Skip to content

Commit d3f4be6

Browse files
anthr76anthr76
authored
feat(ddns): bind kea ddns for nwk3 (#42)
* feat: ddns wip Signed-off-by: Anthony Rabbito <[email protected]> * fix: remove avahi Signed-off-by: Anthony Rabbito <[email protected]> * push wip Signed-off-by: Anthony Rabbito <[email protected]> * push wip Signed-off-by: Anthony Rabbito <[email protected]> * push wip Signed-off-by: Anthony Rabbito <[email protected]> * push wip Signed-off-by: Anthony Rabbito <[email protected]> --------- Signed-off-by: Anthony Rabbito <[email protected]>
1 parent c721f77 commit d3f4be6

File tree

5 files changed

+283
-36
lines changed

5 files changed

+283
-36
lines changed

Diff for: ‎nixos/hosts/fw1-nwk3/default.nix

+219-21
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
1-
{ lib, inputs, pkgs, ... }:
1+
{
2+
lib,
3+
inputs,
4+
pkgs,
5+
config,
6+
...
7+
}:
28
let
39
zoneSerial = toString inputs.self.lastModified;
410
in
@@ -34,11 +40,56 @@ in
3440
'';
3541

3642
networking.interfaces = {
37-
vlan8 = { ipv4 = { addresses = [{ address = "192.168.17.1"; prefixLength = 24; }]; }; };
38-
vlan10 = { ipv4 = { addresses = [{ address = "192.168.16.1"; prefixLength = 24; }]; }; };
39-
vlan99 = { ipv4 = { addresses = [{ address = "10.40.99.1"; prefixLength = 24; }]; }; };
40-
vlan100 = { ipv4 = { addresses = [{ address = "192.168.14.1"; prefixLength = 24; }]; }; };
41-
vlan101 = { ipv4 = { addresses = [{ address = "192.168.13.1"; prefixLength = 24; }]; }; };
43+
vlan8 = {
44+
ipv4 = {
45+
addresses = [
46+
{
47+
address = "192.168.17.1";
48+
prefixLength = 24;
49+
}
50+
];
51+
};
52+
};
53+
vlan10 = {
54+
ipv4 = {
55+
addresses = [
56+
{
57+
address = "192.168.16.1";
58+
prefixLength = 24;
59+
}
60+
];
61+
};
62+
};
63+
vlan99 = {
64+
ipv4 = {
65+
addresses = [
66+
{
67+
address = "10.40.99.1";
68+
prefixLength = 24;
69+
}
70+
];
71+
};
72+
};
73+
vlan100 = {
74+
ipv4 = {
75+
addresses = [
76+
{
77+
address = "192.168.14.1";
78+
prefixLength = 24;
79+
}
80+
];
81+
};
82+
};
83+
vlan101 = {
84+
ipv4 = {
85+
addresses = [
86+
{
87+
address = "192.168.13.1";
88+
prefixLength = 24;
89+
}
90+
];
91+
};
92+
};
4293
};
4394
services.tailscale.extraUpFlags = [
4495
"--advertise-routes=192.168.14.0/24,10.40.99.0/24,192.168.13.0/24"
@@ -59,6 +110,10 @@ in
59110
name = "domain-name-servers";
60111
data = "10.40.99.1";
61112
}
113+
{
114+
name = "domain-search";
115+
data = "nwk3.rabbito.tech,mole-bowfin.ts.net";
116+
}
62117
];
63118
subnet4 = [
64119
{
@@ -162,21 +217,164 @@ in
162217
zones = {
163218
"nwk3.rabbito.tech." = {
164219
master = true;
165-
file = pkgs.writeText "nwk3.rabbito.tech" (lib.strings.concatStrings [
166-
''
167-
$ORIGIN nwk3.rabbito.tech.
168-
$TTL 86400
169-
@ IN SOA nwk3.rabbito.tech. admin.rabbito.tech (
170-
${zoneSerial} ; serial number
171-
3600 ; refresh
172-
900 ; retry
173-
1209600 ; expire
174-
1800 ; ttl
175-
)
176-
IN NS fw1.nwk3.rabbito.tech.
177-
fw1 IN A 10.40.99.1
178-
''
179-
]);
220+
extraConfig = ''
221+
allow-update { key "dhcp-update-key"; };
222+
journal "${config.services.bind.directory}/db.nwk3.rabbito.tech.jnl";
223+
'';
224+
file = pkgs.writeText "nwk3.rabbito.tech" (
225+
lib.strings.concatStrings [
226+
''
227+
$ORIGIN nwk3.rabbito.tech.
228+
$TTL 86400
229+
@ IN SOA nwk3.rabbito.tech. admin.rabbito.tech (
230+
${zoneSerial} ; serial number
231+
3600 ; refresh
232+
900 ; retry
233+
1209600 ; expire
234+
1800 ; ttl
235+
