aboutsummaryrefslogtreecommitdiff
path: root/nix/deuxfleurs.nix
diff options
context:
space:
mode:
Diffstat (limited to 'nix/deuxfleurs.nix')
-rw-r--r--nix/deuxfleurs.nix38
1 files changed, 10 insertions, 28 deletions
diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index f7b70d7..245e12c 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -96,10 +96,6 @@ in
type = types.nullOr types.str;
default = null;
};
- nameservers = mkOption {
- description = "External DNS servers to use";
- type = types.listOf types.str;
- };
# Parameters common to all nodes
cluster_name = mkOption {
@@ -190,47 +186,36 @@ in
};
};
- # Configure Unbound DNS to redirect to Consul queries under .consul
- # and to pass directly to public DNS resolver all others
+ # Configure Unbound as a central DNS server for everything
+ # - is its own recursor (applies DNSSec) for everything,
+ # no need to declare an outside nameserver
+ # - redirects to Consul queries under .consul
services.unbound = {
enable = true;
- enableRootTrustAnchor = false; # disable DNSSEC as it causes issues
settings = {
server = {
- interface = [ "127.0.0.1" "${cfg.lan_ip}" "172.17.0.1" ];
+ interface = [ "127.0.0.1" "172.17.0.1" ];
domain-insecure = [ "consul." ];
local-zone = [ "consul. nodefault" ];
log-servfail = true;
access-control = [
"127.0.0.0/8 allow"
- "${cfg.lan_ip}/${toString cfg.lan_ip_prefix_length} allow"
"172.17.0.0/16 allow"
];
};
- forward-zone = [
+ stub-zone = [
# Forward .consul queries to Consul daemon
{
name = "consul.";
- forward-addr = "${cfg.lan_ip}@8600";
- forward-no-cache = true;
- forward-tcp-upstream = false;
- forward-tls-upstream = false;
- }
- # Forward all queries to our ISP's nameserver
- {
- name = ".";
- forward-addr = cfg.nameservers;
- forward-first = true;
+ stub-addr = "${cfg.cluster_ip}@8600";
+ stub-no-cache = true;
+ stub-tcp-upstream = false;
+ stub-tls-upstream = false;
}
];
};
resolveLocalQueries = true;
};
- # Reach Unbound through the IP of our LAN interface,
- # instead of 127.0.0.1 (this will also work in Docker containers)
- networking.nameservers = [ # TODO remove this ?
- cfg.lan_ip
- ];
services.resolved.enable = false;
# Configure Wireguard VPN between all nodes
@@ -321,9 +306,6 @@ in
verify_outgoing = true;
verify_server_hostname = true;
};
- systemd.services.consul.serviceConfig = { # TODO remove this ?
- AmbientCapabilities = "CAP_NET_BIND_SERVICE";
- };
services.nomad.enable = true;
systemd.services.nomad.after = [ "wg-quick-wg0.service" ];