29027fd1e1
Using pkgs.lib on the spine of module evaluation is problematic because the pkgs argument depends on the result of module evaluation. To prevent an infinite recursion, pkgs and some of the modules are evaluated twice, which is inefficient. Using ‘with lib’ prevents this problem.
119 lines
2.6 KiB
Nix
119 lines
2.6 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
cfg = config.services.unbound;
|
|
|
|
username = "unbound";
|
|
|
|
stateDir = "/var/lib/unbound";
|
|
|
|
access = concatMapStrings (x: " access-control: ${x} allow\n") cfg.allowedAccess;
|
|
|
|
interfaces = concatMapStrings (x: " interface: ${x}\n") cfg.interfaces;
|
|
|
|
forward = optionalString (length cfg.forwardAddresses != 0)
|
|
"forward-zone:\n name: .\n" +
|
|
concatMapStrings (x: " forward-addr: ${x}\n") cfg.forwardAddresses;
|
|
|
|
confFile = pkgs.writeText "unbound.conf"
|
|
''
|
|
server:
|
|
directory: "${stateDir}"
|
|
username: ${username}
|
|
# make sure unbound can access entropy from inside the chroot.
|
|
# e.g. on linux the use these commands (on BSD, devfs(8) is used):
|
|
# mount --bind -n /dev/random /etc/unbound/dev/random
|
|
# and mount --bind -n /dev/log /etc/unbound/dev/log
|
|
chroot: "${stateDir}"
|
|
# logfile: "${stateDir}/unbound.log" #uncomment to use logfile.
|
|
pidfile: "${stateDir}/unbound.pid"
|
|
verbosity: 1 # uncomment and increase to get more logging.
|
|
# listen on all interfaces, answer queries from the local subnet.
|
|
${interfaces}
|
|
${access}
|
|
${forward}
|
|
${cfg.extraConfig}
|
|
'';
|
|
|
|
in
|
|
|
|
{
|
|
|
|
###### interface
|
|
|
|
options = {
|
|
|
|
services.unbound = {
|
|
|
|
enable = mkOption {
|
|
default = false;
|
|
description = "
|
|
Whether to enable the Unbound domain name server.
|
|
";
|
|
};
|
|
|
|
allowedAccess = mkOption {
|
|
default = ["127.0.0.0/24"];
|
|
description = "
|
|
What networks are allowed to use us as a resolver.
|
|
";
|
|
};
|
|
|
|
interfaces = mkOption {
|
|
default = [ "127.0.0.0" "::1" ];
|
|
description = "
|
|
What addresses the server should listen to.
|
|
";
|
|
};
|
|
|
|
forwardAddresses = mkOption {
|
|
default = [ ];
|
|
description = "
|
|
What servers to forward the queries to.
|
|
";
|
|
};
|
|
|
|
extraConfig = mkOption {
|
|
default = "";
|
|
description = "
|
|
Extra unbound config
|
|
";
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
###### implementation
|
|
|
|
config = mkIf config.services.unbound.enable {
|
|
environment.systemPackages = [ pkgs.unbound ];
|
|
|
|
users.extraUsers = singleton
|
|
{ name = username;
|
|
uid = config.ids.uids.unbound;
|
|
description = "unbound daemon user";
|
|
home = "/tmp";
|
|
};
|
|
|
|
jobs.unbound =
|
|
{ description = "Unbound name server job";
|
|
|
|
preStart =
|
|
''
|
|
${pkgs.coreutils}/bin/mkdir -p ${stateDir}
|
|
'';
|
|
|
|
daemonType = "fork";
|
|
|
|
exec = "${pkgs.unbound}/sbin/unbound -c ${confFile}";
|
|
};
|
|
|
|
};
|
|
|
|
}
|