host nameserver on NixOS

Author: dotlambda

flake.lock

@@ -77,6 +77,11 @@
       ref = "master";
     };
 
+    ocf-dns = {
+      url = "github:ocf/dns";
+      flake = false;
+    };
+
     ocf-sync-etc = {
       type = "github";
       owner = "ocf";
@@ -143,6 +148,7 @@
       disko,
       nix-index-database,
       ocflib,
+      ocf-dns,
       ocf-sync-etc,
       ocf-pam-trimspaces,
       ocf-utils,

flake.nix

@@ -0,0 +1,77 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.ocf.nameserver;
+
+  build-zones = pkgs.stdenv.mkDerivation {
+    name = "build-zones";
+    src = inputs.ocf-dns;
+    buildInputs = [
+      (config.ocf.python.package.withPackages (ps: [
+        ps.ldap3
+        ps.ocflib
+      ]))
+    ];
+    installPhase = ''
+      install -Dt "$out/bin" build-zones check-zones
+    '';
+    meta.mainProgram = "build-zones";
+  };
+in
+{
+  options.ocf.nameserver = {
+    enable = lib.mkEnableOption "name server";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.bind = {
+      enable = true;
+      configFile = "/srv/dns/etc/named.conf.local";
+    };
+    systemd.services.bind = {
+      after = [ "rebuild-dns-from-ldap.service" ];
+    };
+
+    systemd.services.rebuild-dns-from-ldap = {
+      after = [ "network-online.target" ];
+      path = [
+        build-zones
+        pkgs.bind
+      ];
+      script = ''
+        tmp="$(mktemp -d)"
+        cp -r ${inputs.ocf-dns} "$tmp"
+        cd "$tmp"
+        build-zones
+        check-zones
+        cp -r etc /run/dns/
+      '';
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStartPost = [
+          # + runs the command as root
+          "+${lib.getExe' pkgs.coreutils "mkdir"} -p /srv/dns/"
+          # cannot use atomic `exch` for the next two operations because /run/dns is on a different fs (bind mount)
+          "+${lib.getExe' pkgs.coreutils "rm"} -rf /srv/dns/etc"
+          "+${lib.getExe' pkgs.coreutils "mv"} /run/dns/etc /srv/dns/"
+          "+${lib.getExe' pkgs.systemd "systemctl"} reload bind.service"
+        ];
+        RuntimeDirectory = "dns";
+        Type = "oneshot";
+      };
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+    };
+
+    systemd.timers.rebuild-dns-from-ldap = {
+      timerConfig.OnCalendar = "hourly";
+      wantedBy = [ "timers.target" ];
+    };
+  };
+}