repomaa/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

setup octodns for automatic dns records

Browse Source
This commit is contained in:
Joakim Repomaa
2025-02-15 03:22:20 +02:00
parent 459cae639d
commit c15d518e4a
14 changed files with 351 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
hosts/freun-dev/configuration.nix
View File

@@ -3,7 +3,10 @@
# and in the NixOS manual (accessible by running `nixos-help`).
{ config, pkgs, ssh, ... }:
let
ipv4Address = "65.21.145.150";
ipv6Address = "2a01:4f9:c011:9ac1::1";
in
{
nix = {
settings = {
@@ -25,13 +28,24 @@
networking.useDHCP = false;
networking.nftables.enable = true;
services.octodns.records."" = {
A = {
ttl = 86400;
values = [ ipv4Address ];
};
AAAA = {
ttl = 86400;
values = [ ipv6Address ];
};
};
systemd.network = {
enable = true;
networks.static = {
name = "enp1s0";
address = [
"65.21.145.150/32"
"2a01:4f9:c011:9ac1::1/64"
"${ipv4Address}/32"
"${ipv6Address}/64"
];
routes = [
{ Gateway = "fe80::1"; }

1
hosts/freun-dev/secrets.nix
View File

@@ -11,6 +11,7 @@
"vaultwarden"
"donetick"
"dnote"
"octodns"
]
) // {
smtp-password = {

11
hosts/freun-dev/services.nix
View File

@@ -12,7 +12,6 @@ let
secrets = config.age.secrets;
in
{
services.postgresql.package = pkgs.postgresql_16;
virtualisation.podman.enable = true;
virtualisation.oci-containers.backend = "podman";
@@ -33,6 +32,16 @@ in
};
services = {
postgresql.package = pkgs.postgresql_16;
octodns = {
enable = true;
records."".MX = {
ttl = 86400;
values = [{ exchange = "${smtp.host}."; }];
};
defaults.CNAME.ttl = 60;
};
hastebin = {
enable = true;
subdomain = "bin";

1
modules/services/default.nix
View File

@@ -17,5 +17,6 @@
./readeck.nix
./donetick.nix
./dnote.nix
./octodns.nix
];
}

8
modules/services/grafana.nix
View File

@@ -31,7 +31,8 @@ in
};
};
services.prometheus = {
services = {
prometheus = {
enable = true;
exporters.node.enable = true;
scrapeConfigs = [
@@ -44,9 +45,9 @@ in
];
};
services.webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.settings.server.http_port;
webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.settings.server.http_port;
services.postgresql = {
postgresql = {
enable = lib.mkDefault true;
ensureDatabases = [ "grafana" ];
ensureUsers = [{
@@ -55,4 +56,5 @@ in
}];
};
};
};
}

8
modules/services/invidious.nix
View File

@@ -11,7 +11,8 @@ in
};
config = lib.mkIf cfg.enable {
services.invidious = {
services = {
invidious = {
domain = fqdn;
address = "127.0.0.1";
@@ -24,11 +25,12 @@ in
};
};
services.postgresql.enable = lib.mkDefault true;
postgresql.enable = lib.mkDefault true;
services.webserver = {
webserver = {
enable = lib.mkDefault true;
vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
};
};
};
}

