nixos/services: make dns configuration easier

agenix/dns/tuxcord.net/tuxcord.net.key.age

@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-ed25519 Wl2fDA XXuM89kA+Hnc4nKJ005H+IDYV5qk4nEx/IUWk/CbKiM
+sPJrUh6RI+Anzwy/nSR/dbCkZQvpJ3dGYSkChfJEv2Q
+-> ssh-ed25519 zNC8SA mg1uB6DPLT/3DE2Hh+EIGv9N4ZmDSi1w7UeW91u0cHs
+qBAmL0fgdRNuM4VYiDx0g6T2ZJFiqhgXpC/4C/RsVqU
+-> ssh-ed25519 EiAAKw EL0tfmXf6b2DWA3Ty4fhYdJL6AYdvknGv/To81dJ2zU
+KtZZx4//yDaAU6bt9JWYdBRbpqn79YHAu46857SBBPI
+-> ssh-rsa eFi+Zw
+jDWmTVRF7H9rhPAVEV2HkHtXpc/g16jlPDxvxzfnftyGF6aGfgoRwKtOwtqZtaB/
+UDE6Pzo3n5yg5/B8d0JhabBMfZpSJ8xiJcJfti8sY5tno97HhL0Fzd2r/0VM74iO
+TZ/ZA8xJACFfm9VclUz3gZWNG7qU4CrMYXQxWcwacphCiIFyFJVuaQEDf1rQnqEd
+3C8bMYxgRmUI64lLaRHdYD84hQ49xXrtuEQbJu6e/B3zCWsAMzpVciE/maDBBBGz
+EFRhhvP3Y8riBt4FLgYRVpvwge44LrX0N9NHeOyFmgP/S62ShDP+xLBnw9V3Tcuz
+9iuyJS4lz/mSWE9ISa1y21emQAuXOwdMkFM0b6tSCBL1zwKUNAzmEV/S4BMydNex
+/1m1ZaWDrOpfrBzRU+kN02a5sCHNGjO2/4T0dCjoGOeHUvpOw0IxniSQiKZj03nQ
+mWnWDp1sA/DK0ySs0AcYXJUs9EoeDQ1ny6tQ1Loc9xzX6uMFnFLfYIWXiI4erldl
+
+--- 9ryp8lwLiw/0MYGf1zSVR8ML6l5h83D0Flaks10d7Yg
+¹´m“Õ¶œK[.›šLÛãKÜ Õr'4†ÿÎÂû*­«ÖÜý­¬ßÏñ-¨À–T,Cê$Š¦Ÿ�Vئf·E:pu*wdwe[óR¦ŒëëwŸP§Qøhªi½è0L×0J"�©e�þD÷
l‡‡gõ®’üœ’ù„&9õ™5éÑjZÀÞÇ«ßd

agenix/dns/tuxcord.test/tuxcord.test.key.age

@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-ed25519 Wl2fDA 86jJdtfiJBUnXAh0R+VjMeX5NTB+kGQlOioe/9Us6GI
+i0EPVHWazwgTCracN1bn9mvbpynd1x+XNE+5Hh09bKM
+-> ssh-ed25519 zNC8SA hL+Axpc8Qy8iosArb+JdAaQdf6gPlUaLRQ0w4YJJU1c
+k4prWpg+pyuykv8N2RjQQT7Ow53QjXBYxsqBwjtgFjw
+-> ssh-ed25519 EiAAKw /+UyD03g2OVWeJzooMrMxNH0otkY6Km9BDSJ+f8zVGQ
+kFSmApLaIFQ1F1ZaLThFlb7ZOfIDWDYZByuYfEvn2FU
+-> ssh-rsa eFi+Zw
+p5uxnSM+9jojTeHlzDycwEKqklY6F1oDU87e0pn/WhNBtSo3SzNI0aHtwKDLN548
+m4RQNQ6wKWAl36VvQDJmWiP6LJNKx5oQvgCLqqJ+fGTAx1mUUL+hpVC+Y2siONbN
+WWbFXVD1FHk+enHkRA9ZERiVPqV7Zg5b55t+E2dwRh2fas8IlOwBEEceIggYKi85
+Dywr8dhdL1VeAHG1l4fdkgn9A3oLqMHIw0oUHX16CawCYrQZt9bezDR6mb8HuEdM
+KVHSd6y+Aq0wYgcmGEkknw45VlG9Mjor0qhW9y+cJQ941niiPr1Q7LPcpdLAUmHP
+KbGDnnt/vvMEXaa5G1HDytvedHbAygx/fWGfm3Ngq8qUAV7kEHz2kUclJ5OOBTRm
+M0081XNKZF2QdmN+O8eMFMor1OcKsNe3Ril0Y8rPtMd+iwOulLbbV3b8LZ/Jd1+9
+ePUoOyj0wP4gVzXo5INiNVtYK+sK6Ek1Gt+UCHhAlJwj5RulmIvEzISZjHJAt4yU
+
+--- hljwKKncDABYcm9RHZtEdHhRlKqSFtoE6GihIfBqowU
+ošã…ŒüFÔÑr	u·«¢sð­(�ÿg»NÇšØÄø¬äƒÇ¤g�Isã„ý¡^•Õíõ‚›�Ò1¼ÁQé¥]¶aE”^Áœiw«Ne2:4Ì ö®bH†ŠŽÆyf¸ nü‰$+ÉÃ_Ö¶•éjòê4Ý>Þ $?”<“³·IŠ¨……‘˜'±

