverride host ip) cfg.localResolution.localDomainOverrides;
 				mkDHCPRange = ipRangeStart: ipRangeEnd: subnetMask: leaseTime: "${ipRangeStart},${ipRangeEnd},${subnetMask},${leaseTime}";
 				mkDHCPOption = option: value: "option:${option},${value}";
 				mkDHCPStaticLease = macAddress: hostname: staticIp: "${macAddress},${hostname},${staticIp},infinite";