···

       
506
       
 
       
      </listitem>

     

       
507
       
 
       
      <listitem>

     

       
508
       
 
       
        <para>

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
509
       
 
       
          <literal>openssh</literal> has been update to 8.9p1, changing

     

       
510
       
 
       
          the FIDO security key middleware interface.

     

       
511
       
 
       
        </para>

     

···

       
506
       
 
       
      </listitem>

     

       
507
       
 
       
      <listitem>

     

       
508
       
 
       
        <para>

     

       
509
       
+
       
          In the ncdns module, the default value of

     

       
510
       
+
       
          <literal>services.ncdns.address</literal> has been changed to

     

       
511
       
+
       
          the IPv6 loopback address (<literal>::1</literal>).

     

       
512
       
+
       
        </para>

     

       
513
       
+
       
      </listitem>

     

       
514
       
+
       
      <listitem>

     

       
515
       
+
       
        <para>

     

       
516
       
 
       
          <literal>openssh</literal> has been update to 8.9p1, changing

     

       
517
       
 
       
          the FIDO security key middleware interface.

     

       
518
       
 
       
        </para>

     

···

       
160
       
 
       
      (`services.pdns-recursor.dns.address`, `services.pdns-recursor.dns.allowFrom`);

     

       
161
       
 
       
    - allow only local connections to the REST API server (`services.pdns-recursor.api.allowFrom`).

     

       
162
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
163
       
 
       
- `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.

     

       
164
       
 
       


     

       
165
       
 
       
- `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.

     

···

       
160
       
 
       
      (`services.pdns-recursor.dns.address`, `services.pdns-recursor.dns.allowFrom`);

     

       
161
       
 
       
    - allow only local connections to the REST API server (`services.pdns-recursor.api.allowFrom`).

     

       
162
       
 
       


     

       
163
       
+
       
- In the ncdns module, the default value of `services.ncdns.address` has been changed to the IPv6 loopback address (`::1`).

     

       
164
       
+
       


     

       
165
       
 
       
- `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.

     

       
166
       
 
       


     

       
167
       
 
       
- `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.

     

···

       
58
       
 
       


     

       
59
       
 
       
      address = mkOption {

     

       
60
       
 
       
        type = types.str;

     

       
61
       
-
       
        default = "127.0.0.1";

     

       
62
       
 
       
        description = ''

     

       
63
       
 
       
          The IP address the ncdns resolver will bind to.  Leave this unchanged

     

       
64
       
 
       
          if you do not wish to directly expose the resolver.

     
···

       
202
       
 
       
  config = mkIf cfg.enable {

     

       
203
       
 
       


     

       
204
       
 
       
    services.pdns-recursor = mkIf cfgs.pdns-recursor.resolveNamecoin {

     

       
205
       
-
       
      forwardZonesRecurse.bit = "127.0.0.1:${toString cfg.port}";

     

       
206
       
 
       
      luaConfig =

     

       
207
       
 
       
        if cfg.dnssec.enable

     

       
208
       
 
       
          then ''readTrustAnchorsFromFile("${cfg.dnssec.keys.public}")''

     

···

       
58
       
 
       


     

       
59
       
 
       
      address = mkOption {

     

       
60
       
 
       
        type = types.str;

     

       
61
       
+
       
        default = "[::1]";

     

       
62
       
 
       
        description = ''

     

       
63
       
 
       
          The IP address the ncdns resolver will bind to.  Leave this unchanged

     

       
64
       
 
       
          if you do not wish to directly expose the resolver.