agenix/ntfy.age

@@ -1,17 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 Wl2fDA JMymqEdh+xJbl8VcL5wg7Y2Dk4667DzNO85RCskX+0Q
+-> ssh-ed25519 Wl2fDA 8rfiRx7+Gr9BtiSXsVEs2W+pXoms6ynODC1TL90+Wi4
-ZQqF0eYpvrLujGdIvAMbfwPnKGa+mfNvAhHGMdXiYaI
+/uMnYMJovbaPjwX1qCAtIokov40RYIAm2Mup5XKBJvw
--> ssh-ed25519 zNC8SA UCQhQA4f3OiNoxejDBMabnls3LjS0GQmvIqPpjB/FH8
+-> ssh-ed25519 zNC8SA FlxMK7kMYnKHY9MBJ+HYDI4GNS0nSgZxVuRe4yTWBgg
-0qvv6W1heZiE1DDYEj1U5N2e99DZLxlJ6A8EoZ31DhM
+HPOV31k8Ueb1W5usG7iLXDQxyAlISrgHThddHpGY2+s
--> ssh-rsa 3G83yA
+-> ssh-ed25519 EiAAKw Bu7+NJXivoRA07glNWUlBGu03J0ueth7XDU7SWQYT30
-Gnpw8t6njIXGm98jTS47Afx6TogPnIJP59rapF0CkYkDXZNrW7WK+fcERHLN2+a+
+r/DBmf4TRDJBgFF0KdeHuKL5hLdU1z6HtfAAVbc6Y0I
-PSkjwkql3LfAtCNqrIJZwWLj/URnKQF5N3ZKwOa1+wsM3GeUzjvaQwPZunj4jyFs
+-> ssh-rsa eFi+Zw
-IJlL+ika2sBk/HvOa1r6ntj2cvLM1fIhbs9bOEZW3br3M3sfXk386TgrytqzM248
+Nu4gAM/vbh0kpEUIaT4P6iTe9qFFM/9IVxiiKPYHdPnCmPJHrug1afLLFrrrpqkd
-3xS2iIwIBmBiI5Xem8KO2+J/2Vk9Px/ZPkBpdIAaZAmihe3g/VWNKHhXrwdM9ZA7
+o1NrfYIM9gW6jl5QMCcP5DpzMTppokX0P1Tz1ZeOEtZUVtGeZ7Q2wmL4zftwmG9J
-tHgw5ohK8ug88ep9XCIFD75DPeK/60wqAdkGs4PE6THcsKqhN061TAEq3SWRl8wp
+qoDjsCd0z6MPDUdU46qc7kjQBhOwGLfHXTfGLXGNZxqj0oLvEoEKpdvFNBvMSyxK
-Kd17yAzHDLhsbdWXT/Q912Y4YJCB3TnD0MFGzPF7sks2NknB6yowwjnCGlqzf5rW
+oGZRwGsHQcUXKhCPtf6PVtSkHMABzpUAhgS8oqjp4RVurD0lcrPgsx8pSRRarfyE
-RBKHp6PTM+x/eDi89vS+uIBtyGFaFU7wBTl4FzJpKoOsRIDYNktGkJSxdTzrMO1n
+ll1QbFCjftuJfeIEshgRkaLGjIQpZDFA3w2XMqDddFz5H/9Ak+F8/rkNnUrN2x4M
-XqXtJtqZaXN7UExA+ko9ln446I7RG8c3hNGx4A4bR1xUEUE8WD/TMhjzrbzysYSl
+amca8s4Sbls6RjyysarIytilCtpaKEI2sgkD2fERao6ayTSnWF45qqh635OLaP5A
+b7qcru9gO0C3Ik+UuiZMgovxo/+yBYe3+8x8q/uKR4apPAkt/2q28Uilw1WboIEB
+rIjBr0BN1JeHvkiyljJGcvGf5jHdmOrpQu/L1xuSDjsTnh+U6BshQC8bbkJNsVoL
 
---- BuKW3bW48i1OD38J2bj5sRkn+zg/WKiLtf8zgycCr2A
+--- GCTLfa/BICL9AWTaqGC13M101Z8sqSqPP4ysJVv5zvg
-g­©2Ôkâ5	ÀóìØ!]0kÉW€³�ÍØ¡t>éQžk[I3Vâ4EÔàwc`L;UvžVe)m©mé¿€Û¸
+]
+ý­¢Ôÿi¹‡7c·f`b@%X”¿J�)û[<+;x-ÇKmTõ@ãÌ„�ýŸK]7sc*ë­Ÿ‡¼2Ý®5

agenix/secrets.nix

@@ -6,7 +6,10 @@ in
 {
   "ntfy.age".publicKeys = [ tuxcord-ca ] ++ builtins.attrValues users;
 
