Working nixops config for russell, begun migration to standard systemd service.

lib/fudo/ldap.nix

@@ -297,7 +297,7 @@ in {
           mode = "0400";
           user = "openldap";
           group = "openldap";
-	  # FIXME: take arguments!
+          # FIXME: take arguments!
           text = ''
             mech_list: gssapi external
             keytab: /etc/ldap/ldap.keytab

lib/fudo/local-network.nix

@@ -5,13 +5,12 @@ with lib;
 let
   cfg = config.fudo.local-network;
 
-  dns = import ../lib/dns.nix { inherit lib; };
-  ip = import ../lib/ip.nix { inherit lib; };
-
   join-lines = concatStringsSep "\n";
 
   traceout = out: builtins.trace out out;
 
+  fudo-lib = import ../fudo-lib.nix { inherit lib; };
+
 in {
 
   options.fudo.local-network = with types; {
@@ -103,20 +102,20 @@ in {
       interfaces = cfg.dhcp-interfaces;
 
       extraConfig = ''
-        subnet ${ip.getNetworkBase cfg.network} netmask ${
-          ip.maskFromV32Network cfg.network
+        subnet ${fudo-lib.ip.getNetworkBase cfg.network} netmask ${
+          fudo-lib.ip.maskFromV32Network cfg.network
         } {
           authoritative;
-          option subnet-mask ${ip.maskFromV32Network cfg.network};
-          option broadcast-address ${ip.networkMaxIp cfg.network};
+          option subnet-mask ${fudo-lib.ip.maskFromV32Network cfg.network};
+          option broadcast-address ${fudo-lib.ip.networkMaxIp cfg.network};
           option routers ${cfg.gateway};
           option domain-name-servers ${concatStringsSep " " cfg.dns-servers};
           option domain-name "${cfg.domain}";
           option domain-search "${
             concatStringsSep " " ([ cfg.domain ] ++ cfg.search-domains)
           }";
-          range ${ip.networkMinIp cfg.dhcp-dynamic-network} ${
-            ip.networkMaxButOneIp cfg.dhcp-dynamic-network
+          range ${fudo-lib.ip.networkMinIp cfg.dhcp-dynamic-network} ${
+            fudo-lib.ip.networkMaxButOneIp cfg.dhcp-dynamic-network
           };
         }
       '';
@@ -218,7 +217,7 @@ in {
           ${join-lines (mapAttrsToList hostSshFpRecords network.hosts)}
           ${join-lines (mapAttrsToList cnameRecord network.aliases)}
           ${join-lines network.verbatim-dns-records}
-          ${dns.srvRecordsToBindZone network.srv-records}
+          ${fudo-lib.dns.srvRecordsToBindZone network.srv-records}
         '';
       }] ++ blockZones;
     };

lib/fudo/secure-dns-proxy.nix

@@ -1,21 +1,24 @@
 { lib, pkgs, config, ... }:
 
 with lib;
-let cfg = config.fudo.secure-dns-proxy;
+let
+  cfg = config.fudo.secure-dns-proxy;
+
+  fudo-lib = import ../fudo-lib.nix { lib = lib; };
 
 in {
-  options.fudo.secure-dns-proxy = {
+  options.fudo.secure-dns-proxy = with types; {
     enable =
       mkEnableOption "Enable a DNS server using an encrypted upstream source.";
 
     listen-port = mkOption {
-      type = types.port;
+      type = port;
       description = "Port on which to listen for DNS queries.";
       default = 53;
     };
 
     upstream-dns = mkOption {
-      type = with types; listOf str;
+      type = listOf str;
       description = ''
         The upstream DNS services to use, in a format useable by dnsproxy.
 
@@ -25,37 +28,47 @@ in {
     };
 
     bootstrap-dns = mkOption {
-      type = types.str;
+      type = str;
       description =
         "A simple DNS server from which HTTPS DNS can be bootstrapped, if necessary.";
       default = "1.1.1.1";
     };
 
     listen-ips = mkOption {
-      type = with types; listOf str;
+      type = listOf str;
       description = "A list of local IP addresses on which to listen.";
       default = [ "0.0.0.0" ];
     };
+
+    allowed-networks = mkOption {
+      type = nullOr (listOf str);
+      description =
+        "List of networks with which this job is allowed to communicate.";
+      default = null;
+    };
   };
 
   config = mkIf cfg.enable {
     environment.systemPackages = with pkgs; [ dnsproxy ];
 
-    systemd.services.secure-dns-proxy = {
-      enable = true;
+    systemd.services.secure-dns-proxy = fudo-lib.system.default-service {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      description = "DNS Proxy for secure DNS lookups";
-      serviceConfig = let
+      description = "DNS Proxy for secure DNS-over-HTTPS lookups.";
+      privateNetwork = false;
+      requiredCapabilities = [ ];
+      restartWhen = "always";
+      addressFamilies = [ "AF_INET" "AF_INET6" ];
+      networkWhitelist = cfg.allowed-networks;
+
+      execStart = let
         upstreams = map (upstream: "-u ${upstream}") cfg.upstream-dns;
         upstream-line = concatStringsSep " " upstreams;
         listen-line =
           concatStringsSep " " (map (listen: "-l ${listen}") cfg.listen-ips);
-        cmd = "${pkgs.dnsproxy}/bin/dnsproxy -p ${
-            toString cfg.listen-port
-          } ${upstream-line} ${listen-line} -b ${cfg.bootstrap-dns}";
-
-      in { ExecStart = cmd; };
+      in "${pkgs.dnsproxy}/bin/dnsproxy -p ${
+        toString cfg.listen-port
+      } ${upstream-line} ${listen-line} -b ${cfg.bootstrap-dns}";
     };
   };
 }