dns: use coredns for https records

This commit is contained in:
Giulio De Pasquale 2024-01-31 00:20:07 +01:00
parent ba39859e01
commit aa12bece7f

View File

@ -1,40 +1,49 @@
{ config, pkgs, lib, ... }: { config, lib, ... }:
let let
domain = "adguard.architect.devs.giugl.io"; # Function to generate CoreDNS config for a single vhost
generateCoreDNSConfigForVhost = domain: conf:
let
# Retrieve architect's IP on each interface
interfaceConfigs = builtins.map
(iface:
let
architectIP = config.architect.networks.${iface}.devices.architect.address;
interfaceNet = config.architect.networks.${iface}.net;
in
''
${domain} {
view ${iface} {
expr incidr(client_ip(), '${interfaceNet}')
}
template IN A ${domain} {
answer "${domain}. 60 IN A ${architectIP}"
}
template IN HTTPS ${domain} {
answer "${domain}. 60 IN HTTPS 1 . ipv4hint=\"${architectIP}\""
}
cache
log
}
''
)
conf.dnsInterfaces;
in
lib.concatStringsSep "\n" interfaceConfigs;
in in
{ {
architect = {
firewall.openUDPVPN = [ 53 ];
vhost.${domain} = {
dnsInterfaces = [ "lan" "tailscale" ];
locations."/" = with config; {
port = services.adguardhome.settings.bind_port;
allow = with architect.networks; [ lan.net tailscale.net ];
deny = [
architect.networks."lan".devices.router.address
];
};
};
};
services = { services = {
dnsmasq = { coredns = {
enable = true; enable = true;
settings = { config = ''
server = [ "127.0.0.1#${toString config.services.adguardhome.settings.dns.port}" ]; ${lib.concatStringsSep "\n" (lib.mapAttrsToList generateCoreDNSConfigForVhost config.architect.vhost)}
localise-queries = true;
min-cache-ttl = 120; . {
max-cache-ttl = 2400; cache
domain = [ forward . 127.0.0.1:${toString config.services.adguardhome.settings.dns.port}
"runas.rocks" }
"giugl.io" '';
"devs.runas.rocks"
"devs.giugl.io"
];
};
}; };
adguardhome = { adguardhome = {