diff options
| -rw-r--r-- | nixos/services/router/dns-dhcp.nix | 57 |
1 files changed, 39 insertions, 18 deletions
diff --git a/nixos/services/router/dns-dhcp.nix b/nixos/services/router/dns-dhcp.nix index 1839b0f..e27e6a1 100644 --- a/nixos/services/router/dns-dhcp.nix +++ b/nixos/services/router/dns-dhcp.nix @@ -40,6 +40,7 @@ in { }; }; dhcp = { + enable = lib.mkEnableOption "enable dnsmasq dns server" // { default = true; }; defaultGateway = lib.mkOption { type = lib.types.str; default = "192.168.1.1"; @@ -85,10 +86,30 @@ in { description = "dhcp static leases"; }; }; - localDomain = lib.mkOption { - type = lib.types.str; - default = "home.lan"; - description = ""; + localResolution = { + localDomain = lib.mkOption { + type = lib.types.nullOr lib.types.str; + #default = if cfg.dhcp.enable then "home.lan" else null; + default = "home.lan"; + description = "domain name for local dns queries, resolved by local dns service"; + }; + localDnsAddress = lib.mkOption { + type = lib.types.nullOr lib.types.str; + #default = if cfg.localResolution.localDomain != null then "127.0.0.1@5353" else null; + default = "127.0.0.1@5353"; + description = "dns server used to resolve queries to the local network e.g. dhcp attached devices"; + }; + localReverseZone = lib.mkOption { + type = lib.types.nullOr lib.types.str; + #default = if cfg.localResolution.localDomain != null then "1.168.192.in-addr.arpa" else null; + default = "1.168.192.in-addr.arpa"; + description = "dns zone to resolve local ptr (reverse dns) requests. e.g. 192.168.1.0/24 -> 1.168.192"; + }; + localReverseDnsAddress = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = cfg.localResolution.localDnsAddress; + description = "dns server used to resolve local ptr (reverse dns) queries"; + }; }; #ipv6 = lib.mkEnableOption "enable ipv6"; # TODO }; @@ -122,7 +143,7 @@ in { # Enable DNSSEC validation (signed DNS, prevents man-in-the-middle attacks) # `auto-trust-anchor-file` is set by default to "/var/unbound/root.key" trust-anchor-file = ''""''; - domain-insecure = cfg.localDomain; # Local domain is not DNSSEC-signed + domain-insecure = cfg.localResolution.localDomain; # Local domain is not DNSSEC-signed harden-below-nxdomain = true; # Protect against non-existent domain response attacks harden-glue = true; # Protect against incorrect DNS glue record attacks harden-dnssec-stripped = true; # Ensures that DNSSEC signatures are not stripped from DNS responses @@ -147,15 +168,15 @@ in { # Forward unknown to public resolver via DoT forward-zone = [ # Local DNS: forward to dnsmasq - { - name = ''"${cfg.localDomain}."''; # TODO mk config - forward-addr = "127.0.0.1@5353"; # TODO mk config - } + (lib.mkIf (cfg.localResolution.localDomain != null && cfg.localResolution.localDnsAddress != null) { + name = ''"${cfg.localResolution.localDomain}."''; # TODO mk config + forward-addr = cfg.localResolution.localDnsAddress; # TODO mk config + }) # Local reverse DNS: forward reverse lookups (PTR records) - { - name = ''"1.168.192.in-addr.arpa"''; # NOTE: 192.168.1.0 -> 1.168.192 - forward-addr = "127.0.0.1@5353"; - } + (lib.mkIf (cfg.localResolution.localReverseZone != null && cfg.localResolution.localReverseDnsAddress != null) { + name = ''"${cfg.localResolution.localReverseZone}"''; + forward-addr = cfg.localResolution.localReverseDnsAddress; + }) # Upstream DNS { name = ''"."''; @@ -172,7 +193,7 @@ in { # Configure dnsmasq for dhcp and local hostname resolution services.dnsmasq = { - enable = true; + enable = cfg.dhcp.enable; settings = let mkDNSHostOverride = host: ip: "${host},${ip}"; dnsHostOverrides = lib.mapAttrsToList (host: ip: mkDNSHostOverride host ip) cfg.dns.hostOverrides; @@ -185,8 +206,8 @@ in { no-resolv = true; # Do not read /etc/resolv.conf, resolve only the LAN no-poll = true; # Do not poll /etc/resolv.conf for changes # TODO config local domain - local = "/${cfg.localDomain}/"; # Use local-only for the defined domain (prevents upstream leaks) - domain = cfg.localDomain; # Define the local domain name + local = "/${cfg.localResolution.localDomain}/"; # Use local-only for the defined domain (prevents upstream leaks) + domain = cfg.localResolution.localDomain; # Define the local domain name expand-hosts = true; # Create both fully-qualified and short-name entries from DHCP hostnames # DNS Server @@ -205,7 +226,7 @@ in { (mkDHCPOption "router" defaultGateway) # Set default gateway for clients #(mkDHCPOption "ntp-server" defaultGateway) # Set ntp server for clients (mkDHCPOption "dns-server" localhostIp) # Set dns server for clients - (mkDHCPOption "domain-search" cfg.localDomain) # Add search rule to clients so they can resolve hostnames w/o the local domain suffix + (mkDHCPOption "domain-search" cfg.localResolution.localDomain) # Add search rule to clients so they can resolve hostnames w/o the local domain suffix ]; #dhcp-no-override = true; # don't use kernel DHCP helpers that bypass macvlan @@ -221,7 +242,7 @@ in { # Search localDomain so host can resolve short names # This is eq. to dnsmasq's dhcp-option "domain-search" for clients, it just adds a search rule to resolv.conf - networking.search = [ cfg.localDomain ]; + networking.search = [ cfg.localResolution.localDomain ]; # Add localhost as default nameserver networking.nameservers = lib.mkDefault [ cfg.dhcp.localhostIp ]; |