setup octodns for automatic dns records

hosts/freun-dev/configuration.nix

@@ -3,7 +3,10 @@
 # and in the NixOS manual (accessible by running `nixos-help`).
 
 { config, pkgs, ssh, ... }:
-
+let
+  ipv4Address = "65.21.145.150";
+  ipv6Address = "2a01:4f9:c011:9ac1::1";
+in
 {
   nix = {
     settings = {
@@ -25,13 +28,24 @@
   networking.useDHCP = false;
   networking.nftables.enable = true;
 
+  services.octodns.records."" = {
+    A = {
+      ttl = 86400;
+      values = [ ipv4Address ];
+    };
+    AAAA = {
+      ttl = 86400;
+      values = [ ipv6Address ];
+    };
+  };
+
   systemd.network = {
     enable = true;
     networks.static = {
       name = "enp1s0";
       address = [
-        "65.21.145.150/32"
+        "${ipv4Address}/32"
-        "2a01:4f9:c011:9ac1::1/64"
+        "${ipv6Address}/64"
       ];
       routes = [
         { Gateway = "fe80::1"; }

hosts/freun-dev/secrets.nix

@@ -11,6 +11,7 @@
         "vaultwarden"
         "donetick"
         "dnote"
+        "octodns"
       ]
     ) // {
     smtp-password = {

hosts/freun-dev/services.nix

@@ -12,7 +12,6 @@ let
   secrets = config.age.secrets;
 in
 {
-  services.postgresql.package = pkgs.postgresql_16;
   virtualisation.podman.enable = true;
   virtualisation.oci-containers.backend = "podman";
 
@@ -33,6 +32,16 @@ in
   };
 
   services = {
+    postgresql.package = pkgs.postgresql_16;
+    octodns = {
+      enable = true;
+      records."".MX = {
+        ttl = 86400;
+        values = [{ exchange = "${smtp.host}."; }];
+      };
+      defaults.CNAME.ttl = 60;
+    };
+
     hastebin = {
       enable = true;
       subdomain = "bin";

modules/services/default.nix

@@ -17,5 +17,6 @@
     ./readeck.nix
     ./donetick.nix
     ./dnote.nix
+    ./octodns.nix
   ];
 }

modules/services/grafana.nix

@@ -31,7 +31,8 @@ in
       };
     };
 
-    services.prometheus = {
+    services = {
+      prometheus = {
         enable = true;
         exporters.node.enable = true;
         scrapeConfigs = [
@@ -44,9 +45,9 @@ in
         ];
       };
 
-    services.webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.settings.server.http_port;
+      webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.settings.server.http_port;
 
-    services.postgresql = {
+      postgresql = {
         enable = lib.mkDefault true;
         ensureDatabases = [ "grafana" ];
         ensureUsers = [{
@@ -55,4 +56,5 @@ in
         }];
       };
     };
+  };
 }

modules/services/invidious.nix

@@ -11,7 +11,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    services.invidious = {
+    services = {
+      invidious = {
         domain = fqdn;
         address = "127.0.0.1";
 
@@ -24,11 +25,12 @@ in
         };
       };
 
-    services.postgresql.enable = lib.mkDefault true;
+      postgresql.enable = lib.mkDefault true;
 
-    services.webserver = {
+      webserver = {
         enable = lib.mkDefault true;
         vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
       };
     };
+  };
 }