)
236+
IN NS fw1.nwk3.rabbito.tech.
237+
fw1 IN A 10.40.99.1
238+
''
239+
]
240+
);
241+
};
242+
"14.168.192.in-addr.arpa." = {
243+
master = true;
244+
extraConfig = ''
245+
allow-update { key "dhcp-update-key"; };
246+
journal "${config.services.bind.directory}/db.14.168.192.in-addr.arpa.jnl";
247+
'';
248+
file = pkgs.writeText "14.168.192.in-addr.arpa" (
249+
lib.strings.concatStrings [
250+
''
251+
$ORIGIN 14.168.192.in-addr.arpa.
252+
$TTL 86400
253+
@ IN SOA nwk3.rabbito.tech. admin.rabbito.tech (
254+
${zoneSerial} ; serial number
255+
3600 ; refresh
256+
900 ; retry
257+
1209600 ; expire
258+
1800 ; ttl
259+
)
260+
IN NS fw1.nwk3.rabbito.tech.
261+
''
262+
]
263+
);
264+
};
265+
"13.168.192.in-addr.arpa." = {
266+
master = true;
267+
extraConfig = ''
268+
allow-update { key "dhcp-update-key"; };
269+
journal "${config.services.bind.directory}/db.13.168.192.in-addr.arpa.jnl";
270+
'';
271+
file = pkgs.writeText "13.168.192.in-addr.arpa" (
272+
lib.strings.concatStrings [
273+
''
274+
$ORIGIN 13.168.192.in-addr.arpa.
275+
$TTL 86400
276+
@ IN SOA nwk3.rabbito.tech. admin.rabbito.tech (
277+
${zoneSerial} ; serial number
278+
3600 ; refresh
279+
900 ; retry
280+
1209600 ; expire
281+
1800 ; ttl
282+
)
283+
IN NS fw1.nwk3.rabbito.tech.
284+
''
285+
]
286+
);
287+
};
288+
"16.168.192.in-addr.arpa." = {
289+
master = true;
290+
extraConfig = ''
291+
allow-update { key "dhcp-update-key"; };
292+
journal "${config.services.bind.directory}/db.16.168.192.in-addr.arpa.jnl";
293+
'';
294+
file = pkgs.writeText "16.168.192.in-addr.arpa" (
295+
lib.strings.concatStrings [
296+
''
297+
$ORIGIN 16.168.192.in-addr.arpa.
298+
$TTL 86400
299+
@ IN SOA nwk3.rabbito.tech. admin.rabbito.tech (
300+
${zoneSerial} ; serial number
301+
3600 ; refresh
302+
900 ; retry
303+
1209600 ; expire
304+
1800 ; ttl
305+
)
306+
IN NS fw1.nwk3.rabbito.tech.
307+
''
308+
]
309+
);
310+
};
311+
"99.40.10.in-addr.arpa." = {
312+
master = true;
313+
extraConfig = ''
314+
allow-update { key "dhcp-update-key"; };
315+
journal "${config.services.bind.directory}/db.99.40.10.in-addr.arpa.jnl";
316+
'';
317+
file = pkgs.writeText "99.40.10.in-addr.arpa" (
318+
lib.strings.concatStrings [
319+
''
320+
$ORIGIN 99.40.10.in-addr.arpa.
321+
$TTL 86400
322+
@ IN SOA nwk3.rabbito.tech. admin.rabbito.tech (
323+
${zoneSerial} ; serial number
324+
3600 ; refresh
325+
900 ; retry
326+
1209600 ; expire
327+
1800 ; ttl
328+
)
329+
IN NS fw1.nwk3.rabbito.tech.
330+
1 IN PTR fw1.nwk3.rabbito.tech.
331+
''
332+
]
333+
);
334+
};
335+
};
336+
};
337+
services.kea.dhcp-ddns = {
338+
settings = {
339+
reverse-ddns = {
340+
ddns-domains = [
341+
{
342+
name = "14.168.192.in-addr.arpa.";
343+
key-name = "dhcp-update-key";
344+
dns-servers = [{
345+
hostname = "";
346+
ip-address = "10.40.99.1";
347+
port = 53;
348+
}];
349+
}
350+
{
351+
name = "13.168.192.in-addr.arpa.";
352+
key-name = "dhcp-update-key";
353+
dns-servers = [{
354+
hostname = "";
355+
ip-address = "10.40.99.1";
356+
port = 53;
357+
}];
358+
}
359+
{
360+
name = "16.168.192.in-addr.arpa.";
361+
key-name = "dhcp-update-key";
362+
dns-servers = [{
363+
hostname = "";
364+
ip-address = "10.40.99.1";
365+
port = 53;
366+
}];
367+
}
368+
{
369+
name = "99.40.10.in-addr.arpa";
370+
key-name = "dhcp-update-key";
371+
dns-servers = [{
372+
hostname = "";
373+
ip-address = "10.40.99.1";
374+
port = 53;
375+
}];
376+
}
377+
];
180378
};
181379
};
182380
};

