nixos-config/zones/signzone.nix

{
  dns,
  ksk,
  zsk,
  zone,
  zonename,
  ...
}: {
  pkgs,
  system,
  ...
}: let
  inherit (dns.util.${system}) writeZone;
  zoneFile = writeZone zonename zone;
in {
  systemd.services."zonesign@${zonename}" = {
    description = "Signing the DNS zone '${zonename}'";
    wantedBy = ["bind.service"];
    before = ["bind.service"];
    script = ''
      set -ex

      # Create the named directory if it doesn’t exist
      ${pkgs.coreutils}/bin/mkdir -pv /var/lib/named

      # Sign the zone and write it to /var/lib/named
      ${pkgs.bind}/bin/dnssec-signzone -o ${zonename} -k /run/secrets/${ksk} -a -3 $(${pkgs.coreutils}/bin/head -c 16 /dev/urandom | ${pkgs.coreutils}/bin/sha256sum | ${pkgs.coreutils}/bin/cut -b 1-32) -f /var/lib/named/${zonename} ${zoneFile} /run/secrets/${zsk}
      ${pkgs.systemd}/bin/systemctl reload bind || true
    '';
  };
  systemd.timers."zonesign@${zonename}" = {
    description = "Resign the DNS zone '${zonename}'";
    timerConfig = {
      Unit = "zonesign@${zonename}.service";
      OnUnitInactiveSec = 86400;
      RandomizedDelaySec = 3600;
    };
    wantedBy = ["bind.service"];
  };
  sops.secrets."${ksk}.key" = {};
  sops.secrets."${ksk}.private" = {};
  sops.secrets."${zsk}.key" = {};
  sops.secrets."${zsk}.private" = {};
}