32 lines
1.1 KiB
Nix
32 lines
1.1 KiB
Nix
{ dns, keyname, zone, zonename, ... }: { pkgs, system, ... }:
|
||
let
|
||
writeZone = dns.util.${system}.writeZone;
|
||
zoneFile = writeZone zonename zone;
|
||
in
|
||
{
|
||
systemd.services."zonesign@${zonename}" = {
|
||
description = "Signing the DNS zone '${zonename}'";
|
||
wantedBy = [ "bind.service" ];
|
||
before = [ "bind.service" ];
|
||
script = ''
|
||
set -ex
|
||
|
||
# Create the named directory if it doesn’t exist
|
||
${pkgs.coreutils}/bin/mkdir -pv /var/lib/named
|
||
|
||
# Sign the zone and write it to /var/lib/named
|
||
${pkgs.bind}/bin/dns-signzone -k /run/secrets/${keyname} -a -p -r /dev/urandom -3 $(${pkgs.coreutils}/bin/head -c 16 /dev/urandom | ${pkgs.coreutils}/bin/sha256sum | ${pkgs.coreutils}/bin/cut -b 1-32) -f /var/lib/named/${zonename} ${zoneFile}
|
||
${pkgs.bind}/bin/rndc reload ${zonename} || true
|
||
'';
|
||
};
|
||
systemd.timers."zonesign@${zonename}" = {
|
||
description = "Resign the DNS zone '${zonename}'";
|
||
timerConfig = {
|
||
Unit = "zonesign@${zonename}.service";
|
||
OnUnitInactiveSec = 86400;
|
||
RandomizedDelaySec = 3600;
|
||
};
|
||
wantedBy = [ "bind.service" ];
|
||
};
|
||
sops.secrets."${keyname}" = { };
|
||
}
|