Diff for: ‎nixos/personalities/server/router/ddns.nix

+46-1
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,55 @@
1-
{ config, ... }:
1+
{ config, lib, ... }:
2+
let
3+
firstBindAddress = lib.head config.services.bind.listenOn;
4+
in
25
{
36
sops.secrets.cfApiToken = {
47
sopsFile = ../../../../secrets/users.yaml;
58
};
9+
sops.secrets."bind-ddns-tsig-file" = {
10+
sopsFile = ../../../../secrets/users.yaml;
11+
owner = config.systemd.services.bind.serviceConfig.User;
12+
group = config.systemd.services.bind.serviceConfig.User;
13+
};
14+
sops.secrets."ddns-tsig-key" = {
15+
# TODO: poor secret name
16+
sopsFile = ../../../../secrets/users.yaml;
17+
owner = config.systemd.services.kea-dhcp-ddns-server.serviceConfig.User;
18+
group = config.systemd.services.kea-dhcp-ddns-server.serviceConfig.User;
19+
};
620
services.cfdyndns = {
721
enable = true;
822
apiTokenFile = config.sops.secrets.cfApiToken.path;
923
};
24+
25+
services.bind.extraConfig = ''
26+
include "${config.sops.secrets."bind-ddns-tsig-file".path}";
27+
'';
28+
29+
services.kea.dhcp-ddns = {
30+
enable = true;
31+
settings = {
32+
tsig-keys = [
33+
{
34+
name = "dhcp-update-key";
35+
algorithm = "hmac-sha256";
36+
secret-file = "${config.sops.secrets."ddns-tsig-key".path}";
37+
}
38+
];
39+
forward-ddns = {
40+
ddns-domains = [
41+
{
42+
name = "${config.networking.domain}.";
43+
key-name = "dhcp-update-key";
44+
dns-servers = [{
45+
hostname = "";
46+
ip-address = "${firstBindAddress}";
47+
port = 53;
48+
}];
49+
}
50+
];
51+
};
52+
};
53+
};
54+
1055
}

Diff for: ‎nixos/personalities/server/router/default.nix

-11
Original file line numberDiff line numberDiff line change
@@ -62,17 +62,6 @@
6262
vlan100 = { id=100; interface="lan"; };
6363
vlan101 = { id=101; interface="lan"; };
6464
};
65-
services.avahi = {
66-
enable = true;
67-
hostName = "${config.networking.hostName}";
68-
allowInterfaces = [ "vlan100" "vlan101" ];
69-
publish = {
70-
enable = true;
71-
addresses = true;
72-
domain = true;
73-
userServices = true;
74-
};
75-
};
7665
services.udpbroadcastrelay = {
7766
enable = true;
7867
package = pkgs.udpbroadcastrelay;

Diff for: ‎nixos/personalities/server/router/dhcp.nix

+13
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,20 @@
1+
{config, ...}:
12
{
3+
4+
sops.secrets.ddns-tsig-key = {
5+
# TODO: poor secret name
6+
sopsFile = ../../../../secrets/users.yaml;
7+
};
8+
29
services.kea.dhcp4 = {
310
enable = true;
411
settings = {
12+
dhcp-ddns.enable-updates = true;
13+
ddns-replace-client-name = "when-not-present";
14+
ddns-update-on-renew = true;
15+
ddns-override-client-update = true;
16+
ddns-override-no-update = true;
17+
ddns-qualifying-suffix = "${config.networking.domain}";
518
lease-database = {
619
name = "/var/lib/kea/dhcp4.leases";
720
persist = true;