210
modules/services/octodns.nix Normal file
View File

@@ -0,0 +1,210 @@
{ pkgs, lib, config, ... }:
let
cfg = config.services.octodns;
secrets = config.age.secrets;
types = {
ttlOptions = default: {
ttl = lib.mkOption {
type = lib.types.int;
default = default;
};
};
defaults = lib.types.submodule {
options = {
A = lib.mkOption {
type = lib.types.submodule {
options = types.ttlOptions cfg.defaults.ttl;
};
default = { };
};
AAAA = lib.mkOption {
type = lib.types.submodule {
options = types.ttlOptions cfg.defaults.ttl;
};
default = { };
};
CNAME = lib.mkOption {
type = lib.types.submodule {
options = types.ttlOptions cfg.defaults.ttl;
};
default = { };
};
MX = lib.mkOption {
type = lib.types.submodule {
options = types.ttlOptions cfg.defaults.ttl;
};
default = { };
};
} // (types.ttlOptions 3600);
};
aRecord = lib.types.submodule {
options = {
values = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
};
ttl = lib.mkOption {
type = lib.types.int;
default = cfg.defaults.A.ttl;
};
};
};
aaaaRecord = lib.types.submodule {
options = {
values = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
};
ttl = lib.mkOption {
type = lib.types.int;
default = cfg.defaults.AAAA.ttl;
};
};
};
cnameRecord = lib.types.submodule {
options = {
target = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
};
toRoot = lib.mkOption {
type = lib.types.bool;
default = false;
};
ttl = lib.mkOption {
type = lib.types.int;
default = cfg.defaults.CNAME.ttl;
};
};
};
mxValue = lib.types.submodule {
options = {
exchange = lib.mkOption {
type = lib.types.str;
};
preference = lib.mkOption {
type = lib.types.int;
default = 10;
};
};
};
mxRecord = lib.types.submodule {
options = {
values = lib.mkOption {
type = lib.types.listOf types.mxValue;
default = [ ];
};
ttl = lib.mkOption {
type = lib.types.int;
default = cfg.defaults.MX.ttl;
};
};
};
records = lib.types.submodule {
options = {
A = lib.mkOption {
type = types.aRecord;
default = { };
};
AAAA = lib.mkOption {
type = types.aaaaRecord;
default = { };
};
CNAME = lib.mkOption {
type = types.cnameRecord;
default = { };
};
MX = lib.mkOption {
type = types.mxRecord;
default = { };
};
};
};
};
yamlFormat = pkgs.formats.yaml { };
zoneFile = yamlFormat.generate "octodns-zone"
(
lib.filterAttrs (_: records: (lib.length records) > 0)
(lib.mapAttrs
(_: types:
lib.filter
({ values ? [ ], value ? null, ... }: (lib.length values) > 0 || !(builtins.isNull value))
(lib.mapAttrsToList
(type: { ttl, ... }@options:
if (type == "CNAME")
then
let
inherit (options) target toRoot;
value = if toRoot then "${config.networking.domain}." else target;
in
{ inherit type ttl value; }
else
{ inherit type ttl; inherit (options) values; }
)
types
)
)
cfg.records
)
);
zonesDir = pkgs.linkFarm "octodns-zones" {
"${config.networking.domain}.yaml" = zoneFile;
};
configFile = yamlFormat.generate "octodns-config.yaml" {
providers = {
config = {
class = "octodns.provider.yaml.YamlProvider";
directory = zonesDir;
default_ttl = cfg.defaults.ttl;
};
hetzner = {
class = "octodns_hetzner.HetznerProvider";
token = "env/HETZNER_TOKEN";
};
};
zones."*" = {
sources = [ "config" ];
targets = [ "hetzner" ];
};
};
octodns = pkgs.octodns.withProviders (_: [
pkgs.octodns-providers.hetzner
]);
in
{
options.services.octodns = {
enable = lib.mkEnableOption "Enable octodns";
records = lib.mkOption {
type = lib.types.attrsOf types.records;
default = { };
};
defaults = lib.mkOption {
type = types.defaults;
default = { };
};
};
config = lib.mkIf cfg.enable {
systemd.services.octodns = {
enable = true;
description = "OctoDNS";
serviceConfig = {
Type = "oneshot";
ExecStart = "${octodns}/bin/octodns-sync --config-file ${configFile} --doit";
DynamicUser = true;
EnvironmentFile = secrets.octodns.path;
RemainAfterExit = true;
};
wantedBy = lib.optionals config.services.nginx.enable [ "nginx.service" ];
before = lib.optionals config.services.nginx.enable [ "nginx.service" ];
};
};
}

6
modules/services/owncast.nix
View File

@@ -11,10 +11,12 @@ in
};
config = lib.mkIf cfg.enable {
services.owncast = {
services = {
owncast = {
openFirewall = true;
};
services.webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
};
};
}

6
modules/services/syncthing.nix
View File

@@ -15,15 +15,17 @@ in
};
config = lib.mkIf cfg.enable {
services.syncthing = {
services = {
syncthing = {
openDefaultPorts = true;
guiAddress = "[::1]:${toString cfg.port}";
settings.gui.insecureSkipHostCheck = true;
};
services.webserver = {
webserver = {
enable = lib.mkDefault true;
vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
};
};
};
}

13
modules/services/webserver.nix
View File

@@ -46,7 +46,8 @@ in
};
config = lib.mkIf cfg.enable {
services.nginx = {
services = {
nginx = {
enable = lib.mkDefault true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
@@ -78,6 +79,16 @@ in
cfg.vHosts;
};
octodns.records = lib.filterAttrs (name: _: name != config.networking.domain) (
lib.mapAttrs'
(fqdn: _: {
name = lib.removeSuffix ".${config.networking.domain}" fqdn;
value = { CNAME.toRoot = true; };
})
cfg.vHosts
);
};
security.acme = {
acceptTerms = true;
defaults = {

4
modules/services/workout-sync.nix
View File

@@ -46,7 +46,8 @@ in
confinement.enable = true;
};
services.webserver = {
services = {
webserver = {
enable = lib.mkDefault true;
vHosts.${fqdn}.locations."/" = {
proxyPort = port;
@@ -59,4 +60,5 @@ in
};
};
};
};
}

6
modules/services/workout-tracker.nix
View File

@@ -13,11 +13,13 @@ in
};
config = lib.mkIf cfg.enable {
services.workout-tracker = { inherit package; };
services = {
workout-tracker = { inherit package; };
services.webserver = {
webserver = {
enable = lib.mkDefault true;
vHosts.${fqdn}.locations."/".proxyPort = port;
};
};
};
}

BIN
secrets/octodns.age Normal file
View File

Binary file not shown.

1
secrets/secrets.nix
View File

@@ -19,4 +19,5 @@ in
"readeck.age".publicKeys = users ++ [ freun-dev ];
"donetick.age".publicKeys = users ++ [ freun-dev ];
"dnote.age".publicKeys = users ++ [ freun-dev ];
"octodns.age".publicKeys = users ++ [ freun-dev ];
}