nameservers/overlay: Switch from unbound to nsd

flake.lock

@@ -59,6 +59,27 @@
         "type": "github"
       }
     },
+    "dns": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768143854,
+        "narHash": "sha256-E5/kyPz4zAZn/lZdvqlF83jMgCWNxmqYjjWuadngCbk=",
+        "owner": "kirelagin",
+        "repo": "dns.nix",
+        "rev": "a97cf4156e9f044fe4bed5be531061000dfabb07",
+        "type": "github"
+      },
+      "original": {
+        "owner": "kirelagin",
+        "repo": "dns.nix",
+        "type": "github"
+      }
+    },
     "firefox-addons": {
       "inputs": {
         "nixpkgs": [
@@ -136,6 +157,21 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "locked": {
+        "lastModified": 1614513358,
+        "narHash": "sha256-LakhOx3S1dRjnh0b5Dg3mbZyH0ToC9I8Y2wKSkBaTzU=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5466c5bbece17adaab2d82fae80b46e807611bf3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -313,6 +349,7 @@
         "betterfox": "betterfox",
         "comin": "comin",
         "disko": "disko",
+        "dns": "dns",
         "firefox-addons": "firefox-addons",
         "flake-parts": "flake-parts",
         "home-manager": "home-manager",

flake.nix

@@ -57,6 +57,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    dns = {
+      url = "github:kirelagin/dns.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     radicale-birthday-calendar = {
       url = "github:iBigQ/radicale-birthday-calendar";
       flake = false;

modules/nixos/services/nameservers/overlay.nix

@@ -1,5 +1,6 @@
 {
   config,
+  inputs,
   self,
   lib,
   allHosts,
@@ -8,23 +9,37 @@
 let
   cfg = config.custom.services.nameservers.overlay;
   netCfg = config.custom.networking;
-in
-{
-  options.custom.services.nameservers.overlay.enable = lib.mkEnableOption "";
 
-  config = lib.mkIf cfg.enable {
+  zoneData = {
-    services = {
+    SOA = {
-      unbound = {
+      nameServer = "${netCfg.overlay.fqdn}.";
-        enable = true;
+      adminEmail = "hostmaster@sstork.dev";
+      serial = 1;
+    };
+    NS =
+      allHosts
+      |> lib.attrValues
+      |> lib.filter (host: host.config.custom.services.nameservers.overlay.enable)
+      |> lib.map (host: "${host.config.custom.networking.overlay.fqdn}.");
 
-        settings.server = {
+    subdomains =
-          interface = [ netCfg.overlay.interface ];
-          access-control = [ "${toString netCfg.overlay.networkCidr} allow" ];
-
-          local-zone = "\"${netCfg.overlay.domain}.\" static";
-          local-data =
       let
-              nodeRecords = netCfg.nodes |> lib.map (node: "\"${node.overlay.fqdn}. A ${node.overlay.address}\"");
+        mkRecord =
+          { name, address }:
+          {
+            inherit name;
+            value.A = [ address ];
+          };
+
+        nodeRecords =
+          netCfg.nodes
+          |> lib.map (
+            node:
+            mkRecord {
+              name = node.hostName;
+              inherit (node.overlay) address;
+            }
+          );
         serviceRecords =
           allHosts
           |> lib.attrValues
@@ -34,11 +49,27 @@ in
             |> lib.attrValues
             |> lib.map (vHost: vHost.domain)
             |> lib.filter (domain: self.lib.isPrivateDomain domain)
-                  |> lib.map (domain: "\"${domain}. A ${host.config.custom.networking.overlay.address}\"")
+            |> lib.map (
+              domain:
+              mkRecord {
+                name = domain |> lib.removeSuffix ".${netCfg.overlay.domain}";
+                inherit (host.config.custom.networking.overlay) address;
+              }
+            )
           );
       in
-            nodeRecords ++ serviceRecords;
+      (nodeRecords ++ serviceRecords) |> lib.listToAttrs;
   };
+in
+{
+  options.custom.services.nameservers.overlay.enable = lib.mkEnableOption "";
+
+  config = lib.mkIf cfg.enable {
+    services = {
+      nsd = {
+        enable = true;
+        interfaces = [ netCfg.overlay.interface ];
+        zones.${netCfg.overlay.domain}.data = zoneData |> inputs.dns.lib.toString netCfg.overlay.domain;
       };
 
       nebula.networks.mesh.firewall.inbound = lib.singleton {
@@ -48,7 +79,7 @@ in
       };
     };
 
-    systemd.services.unbound = {
+    systemd.services.nsd = {
       requires = [ netCfg.overlay.systemdUnit ];
       after = [ netCfg.overlay.systemdUnit ];
     };

tests/infrastructure/default.nix

@@ -133,7 +133,7 @@
       client1.wait_for_unit("${client1NetCfg.overlay.systemdUnit}")
       client2.wait_for_unit("${client2NetCfg.overlay.systemdUnit}")
 
-      lighthouse.wait_for_unit("unbound.service")
+      lighthouse.wait_for_unit("nsd.service")
       lighthouse.wait_for_open_port(53, "${lighthouseNetCfg.overlay.address}")
 
       server.wait_for_unit("sshd.service")