pyrox.dev
1# /etc files related to networking, such as /etc/services.
2{
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9
10 cfg = config.networking.resolvconf;
11
12 resolvconfOptions =
13 cfg.extraOptions
14 ++ lib.optional cfg.dnsSingleRequest "single-request"
15 ++ lib.optional cfg.dnsExtensionMechanism "edns0"
16 ++ lib.optional cfg.useLocalResolver "trust-ad";
17
18 configText = ''
19 # This is the default, but we must set it here to prevent
20 # a collision with an apparently unrelated environment
21 # variable with the same name exported by dhcpcd.
22 interface_order='lo lo[0-9]*'
23 ''
24 + lib.optionalString config.services.nscd.enable ''
25 # Invalidate the nscd cache whenever resolv.conf is
26 # regenerated.
27 libc_restart='/run/current-system/systemd/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
28 ''
29 + lib.optionalString (lib.length resolvconfOptions > 0) ''
30 # Options as described in resolv.conf(5)
31 resolv_conf_options='${lib.concatStringsSep " " resolvconfOptions}'
32 ''
33 + lib.optionalString cfg.useLocalResolver ''
34 # This hosts runs a full-blown DNS resolver.
35 name_servers='127.0.0.1${lib.optionalString config.networking.enableIPv6 " ::1"}'
36 ''
37 + cfg.extraConfig;
38
39in
40
41{
42 imports = [
43 (lib.mkRenamedOptionModule
44 [ "networking" "dnsSingleRequest" ]
45 [ "networking" "resolvconf" "dnsSingleRequest" ]
46 )
47 (lib.mkRenamedOptionModule
48 [ "networking" "dnsExtensionMechanism" ]
49 [ "networking" "resolvconf" "dnsExtensionMechanism" ]
50 )
51 (lib.mkRenamedOptionModule
52 [ "networking" "extraResolvconfConf" ]
53 [ "networking" "resolvconf" "extraConfig" ]
54 )
55 (lib.mkRenamedOptionModule
56 [ "networking" "resolvconfOptions" ]
57 [ "networking" "resolvconf" "extraOptions" ]
58 )
59 (lib.mkRemovedOptionModule [
60 "networking"
61 "resolvconf"
62 "useHostResolvConf"
63 ] "This option was never used for anything anyways")
64 ];
65
66 options = {
67
68 networking.resolvconf = {
69
70 enable = lib.mkOption {
71 type = lib.types.bool;
72 default = !(config.environment.etc ? "resolv.conf");
73 defaultText = lib.literalExpression ''!(config.environment.etc ? "resolv.conf")'';
74 description = ''
75 Whether DNS configuration is managed by resolvconf.
76 '';
77 };
78
79 package = lib.mkOption {
80 type = lib.types.package;
81 default = pkgs.openresolv;
82 defaultText = lib.literalExpression "pkgs.openresolv";
83 description = ''
84 The package that provides the system-wide resolvconf command. Defaults to `openresolv`
85 if this module is enabled. Otherwise, can be used by other modules (for example {option}`services.resolved`) to
86 provide a compatibility layer.
87
88 This option generally shouldn't be set by the user.
89 '';
90 };
91
92 dnsSingleRequest = lib.mkOption {
93 type = lib.types.bool;
94 default = false;
95 description = ''
96 Recent versions of glibc will issue both ipv4 (A) and ipv6 (AAAA)
97 address queries at the same time, from the same port. Sometimes upstream
98 routers will systemically drop the ipv4 queries. The symptom of this problem is
99 that 'getent hosts example.com' only returns ipv6 (or perhaps only ipv4) addresses. The
100 workaround for this is to specify the option 'single-request' in
101 /etc/resolv.conf. This option enables that.
102 '';
103 };
104
105 dnsExtensionMechanism = lib.mkOption {
106 type = lib.types.bool;
107 default = true;
108 description = ''
109 Enable the `edns0` option in {file}`resolv.conf`. With
110 that option set, `glibc` supports use of the extension mechanisms for
111 DNS (EDNS) specified in RFC 2671. The most popular user of that feature is DNSSEC,
112 which does not work without it.
113 '';
114 };
115
116 extraConfig = lib.mkOption {
117 type = lib.types.lines;
118 default = "";
119 example = "libc=NO";
120 description = ''
121 Extra configuration to append to {file}`resolvconf.conf`.
122 '';
123 };
124
125 extraOptions = lib.mkOption {
126 type = lib.types.listOf lib.types.str;
127 default = [ ];
128 example = [
129 "ndots:1"
130 "rotate"
131 ];
132 description = ''
133 Set the options in {file}`/etc/resolv.conf`.
134 '';
135 };
136
137 useLocalResolver = lib.mkOption {
138 type = lib.types.bool;
139 default = false;
140 description = ''
141 Use local DNS server for resolving.
142 '';
143 };
144
145 subscriberFiles = lib.mkOption {
146 type = lib.types.listOf lib.types.path;
147 default = [ ];
148 description = ''
149 Files written by resolvconf updates
150 '';
151 internal = true;
152 };
153
154 };
155
156 };
157
158 config = lib.mkMerge [
159 {
160 environment.etc."resolvconf.conf".text =
161 if !cfg.enable then
162 # Force-stop any attempts to use resolvconf
163 ''
164 echo "resolvconf is disabled on this system but was used anyway:" >&2
165 echo "$0 $*" >&2
166 exit 1
167 ''
168 else
169 configText;
170 }
171
172 (lib.mkIf cfg.enable {
173 users.groups.resolvconf = { };
174
175 networking.resolvconf.subscriberFiles = [ "/etc/resolv.conf" ];
176
177 environment.systemPackages = [ cfg.package ];
178
179 systemd.services.resolvconf = {
180 description = "resolvconf update";
181
182 before = [ "network-pre.target" ];
183 wants = [ "network-pre.target" ];
184 wantedBy = [ "multi-user.target" ];
185 restartTriggers = [ config.environment.etc."resolvconf.conf".source ];
186 serviceConfig.Type = "oneshot";
187 serviceConfig.RemainAfterExit = true;
188
189 script = ''
190 ${lib.getExe cfg.package} -u
191 chgrp resolvconf ${lib.escapeShellArgs cfg.subscriberFiles}
192 chmod g=u ${lib.escapeShellArgs cfg.subscriberFiles}
193 ${lib.getExe' pkgs.acl "setfacl"} -R \
194 -m group:resolvconf:rwx \
195 -m default:group:resolvconf:rwx \
196 /run/resolvconf
197 '';
198 };
199
200 })
201 ];
202
203}