pyrox.dev
1{ config
2, lib
3, pkgs
4, ...
5}:
6
7with lib;
8
9let
10 cfg = config.services.routedns;
11 settingsFormat = pkgs.formats.toml { };
12in
13{
14 options.services.routedns = {
15 enable = mkEnableOption (lib.mdDoc "RouteDNS - DNS stub resolver, proxy and router");
16
17 settings = mkOption {
18 type = settingsFormat.type;
19 example = literalExpression ''
20 {
21 resolvers.cloudflare-dot = {
22 address = "1.1.1.1:853";
23 protocol = "dot";
24 };
25 groups.cloudflare-cached = {
26 type = "cache";
27 resolvers = ["cloudflare-dot"];
28 };
29 listeners.local-udp = {
30 address = "127.0.0.1:53";
31 protocol = "udp";
32 resolver = "cloudflare-cached";
33 };
34 listeners.local-tcp = {
35 address = "127.0.0.1:53";
36 protocol = "tcp";
37 resolver = "cloudflare-cached";
38 };
39 }
40 '';
41 description = lib.mdDoc ''
42 Configuration for RouteDNS, see <https://github.com/folbricht/routedns/blob/master/doc/configuration.md>
43 for more information.
44 '';
45 };
46
47 configFile = mkOption {
48 default = settingsFormat.generate "routedns.toml" cfg.settings;
49 defaultText = "A RouteDNS configuration file automatically generated by values from services.routedns.*";
50 type = types.path;
51 example = literalExpression ''"''${pkgs.routedns}/cmd/routedns/example-config/use-case-1.toml"'';
52 description = lib.mdDoc "Path to RouteDNS TOML configuration file.";
53 };
54
55 package = mkOption {
56 default = pkgs.routedns;
57 defaultText = literalExpression "pkgs.routedns";
58 type = types.package;
59 description = lib.mdDoc "RouteDNS package to use.";
60 };
61 };
62
63 config = mkIf cfg.enable {
64 systemd.services.routedns = {
65 description = "RouteDNS - DNS stub resolver, proxy and router";
66 after = [ "network.target" ]; # in case a bootstrap resolver is used, this might fail a few times until the respective server is actually reachable
67 wantedBy = [ "multi-user.target" ];
68 wants = [ "network.target" ];
69 startLimitIntervalSec = 30;
70 startLimitBurst = 5;
71 serviceConfig = {
72 Restart = "on-failure";
73 RestartSec = "5s";
74 LimitNPROC = 512;
75 LimitNOFILE = 1048576;
76 DynamicUser = true;
77 AmbientCapabilities = "CAP_NET_BIND_SERVICE";
78 NoNewPrivileges = true;
79 ExecStart = "${getBin cfg.package}/bin/routedns -l 4 ${cfg.configFile}";
80 };
81 };
82 };
83 meta.maintainers = with maintainers; [ jsimonetti ];
84}