nixos-configs/devices/cluster/modules/unbound.nix
matt1432 8cd7cf258c
All checks were successful
Discord / discord commits (push) Successful in 28s
feat(servers): move oksys services to cluster
2024-01-23 23:42:41 -05:00

83 lines
2.1 KiB
Nix

{config, ...}: let
inherit (config.vars) mainUser hostName;
in {
# https://github.com/MatthewVance/unbound-docker-rpi/issues/4#issuecomment-1001879602
boot.kernel.sysctl."net.core.rmem_max" = 1048576;
users.users.${mainUser}.extraGroups = ["unbound"];
services.unbound = {
enable = true;
enableRootTrustAnchor = true;
resolveLocalQueries = false;
settings = {
server = {
interface = ["127.0.0.1"];
port = 5335;
# Custom DNS
local-zone = [
"pve.nelim.org redirect"
"headscale.nelim.org redirect"
"git.nelim.org redirect"
"mc.nelim.org transparent"
"cv.nelim.org transparent"
"mc2.nelim.org transparent"
"ota.nelim.org redirect"
"nelim.org redirect"
];
local-data = let
caddyIp =
if hostName == "thingone"
then "100.64.0.8"
else "100.64.0.9";
in [
"\"pve.nelim.org IN A 100.64.0.4\""
"\"headscale.nelim.org. IN A 24.200.126.219\""
"\"git.nelim.org. IN A 24.200.126.219\""
"\"mc.nelim.org IN A 100.64.0.7\""
"\"_minecraft._tcp.mc.nelim.org. 180 IN SRV 0 0 25569 mc.nelim.org.\""
"\"cv.nelim.org IN A 100.64.0.7\""
"\"_minecraft._tcp.cv.nelim.org. 180 IN SRV 0 0 25566 cv.nelim.org.\""
"\"mc2.nelim.org IN A 100.64.0.7\""
"\"_minecraft._tcp.mc2.nelim.org. 180 IN SRV 0 0 25560 mc2.nelim.org.\""
"\"ota.nelim.org. IN A 100.64.0.5\""
"\"nelim.org 0 A ${caddyIp}\""
];
do-ip4 = true;
do-ip6 = false;
prefer-ip6 = false;
do-udp = true;
do-tcp = true;
# Performance
prefetch = true;
num-threads = 1;
private-address = [
"172.16.0.0/12"
"10.0.0.0/8"
"100.64.0.0/8"
"fd00::/8"
"fe80::/10"
];
# Default stuff
harden-glue = true;
harden-dnssec-stripped = true;
use-caps-for-id = false;
edns-buffer-size = 1232;
so-rcvbuf = "1m";
};
};
};
}