Diff for: ‎secrets/users.yaml

+5-3
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ chromium-client-secret: ENC[AES256_GCM,data:CrQUBfe8lZHdYkCbi7NfBUqqTK2BBe518Oej
55
tailscale-auth-key: ENC[AES256_GCM,data:bZlL8FYKJMOfj1RWHZFIgNkGY5G4qwBohZKf9aavYOelrIDjWb6kot3eLhGR6S3cJt+/pzFv75143AKrUNc=,iv:I3BAY57o8Bl7BIqRXzEmjDvNg1j6EPKS6KlDn0WXDLU=,tag:EP3KB3QOgqAVO8XXQ5Twog==,type:str]
66
nixbuild-ssh-key: ENC[AES256_GCM,data:CJoF+QvIYYBF82iRwqfFsvyTaGZf4zgZYpnppA9jYij6lGWee3LGA0lDp05oG6h3QY5Yrp8XB8lx4WUzALWHjYn9cY+762PxfRO8SwQYx1oJvfP8zZv02WgzctbyxHNNP3bn4yC1YyWDyvWTCU9uQgL+kWOjNpfSBqGJ7rGAuF+XypgmgFMbly4sl8Z3SbICFNVWQOCloemHS/kN2hNu+KlaWgoAPbgAWmLnYb9qndkQKiwapxfi0J4KyU/ryqXW98a+ig89e8u+mJmA8Q9p6XwkEYZ9DAqHg95dqPgjJYgrlmpy4dJ8UHpdFACD8cWQEu11n2O9dIy5pw/YpF89n2toFgDX1Kn/4FMXVaBg/uzJfF9IaOLLOEnqMTXrin+2DWmFDnS+/9w0ybcDPGhIL3+d9xSN8cWgYIB4dr2AVBajbwF3PezczWTg+UIC6fyT1QQAXkusL07pcntOy0g+fMkCXBYLTu84QPmXpRXJVdBDF2v3TF9gtpfc1tpOW0LWc+U0x0m5WALNUAJJ1MXk,iv:UmwIuZIvndyzPQvsm/3M+EwA3gyfyLxZfFcKK6tkkVg=,tag:hIDXKv3E+7SPDBPwSmyV4Q==,type:str]
77
cfApiToken: ENC[AES256_GCM,data:H58ODWo3uRm/V4MuNRXV/LxGq6eSX/Og+k95wyV3cLLy9GCVPJP/AA==,iv:z71Fyl6XjcOwl0mwu/sycYm6g3ZZ8HijeeILWXUwUII=,tag:BIXwlUfI7CywLga4+zF87g==,type:str]
8+
ddns-tsig-key: ENC[AES256_GCM,data:QstpuXoJUplS4BxvRmGIbGBk0+uiLtbyE5XV3CcCcJd6xz7CCIOpsb/YR7w=,iv:2eEL8mD49o9+Qd0VPGAkkudBZOv5YV9h5vuHnugJ8BY=,tag:nurtUr3nfPOmwAExybJsNQ==,type:str]
9+
bind-ddns-tsig-file: ENC[AES256_GCM,data:VoZh19vnpVxad/PBJdIv8axpZfZZA/txPNESwwRk23YrJ2aSJ+I19LbLPPniEryFSUchyaDocgeLy0vTC/FElc2IQQoj4oEX8sUeskL6Mi57WsZYLAQfIVEr1R0vyja6f+XOUSwmI/suU3AHDhmkSu0=,iv:cUKG+55PQiaGYm3056ri5OsG10YFJMWyC9+rPg6e7DM=,tag:J2PNelxamFMaUTbfN4dWcw==,type:str]
810
sops:
911
kms: []
1012
gcp_kms: []
@@ -92,8 +94,8 @@ sops:
9294
aXVheUlzK3prQWR5bytPcmlWSC9qOFEKmLiEcU0rCyi7HnBlgG/WZESnqC8erjKa
9395
jNXj+pFjHW8bq6DlC8lclufntBiu7GYyX73SAE3Tpa9vMTyooGlv0g==
9496
-----END AGE ENCRYPTED FILE-----
95-
lastmodified: "2024-05-01T20:34:19Z"
96-
mac: ENC[AES256_GCM,data:wYCBK7exvPP6bEa84InCly3FZDYuvtzzA16kYhMs6cmbKgNPfsaIDyiRmabAcB2y4S69wW7E220PSpTollvJEy7y9ZuQuSED6VskobPg7eXxaEXKpcgzIPOD2L+W6EL7bYogi6x0YpBJuvu+ONSUJuCuOT9PwCCXiOIFy/ZTw4I=,iv:mNCUnjJnVXLrjfLu48eH0FiKQveK2OdYln+uCcY308c=,tag:dEMGpAxXtAVRpdRMEqLMZA==,type:str]
97+
lastmodified: "2025-01-13T01:37:56Z"
98+
mac: ENC[AES256_GCM,data:8oW84vt/OyouzxAut+LD40tzfinoyXBMELsXuzDiQOPPXsj/GHf4kgAI0lFgjswGM6z8IWE1yvgpMryW59qTulbWnjfC753PQnmBvD2YGB1ASGq3OulursIGGtksWeUC3KDKcg4iAWeqXI6u7tTc+4hi5MTi7nPmQbjn1UrxZso=,iv:+r1IgqsV5402DU/ZmHTxgsS3wc0quSMfgyXGM/hScZE=,tag:nPE9vfoB94KJQcVQh+TeWQ==,type:str]
9799
pgp: []
98100
unencrypted_suffix: _unencrypted
99-
version: 3.8.1
101+
version: 3.9.2

0 commit comments

Comments
 (0)