2020-04-24 23:36:52 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
|
|
|
|
with lib;
|
|
|
|
|
|
|
|
let
|
|
|
|
cfg = config.services.kresd;
|
|
|
|
|
|
|
|
# Convert systemd-style address specification to kresd config line(s).
|
|
|
|
# On Nix level we don't attempt to precisely validate the address specifications.
|
2022-01-13 20:06:32 +00:00
|
|
|
# The optional IPv6 scope spec comes *after* port, perhaps surprisingly.
|
2020-04-24 23:36:52 +00:00
|
|
|
mkListen = kind: addr: let
|
2022-01-27 00:19:43 +00:00
|
|
|
al_v4 = builtins.match "([0-9.]+):([0-9]+)($)" addr;
|
2022-01-13 20:06:32 +00:00
|
|
|
al_v6 = builtins.match "\\[(.+)]:([0-9]+)(%.*|$)" addr;
|
2024-02-07 01:22:34 +00:00
|
|
|
al_portOnly = builtins.match "(^)([0-9]+)" addr;
|
2020-04-24 23:36:52 +00:00
|
|
|
al = findFirst (a: a != null)
|
|
|
|
(throw "services.kresd.*: incorrect address specification '${addr}'")
|
|
|
|
[ al_v4 al_v6 al_portOnly ];
|
2022-01-13 20:06:32 +00:00
|
|
|
port = elemAt al 1;
|
|
|
|
addrSpec = if al_portOnly == null then "'${head al}${elemAt al 2}'" else "{'::', '0.0.0.0'}";
|
2020-04-24 23:36:52 +00:00
|
|
|
in # freebind is set for compatibility with earlier kresd services;
|
|
|
|
# it could be configurable, for example.
|
|
|
|
''
|
|
|
|
net.listen(${addrSpec}, ${port}, { kind = '${kind}', freebind = true })
|
|
|
|
'';
|
|
|
|
|
|
|
|
configFile = pkgs.writeText "kresd.conf" (
|
2020-11-19 00:13:47 +00:00
|
|
|
""
|
2020-04-24 23:36:52 +00:00
|
|
|
+ concatMapStrings (mkListen "dns") cfg.listenPlain
|
|
|
|
+ concatMapStrings (mkListen "tls") cfg.listenTLS
|
2020-11-19 00:13:47 +00:00
|
|
|
+ concatMapStrings (mkListen "doh2") cfg.listenDoH
|
2020-04-24 23:36:52 +00:00
|
|
|
+ cfg.extraConfig
|
|
|
|
);
|
|
|
|
in {
|
|
|
|
meta.maintainers = [ maintainers.vcunat /* upstream developer */ ];
|
|
|
|
|
|
|
|
imports = [
|
|
|
|
(mkChangedOptionModule [ "services" "kresd" "interfaces" ] [ "services" "kresd" "listenPlain" ]
|
|
|
|
(config:
|
|
|
|
let value = getAttrFromPath [ "services" "kresd" "interfaces" ] config;
|
|
|
|
in map
|
|
|
|
(iface: if elem ":" (stringToCharacters iface) then "[${iface}]:53" else "${iface}:53") # Syntax depends on being IPv6 or IPv4.
|
|
|
|
value
|
|
|
|
)
|
|
|
|
)
|
|
|
|
(mkRemovedOptionModule [ "services" "kresd" "cacheDir" ] "Please use (bind-)mounting instead.")
|
|
|
|
];
|
|
|
|
|
|
|
|
###### interface
|
|
|
|
options.services.kresd = {
|
|
|
|
enable = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
2022-08-12 12:06:08 +00:00
|
|
|
description = lib.mdDoc ''
|
2020-04-24 23:36:52 +00:00
|
|
|
Whether to enable knot-resolver domain name server.
|
|
|
|
DNSSEC validation is turned on by default.
|
2022-08-12 12:06:08 +00:00
|
|
|
You can run `sudo nc -U /run/knot-resolver/control/1`
|
2020-04-24 23:36:52 +00:00
|
|
|
and give commands interactively to kresd@1.service.
|
|
|
|
'';
|
|
|
|
};
|
2024-01-02 11:29:13 +00:00
|
|
|
package = mkPackageOption pkgs "knot-resolver" {
|
|
|
|
example = "knot-resolver.override { extraFeatures = true; }";
|
2021-05-03 20:48:10 +00:00
|
|
|
};
|
2020-04-24 23:36:52 +00:00
|
|
|
extraConfig = mkOption {
|
|
|
|
type = types.lines;
|
|
|
|
default = "";
|
2022-08-12 12:06:08 +00:00
|
|
|
description = lib.mdDoc ''
|
2020-04-24 23:36:52 +00:00
|
|
|
Extra lines to be added verbatim to the generated configuration file.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
listenPlain = mkOption {
|
|
|
|
type = with types; listOf str;
|
|
|
|
default = [ "[::1]:53" "127.0.0.1:53" ];
|
|
|
|
example = [ "53" ];
|
2022-08-12 12:06:08 +00:00
|
|
|
description = lib.mdDoc ''
|
2020-04-24 23:36:52 +00:00
|
|
|
What addresses and ports the server should listen on.
