gaming

nix/modules/dns/default.nix

@@ -1,9 +1,9 @@
-{ pkgs, lib, networkingConfig, config, ... }:
+{ pkgs, lib, networkingConfig, config, name, ... }:
 let metricsPort = 9433; in
 {
-  age.secrets.knot_dns_rfc2136_key_config = {
+  age.secrets.knot_dns_acme_dns_01_key_config = {
     file =
-      ../../secrets/knot_dns_rfc2136_key_config.age;
+      ../../secrets/knot_dns_acme_dns_01_key_config.age;
     owner = "knot";
   };
 
@@ -27,42 +27,57 @@ let metricsPort = 9433; in
 
   services.knot = {
     enable = true;
-    keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ];
-    settingsFile = pkgs.writeTextFile {
-      name = "knot.conf";
-      text = ''
-        server:
-            listen: 0.0.0.0@53
-            listen: ::@53
-        
-        key:
-          - id: rfc2136-update
-            algorithm: hmac-sha256
-            secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds=
-        
-        acl:
-          - id: update_acl
-            address: 10.0.0.0/24
-            key: rfc2136-update
-            action: update
-            update-type: [TXT]
+    keyFiles = [ config.age.secrets.knot_dns_acme_dns_01_key_config.path ];
+    settings = {
+      server.listen = [ "0.0.0.0@53" "::@53" ];
+      acl = [
+        {
+          id = "update_acl";
+          address = "10.0.0.0/16";
+          key = "acme-dns-01";
+          action = "update";
+          update-type = [ "TXT" ];
+        }
+      ];
+      zone = [
+        {
+          domain = "noratrieb.dev";
+          file = import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
 
-        zone:
-          - domain: noratrieb.dev
-            storage: /var/lib/knot/zones/
-            file: ${import ./noratrieb.dev.nix { inherit pkgs lib networkingConfig; }}
-          - domain: nilstrieb.dev
-            storage: /var/lib/knot/zones/
-            file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
-            acl: update_acl
-        log:
-          - target: syslog
-            any: info
-      '';
+      ] ++ (if name == "dns1" then [
+        {
+          domain = "nilstrieb.dev";
+          file = import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; };
+        }
+        {
+          domain = "noratrieb-acme-delegate.dev";
+          storage = "/var/lib/knot/zones/";
+          file = "noratrieb-acme-delegate.dev.zone";
+          acl = "update_acl";
+        }
+      ] else [ ]);
+      log = [{
+        target = "syslog";
+        any = "info";
+      }];
     };
   };
 
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort ];
+  systemd.services.knot.preStart =
+    lib.mkIf (name == "dns1")
+      (lib.getExe
+        (pkgs.writeShellApplication {
+          name = "knot-prestart.sh";
+          text = ''
+            mkdir -p /var/lib/knot/zones/
+            cp ${
+              import ./noratrieb-acme-delegate.dev.nix { inherit pkgs lib networkingConfig; }
+            } /var/lib/knot/zones/noratrieb-acme-delegate.dev.zone
+          '';
+        }));
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [ metricsPort 53 ];
   services.prometheus.exporters.knot = {
     enable = true;
     port = metricsPort;

nix/modules/dns/nilstrieb.dev.nix

@@ -29,14 +29,11 @@ let
       ];
 
       NS = [
-        "ns1.nilstrieb.dev."
-        "ns2.nilstrieb.dev."
+        "ns.nilstrieb.dev."
       ];
 
       subdomains = {
         ns = dns1;
-        ns1 = dns1;
-        ns2 = dns2;
 
         localhost.A = [ (a "127.0.0.1") ];
 

nix/modules/dns/noratrieb-acme-delegate.dev.nix

@@ -0,0 +1,39 @@
+# https://github.com/nix-community/dns.nix
+{ pkgs, lib, networkingConfig, ... }:
+let
+  data = with pkgs.nix-dns.lib.combinators;
+    let
+      hour1 = 3600;
+      hostsToDns = builtins.mapAttrs
+        (name: { publicIPv4, publicIPv6, ... }:
+          lib.optionalAttrs (publicIPv4 != null) { A = [ (a publicIPv4) ]; } //
+          lib.optionalAttrs (publicIPv6 != null) { AAAA = [ (aaaa publicIPv6) ]; })
+        networkingConfig;
+    in
+    with hostsToDns;
+    {
+      TTL = hour1;
+      SOA = {
+        nameServer = "ns.noratrieb-acme-delegate.dev.";
+        adminEmail = "void@noratrieb.dev";
+        serial = 2024072601;
+      };
+
+      CAA = [
+        { issuerCritical = false; tag = "issue"; value = "letsencrypt.org"; }
+        { issuerCritical = false; tag = "issue"; value = "sectigo.com"; }
+      ];
+
+      NS = [
+        "ns.noratrieb-acme-delegate.dev."
+      ];
+
+      subdomains = {
+        ns = dns1;
+      };
+    };
+in
+pkgs.writeTextFile {
+  name = "noratrieb-acme-delegate.dev.zone";
+  text = pkgs.nix-dns.lib.toString "noratrieb-acme-delegate.dev" data;
+}

nix/modules/dns/noratrieb.dev.nix

@@ -97,10 +97,15 @@ let
         infra.subdomains = hostsToDns;
 
         # --- internal stuff
-        internal.subdomains = {
-          immich = minipc;
-          paperless = minipc;
-        };
+        internal.subdomains = builtins.listToAttrs (builtins.map
+          (name: {
+            inherit name;
+            value = minipc // {
+              subdomains = {
+                _acme-challenge.CNAME = [ (cname "_acme-challenge.${name}.internal.noratrieb-acme-delegate.dev.") ];
+              };
+            };
+          }) [ "immich" "paperless" "home-assistant" ]);
 
         # --- other verification
         _discord.TXT = [ "dh=e0f7e99c70c4ce17f7afcce3be8bfda9cd363843" ];