From 641a68715f3b5d70d249deb3f9206ee86f200a6b Mon Sep 17 00:00:00 2001
From: Alex Auvolat <alex@adnab.me>
Date: Wed, 1 Jun 2022 14:46:00 +0200
Subject: Configure Consul DNS

---
 nix/deuxfleurs.nix | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

(limited to 'nix')

diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index d20ea5d..82bec18 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -60,6 +60,10 @@ in
       description = "Site (availability zone) on which this node is deployed";
       type = types.str;
     };
+    nameservers = mkOption {
+      description = "External DNS servers to use";
+      type = types.listOf types.str;
+    };
 
     # Parameters common to all nodes
     cluster_name = mkOption {
@@ -101,11 +105,16 @@ in
       };
     in
       (attrsets.setAttrByPath [ cfg.network_interface ] (ip4config // ip6config));
+
     networking.defaultGateway = {
       address = cfg.lan_default_gateway;
       interface = cfg.network_interface;
     };
 
+    networking.nameservers = [
+      cfg.lan_ip
+    ] ++ cfg.nameservers;
+
     # wesher overlay network
     services.wesher = {
       enable = true;
@@ -137,9 +146,17 @@ in
       ui = true;
       bind_addr = "${cfg.cluster_ip}";
 
-      ports.http = -1;
-      addresses.https = "0.0.0.0";
-      ports.https = 8501;
+      addresses = {
+        https = "0.0.0.0";
+        dns = "0.0.0.0";
+      };
+      ports = {
+        http = -1;
+        https = 8501;
+        dns = 53;
+      };
+
+      recursors = [ cfg.nameservers ];
 
       ca_file = "/var/lib/consul/pki/consul-ca.crt";
       cert_file = "/var/lib/consul/pki/consul2022.crt";
@@ -148,6 +165,9 @@ in
       verify_outgoing = true;
       verify_server_hostname = true;
     };
+    systemd.services.consul.serviceConfig = {
+      AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+    };
 
     services.nomad.enable = true;
     services.nomad.package = pkgs.nomad_1_1;
-- 
cgit v1.2.3