commit 05d6a7edb63ac387d25d96367228873c5b245eaf · pyrox.dev/nixpkgs

+23
nixos/modules/services/networking/kresd.nix
···

       46
       46
        
               What addresses the server should listen on. (UDP+TCP 53)

     

       47
       47
        
             '';

     

       48
       48
        
           };

     

       49
       49
       +
           listenTLS = mkOption {

     

       50
       50
       +
             type = with types; listOf str;

     

       51
       51
       +
             default = [];

     

       52
       52
       +
             example = [ "198.51.100.1:853" "[2001:db8::1]:853" "853" ];

     

       53
       53
       +
             description = ''

     

       54
       54
       +
               Addresses on which kresd should provide DNS over TLS (see RFC 7858).

     

       55
       55
       +
               For detailed syntax see ListenStream in man systemd.socket.

     

       56
       56
       +
             '';

     

       57
       57
       +
           };

     

       49
       58
        
           # TODO: perhaps options for more common stuff like cache size or forwarding

     

       50
       59
        
         };

     

       51
       60
        
       

     
···

       75
       84
        
             socketConfig.FreeBind = true;

     

       76
       85
        
           };

     

       77
       86
        
       

     

       87
       87
       +
           systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {

     

       88
       88
       +
             wantedBy = [ "sockets.target" ];

     

       89
       89
       +
             before = wantedBy;

     

       90
       90
       +
             partOf = [ "kresd.socket" ];

     

       91
       91
       +
             listenStreams = cfg.listenTLS;

     

       92
       92
       +
             socketConfig = {

     

       93
       93
       +
               FileDescriptorName = "tls";

     

       94
       94
       +
               FreeBind = true;

     

       95
       95
       +
               Service = "kresd.service";

     

       96
       96
       +
             };

     

       97
       97
       +
           };

     

       98
       98
       +
       

     

       78
       99
        
           systemd.sockets.kresd-control = rec {

     

       79
       100
        
             wantedBy = [ "sockets.target" ];

     

       80
       101
        
             before = wantedBy;

     
···

       97
       118
        
               Type = "notify";

     

       98
       119
        
               WorkingDirectory = cfg.cacheDir;

     

       99
       120
        
               Restart = "on-failure";

     

       121
       121
       +
               Sockets = [ "kresd.socket" "kresd-control.socket" ]

     

       122
       122
       +
                 ++ optional (cfg.listenTLS != []) "kresd-tls.socket";

     

       100
       123
        
             };

     

       101
       124
        
       

     

       102
       125
        
             # Trust anchor goes from dns-root-data by default.