-  # tsig-keygen sub.domain.tld.
+  # tsig-keygen etc.sub.domain.tld.
-  "dns/tuxcord.key".publicKeys = [ tuxcord-ca ] ++ [ users.error users.javalsai ];
+  "dns/tuxcord.net/tuxcord.net.key.age".publicKeys = [ tuxcord-ca ] ++ [ users.error users.javalsai ];
-  # "dns/users/XXX.key".publicKeys = [ users.XXX ];
+  # "dns/tuxcord.net/XXX.tuxcord.net.key.age".publicKeys = [ tuxcord-ca ] ++ [ users.XXX ];
+
+  "dns/tuxcord.test/tuxcord.test.key.age".publicKeys = [ tuxcord-ca ] ++ builtins.attrValues users;
+  "dns/tuxcord.test/sub.tuxcord.test.key.age".publicKeys = [ tuxcord-ca ] ++ builtins.attrValues users;
 }

nixos/common.nix

@@ -28,14 +28,6 @@ in
     ./vm.nix
   ];
 
-  age.secrets = {
-    dns-root-key = {
-      file = ../agenix/dns/tuxcord.key;
-      group = "named";
-      owner = "named";
-    };
-  };
-
   nix = {
     package = inputs'.nix-super.packages.default;
 

nixos/hosts/tuxcord-ca/default.nix

@@ -4,6 +4,7 @@
     ./storage.nix
   ];
 
+  dns.enable = true;
   networking.fqdn = "tuxcord.net";
   time.timeZone = "Canada/Eastern";
 }

nixos/hosts/tuxcord-test/default.nix

@@ -1,3 +1,4 @@
 {
+  dns.enable = true;
   networking.fqdn = "tuxcord.test";
 }

nixos/modules/dns.nix

@@ -1,28 +1,71 @@
-{ config, ... }:
+{ config, lib, ... }:
 let
-  fqdn = "tuxcord.net";
+  agenixDnsDir = ../../agenix/dns + "/${config.dns.domain}";
-  # fqdn = config.networking.fqdn;
+  agenixKeys = builtins.attrNames (builtins.readDir agenixDnsDir);
 
+  keys = map (
+    filename:
+    let
       zonesub = _: "zonesub";
       subdomain = name: "subdomain ${name}";
 
-  # careful, assumes the fqdn (name) matches the key name content
+      zoneDomain =
-  keys = [
+        if lib.strings.hasSuffix ".key.age" filename then
+          lib.strings.removeSuffix ".key.age" filename
+        else
+          throw "${filename} is not a `.key.age` file";
+    in
     {
-      name = "tuxcord.net";
+      name = zoneDomain;
-      path = config.age.secrets.dns-root-key.path;
+      path = config.age.secrets."dns/${filename}".path;
-      type = zonesub;
+      type = if zoneDomain == config.dns.domain then zonesub else subdomain;
     }
-  ];
+  ) agenixKeys;
+
+  cfg = config.dns;
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    mkIf
+    ;
 in
 {
+  options.dns = {
+    enable = mkEnableOption "" // {
+      default = true;
+    };
+
+    domain = mkOption {
+      type = with lib.types; str;
+      default = config.networking.fqdn;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    age.secrets = builtins.listToAttrs (
+      map (
+        filename:
+        let
+          path = "${agenixDnsDir}/${filename}";
+        in
+        {
+          name = "dns/${filename}";
+          value = {
+            file = path;
+            group = "named";
+            owner = "named";
+          };
+        }
+      ) agenixKeys
+    );
+
     services.bind = {
       enable = true;
 
       extraConfig = builtins.concatStringsSep "\n" (map (key: "include \"${key.path}\";") keys);
 
       zones = {
-      "${fqdn}" = {
+        "${config.dns.domain}" = {
           # grant "tuxcord.net" zonesub ANY;
           extraConfig = ''
             update-policy {
@@ -31,21 +74,19 @@ in
               )}
             };
           '';
-        file = "/var/dns/${fqdn}.zone"; # need to put default stuff
+          file = "/var/dns/${config.dns.domain}.zone"; # need to put default stuff
           master = true;
         };
       };
     };
 
-  environment.persistence."/persist" = {
+    environment.persistence."/persist".directories = [
-    directories = [
       {
         directory = "/var/dns";
         group = "named";
         user = "named";
       }
     ];
-  };
 
     networking.firewall =
       let
@@ -55,4 +96,5 @@ in
         allowedTCPPorts = ports;
         allowedUDPPorts = ports;
       };
+  };
 }