|
2023-01-11 07:51:40 +00:00
|
|
|
For detailed syntax see ListenStream in {manpage}`systemd.socket(5)`.
|
2020-04-24 23:36:52 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
listenTLS = mkOption {
|
|
|
|
type = with types; listOf str;
|
|
|
|
default = [];
|
|
|
|
example = [ "198.51.100.1:853" "[2001:db8::1]:853" "853" ];
|
2022-08-12 12:06:08 +00:00
|
|
|
description = lib.mdDoc ''
|
2020-04-24 23:36:52 +00:00
|
|
|
Addresses and ports on which kresd should provide DNS over TLS (see RFC 7858).
|
2023-01-11 07:51:40 +00:00
|
|
|
For detailed syntax see ListenStream in {manpage}`systemd.socket(5)`.
|
2020-04-24 23:36:52 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
listenDoH = mkOption {
|
|
|
|
type = with types; listOf str;
|
|
|
|
default = [];
|
|
|
|
example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
|
2022-08-12 12:06:08 +00:00
|
|
|
description = lib.mdDoc ''
|
2020-11-19 00:13:47 +00:00
|
|
|
Addresses and ports on which kresd should provide DNS over HTTPS/2 (see RFC 8484).
|
2023-01-11 07:51:40 +00:00
|
|
|
For detailed syntax see ListenStream in {manpage}`systemd.socket(5)`.
|
2020-04-24 23:36:52 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
instances = mkOption {
|
|
|
|
type = types.ints.unsigned;
|
|
|
|
default = 1;
|
2022-08-12 12:06:08 +00:00
|
|
|
description = lib.mdDoc ''
|
2020-04-24 23:36:52 +00:00
|
|
|
The number of instances to start. They will be called kresd@{1,2,...}.service.
|
|
|
|
Knot Resolver uses no threads, so this is the way to scale.
|
|
|
|
You can dynamically start/stop them at will, so this is just system default.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
# TODO: perhaps options for more common stuff like cache size or forwarding
|
|
|
|
};
|
|
|
|
|
|
|
|
###### implementation
|
|
|
|
config = mkIf cfg.enable {
|
|
|
|
environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
|
|
|
|
|
2021-05-28 09:39:13 +00:00
|
|
|
networking.resolvconf.useLocalResolver = mkDefault true;
|
|
|
|
|
2020-04-24 23:36:52 +00:00
|
|
|
users.users.knot-resolver =
|
|
|
|
{ isSystemUser = true;
|
|
|
|
group = "knot-resolver";
|
|
|
|
description = "Knot-resolver daemon user";
|
|
|
|
};
|
|
|
|
users.groups.knot-resolver.gid = null;
|
|
|
|
|
2021-05-03 20:48:10 +00:00
|
|
|
systemd.packages = [ cfg.package ]; # the units are patched inside the package a bit
|
2020-04-24 23:36:52 +00:00
|
|
|
|
|
|
|
systemd.targets.kresd = { # configure units started by default
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
wants = [ "kres-cache-gc.service" ]
|
|
|
|
++ map (i: "kresd@${toString i}.service") (range 1 cfg.instances);
|
|
|
|
};
|
|
|
|
systemd.services."kresd@".serviceConfig = {
|
2021-05-03 20:48:10 +00:00
|
|
|
ExecStart = "${cfg.package}/bin/kresd --noninteractive "
|
|
|
|
+ "-c ${cfg.package}/lib/knot-resolver/distro-preconfig.lua -c ${configFile}";
|
2020-08-20 17:08:02 +00:00
|
|
|
# Ensure /run/knot-resolver exists
|
|
|
|
RuntimeDirectory = "knot-resolver";
|
|
|
|
RuntimeDirectoryMode = "0770";
|
|
|
|
# Ensure /var/lib/knot-resolver exists
|
|
|
|
StateDirectory = "knot-resolver";
|
|
|
|
StateDirectoryMode = "0770";
|
|
|
|
# Ensure /var/cache/knot-resolver exists
|
2020-04-24 23:36:52 +00:00
|
|
|
CacheDirectory = "knot-resolver";
|
2020-08-20 17:08:02 +00:00
|
|
|
CacheDirectoryMode = "0770";
|
2020-04-24 23:36:52 +00:00
|
|
|
};
|
2020-12-25 13:55:36 +00:00
|
|
|
# We don't mind running stop phase from wrong version. It seems less racy.
|
|
|
|
systemd.services."kresd@".stopIfChanged = false;
|
2020-04-24 23:36:52 +00:00
|
|
|
};
|
|
|
|
}
|