     
···

       
202
       
 
       
  config = mkIf cfg.enable {

     

       
203
       
 
       


     

       
204
       
 
       
    services.pdns-recursor = mkIf cfgs.pdns-recursor.resolveNamecoin {

     

       
205
       
+
       
      forwardZonesRecurse.bit = "${cfg.address}:${toString cfg.port}";

     

       
206
       
 
       
      luaConfig =

     

       
207
       
 
       
        if cfg.dnssec.enable

     

       
208
       
 
       
          then ''readTrustAnchorsFromFile("${cfg.dnssec.keys.public}")''

     

···

       
29
       
 
       
  };

     

       
30
       
 
       


     

       
31
       
 
       
  nodes.server = { ... }: {

     

       
32
       
-
       
    networking.nameservers = [ "127.0.0.1" ];

     

       
33
       
 
       


     

       
34
       
 
       
    services.namecoind.rpc = {

     

       
35
       
-
       
      address = "127.0.0.1";

     

       
36
       
 
       
      user = "namecoin";

     

       
37
       
 
       
      password = "secret";

     

       
38
       
 
       
      port = 8332;

     
···

       
45
       
 
       
      script = ''

     

       
46
       
 
       
        while true; do

     

       
47
       
 
       
          echo -e "HTTP/1.1 200 OK\n\n $(<${fakeReply})\n" \

     

       
48
       
-
       
            | ${pkgs.netcat}/bin/nc -N -l 127.0.0.1 8332

     

       
49
       
 
       
        done

     

       
50
       
 
       
      '';

     

       
51
       
 
       
    };

     
···

       
58
       
 
       
      identity.address    = "1.0.0.1";

     

       
59
       
 
       
    };

     

       
60
       
 
       


     

       
61
       
-
       
    services.pdns-recursor = {

     

       
62
       
-
       
      enable = true;

     

       
63
       
-
       
      dns.allowFrom = [ "127.0.0.0/8" ];

     

       
64
       
-
       
      resolveNamecoin = true;

     

       
65
       
-
       
    };

     

       
66
       
 
       


     

       
67
       
 
       
    environment.systemPackages = [ pkgs.dnsutils ];

     

       
68
       
-
       


     

       
69
       
 
       
  };

     

       
70
       
 
       


     

       
71
       
 
       
  testScript =

     
···

       
91
       
 
       
          assert "example.com" in server.succeed("dig SOA @localhost -p 5333 bit")

     

       
92
       
 
       


     

       
93
       
 
       
      with subtest("bit. zone forwarding works"):

     

       
0
       
 
       

     

       
94
       
 
       
          assert "1.2.3.4" in server.succeed("host test.bit")

     

       
95
       
 
       
    '';

     

       
96
       
 
       
})

     

···

       
29
       
 
       
  };

     

       
30
       
 
       


     

       
31
       
 
       
  nodes.server = { ... }: {

     

       
32
       
+
       
    networking.nameservers = [ "::1" ];

     

       
33
       
 
       


     

       
34
       
 
       
    services.namecoind.rpc = {

     

       
35
       
+
       
      address = "::1";

     

       
36
       
 
       
      user = "namecoin";

     

       
37
       
 
       
      password = "secret";

     

       
38
       
 
       
      port = 8332;

     
···

       
45
       
 
       
      script = ''

     

       
46
       
 
       
        while true; do

     

       
47
       
 
       
          echo -e "HTTP/1.1 200 OK\n\n $(<${fakeReply})\n" \

     

       
48
       
+
       
            | ${pkgs.netcat}/bin/nc -N -l ::1 8332

     

       
49
       
 
       
        done

     

       
50
       
 
       
      '';

     

       
51
       
 
       
    };

     
···

       
58
       
 
       
      identity.address    = "1.0.0.1";

     

       
59
       
 
       
    };

     

       
60
       
 
       


     

       
61
       
+
       
    services.pdns-recursor.enable = true;

     

       
62
       
+
       
    services.pdns-recursor.resolveNamecoin = true;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
63
       
 
       


     

       
64
       
 
       
    environment.systemPackages = [ pkgs.dnsutils ];

     

       
0
       
 
       

     

       
65
       
 
       
  };

     

       
66
       
 
       


     

       
67
       
 
       
  testScript =

     
···

       
87
       
 
       
          assert "example.com" in server.succeed("dig SOA @localhost -p 5333 bit")

     

       
88
       
 
       


     

       
89
       
 
       
      with subtest("bit. zone forwarding works"):

     

       
90
       
+
       
          server.wait_for_unit("pdns-recursor")

     

       
91
       
 
       
          assert "1.2.3.4" in server.succeed("host test.bit")

     

       
92
       
 
       
    '';

     

       
93
       
 
       
})