modules/services/octodns.nix

@@ -0,0 +1,210 @@
+{ pkgs, lib, config, ... }:
+let
+  cfg = config.services.octodns;
+  secrets = config.age.secrets;
+
+  types = {
+    ttlOptions = default: {
+      ttl = lib.mkOption {
+        type = lib.types.int;
+        default = default;
+      };
+    };
+    defaults = lib.types.submodule {
+      options = {
+        A = lib.mkOption {
+          type = lib.types.submodule {
+            options = types.ttlOptions cfg.defaults.ttl;
+          };
+          default = { };
+        };
+        AAAA = lib.mkOption {
+          type = lib.types.submodule {
+            options = types.ttlOptions cfg.defaults.ttl;
+          };
+          default = { };
+        };
+        CNAME = lib.mkOption {
+          type = lib.types.submodule {
+            options = types.ttlOptions cfg.defaults.ttl;
+          };
+          default = { };
+        };
+        MX = lib.mkOption {
+          type = lib.types.submodule {
+            options = types.ttlOptions cfg.defaults.ttl;
+          };
+          default = { };
+        };
+      } // (types.ttlOptions 3600);
+    };
+    aRecord = lib.types.submodule {
+      options = {
+        values = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        ttl = lib.mkOption {
+          type = lib.types.int;
+          default = cfg.defaults.A.ttl;
+        };
+      };
+    };
+    aaaaRecord = lib.types.submodule {
+      options = {
+        values = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        ttl = lib.mkOption {
+          type = lib.types.int;
+          default = cfg.defaults.AAAA.ttl;
+        };
+      };
+    };
+    cnameRecord = lib.types.submodule {
+      options = {
+        target = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+        toRoot = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+        ttl = lib.mkOption {
+          type = lib.types.int;
+          default = cfg.defaults.CNAME.ttl;
+        };
+      };
+    };
+    mxValue = lib.types.submodule {
+      options = {
+        exchange = lib.mkOption {
+          type = lib.types.str;
+        };
+        preference = lib.mkOption {
+          type = lib.types.int;
+          default = 10;
+        };
+      };
+    };
+    mxRecord = lib.types.submodule {
+      options = {
+        values = lib.mkOption {
+          type = lib.types.listOf types.mxValue;
+          default = [ ];
+        };
+        ttl = lib.mkOption {
+          type = lib.types.int;
+          default = cfg.defaults.MX.ttl;
+        };
+      };
+    };
+    records = lib.types.submodule {
+      options = {
+        A = lib.mkOption {
+          type = types.aRecord;
+          default = { };
+        };
+        AAAA = lib.mkOption {
+          type = types.aaaaRecord;
+          default = { };
+        };
+        CNAME = lib.mkOption {
+          type = types.cnameRecord;
+          default = { };
+        };
+        MX = lib.mkOption {
+          type = types.mxRecord;
+          default = { };
+        };
+      };
+    };
+  };
+
+  yamlFormat = pkgs.formats.yaml { };
+
+  zoneFile = yamlFormat.generate "octodns-zone"
+    (
+      lib.filterAttrs (_: records: (lib.length records) > 0)
+        (lib.mapAttrs
+          (_: types:
+            lib.filter
+              ({ values ? [ ], value ? null, ... }: (lib.length values) > 0 || !(builtins.isNull value))
+              (lib.mapAttrsToList
+                (type: { ttl, ... }@options:
+                  if (type == "CNAME")
+                  then
+                    let
+                      inherit (options) target toRoot;
+                      value = if toRoot then "${config.networking.domain}." else target;
+                    in
+                    { inherit type ttl value; }
+                  else
+                    { inherit type ttl; inherit (options) values; }
+                )
+                types
+              )
+          )
+          cfg.records
+        )
+    );
+
+  zonesDir = pkgs.linkFarm "octodns-zones" {
+    "${config.networking.domain}.yaml" = zoneFile;
+  };
+
+
+  configFile = yamlFormat.generate "octodns-config.yaml" {
+    providers = {
+      config = {
+        class = "octodns.provider.yaml.YamlProvider";
+        directory = zonesDir;
+        default_ttl = cfg.defaults.ttl;
+      };
+      hetzner = {
+        class = "octodns_hetzner.HetznerProvider";
+        token = "env/HETZNER_TOKEN";
+      };
+    };
+
+    zones."*" = {
+      sources = [ "config" ];
+      targets = [ "hetzner" ];
+    };
+  };
+
+  octodns = pkgs.octodns.withProviders (_: [
+    pkgs.octodns-providers.hetzner
+  ]);
+in
+{
+  options.services.octodns = {
+    enable = lib.mkEnableOption "Enable octodns";
+    records = lib.mkOption {
+      type = lib.types.attrsOf types.records;
+      default = { };
+    };
+    defaults = lib.mkOption {
+      type = types.defaults;
+      default = { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.octodns = {
+      enable = true;
+      description = "OctoDNS";
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${octodns}/bin/octodns-sync --config-file ${configFile} --doit";
+        DynamicUser = true;
+        EnvironmentFile = secrets.octodns.path;
+        RemainAfterExit = true;
+      };
+      wantedBy = lib.optionals config.services.nginx.enable [ "nginx.service" ];
+      before = lib.optionals config.services.nginx.enable [ "nginx.service" ];
+    };
+  };
+}

modules/services/owncast.nix

@@ -11,10 +11,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    services.owncast = {
+    services = {
+      owncast = {
         openFirewall = true;
       };
 
-    services.webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
+      webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
+    };
   };
 }

modules/services/syncthing.nix

@@ -15,15 +15,17 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    services.syncthing = {
+    services = {
+      syncthing = {
         openDefaultPorts = true;
         guiAddress = "[::1]:${toString cfg.port}";
         settings.gui.insecureSkipHostCheck = true;
       };
 
-    services.webserver = {
+      webserver = {
         enable = lib.mkDefault true;
         vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
       };
     };
+  };
 }

modules/services/webserver.nix

@@ -46,7 +46,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    services.nginx = {
+    services = {
+      nginx = {
         enable = lib.mkDefault true;
         recommendedProxySettings = true;
         recommendedTlsSettings = true;
@@ -78,6 +79,16 @@ in
           cfg.vHosts;
       };
 
+      octodns.records = lib.filterAttrs (name: _: name != config.networking.domain) (
+        lib.mapAttrs'
+          (fqdn: _: {
+            name = lib.removeSuffix ".${config.networking.domain}" fqdn;
+            value = { CNAME.toRoot = true; };
+          })
+          cfg.vHosts
+      );
+    };
+
     security.acme = {
       acceptTerms = true;
       defaults = {

modules/services/workout-sync.nix

@@ -46,7 +46,8 @@ in
       confinement.enable = true;
     };
 
-    services.webserver = {
+    services = {
+      webserver = {
         enable = lib.mkDefault true;
         vHosts.${fqdn}.locations."/" = {
           proxyPort = port;
@@ -59,4 +60,5 @@ in
         };
       };
     };
+  };
 }

modules/services/workout-tracker.nix

@@ -13,11 +13,13 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    services.workout-tracker = { inherit package; };
+    services = {
+      workout-tracker = { inherit package; };
 
-    services.webserver = {
+      webserver = {
         enable = lib.mkDefault true;
         vHosts.${fqdn}.locations."/".proxyPort = port;
       };
     };
+  };
 }

secrets/secrets.nix

@@ -19,4 +19,5 @@ in
   "readeck.age".publicKeys = users ++ [ freun-dev ];
   "donetick.age".publicKeys = users ++ [ freun-dev ];
   "dnote.age".publicKeys = users ++ [ freun-dev ];
+  "octodns.age".publicKeys = users ++ [ freun-dev ];
 }