Added fudo.org DNS config (unused) and better lib imports

config/fudo/dns.nix

@@ -5,8 +5,6 @@ with lib;
 let
   cfg = config.fudo.dns;
 
-  ip = import ../../lib/ip.nix { lib = lib; };
-
   join-lines = concatStringsSep "\n";
 
   hostOpts = { host, ...}: {
@@ -32,6 +30,7 @@ let
         description = ''
           A list of DNS SSHFP records for this host.
         '';
+        default = [];
       };
 
       description = mkOption {
@@ -83,7 +82,11 @@ let
         description = "A map of hostname to { host_attributes }.";
       };
 
-      dnssec = mkEnableOption "Enable DNSSEC security for this zone.";
+      dnssec = mkOption {
+        type = bool;
+        description = "Enable DNSSEC security for this zone.";
+        default = true;
+      };
 
       mx = mkOption {
         type = listOf str;
@@ -160,9 +163,7 @@ let
     optionalString (dmarc-email != null)
       ''_dmarc IN TXT "v=DMARC1;p=quarantine;sp=quarantine;rua=mailto:${dmarc-email};"'';
 
-  nsRecords = ns-hosts:
-    join-lines ((mapAttrsToList (host: _: "@ IN NS ${host}.") ns-hosts) ++
-                (mapAttrsToList (host: ip: "${host}. IN A ${ip}") ns-hosts));
+  nsRecords = dom: ns-hosts: join-lines (mapAttrsToList (host: _: "@ IN NS ${host}.${dom}.") ns-hosts);
 
 in {
 
@@ -170,10 +171,21 @@ in {
     enable = mkEnableOption "Enable master DNS services.";
 
     # FIXME: This should allow for AAAA addresses too...
-    dns-hosts = mkOption {
-      type = loaOf str;
+    nameservers = mkOption {
+      type = loaOf (submodule hostOpts);
       description = "Map of domain nameserver FQDNs to IP.";
-      example = { "ns1.domain.com" = "1.1.1.1"; };
+      example = {
+        "ns1.domain.com" = {
+          ip-addresses = [ "1.1.1.1" ];
+          ipv6-addresses = [];
+          description = "my fancy dns server";
+        };
+      };
+    };
+
+    identity = mkOption {
+      type = str;
+      description = "The identity (CH TXT ID.SERVER) of this host.";
     };
 
     domains = mkOption {
@@ -192,7 +204,7 @@ in {
   config = mkIf cfg.enable {
     services.nsd = {
       enable = true;
-      identity = "procul.informis.land";
+      identity = cfg.identity;
       interfaces = cfg.listen-ips;
       zones = mapAttrs' (dom: dom-cfg:
         nameValuePair "${dom}." {
@@ -215,7 +227,8 @@ in {
 
             $TTL 6h
 
-            ${nsRecords cfg.dns-hosts}
+            ${nsRecords dom cfg.nameservers}
+            ${join-lines (mapAttrsToList hostRecords cfg.nameservers)}
 
             ${dmarcRecord dom-cfg.dmarc-report-address}
 

config/fudo/local-network.nix

@@ -7,9 +7,6 @@ let
 
   join-lines = concatStringsSep "\n";
 
-  ip = import ../../lib/ip.nix { inherit lib; };
-  dns = import ../../lib/dns.nix { inherit lib; };
-
   hostOpts = { hostname, ... }: {
     options = {
       ip-address = mkOption {

config/fudo/vpn.nix

@@ -4,8 +4,6 @@ with lib;
 let
   cfg = config.fudo.vpn;
 
-  ip-util = import ../../lib/ip.nix { lib = lib; };
-
   generate-pubkey-pkg = name: privkey:
     pkgs.runCommand "wireguard-${name}-pubkey" {
       WIREGUARD_PRIVATE_KEY = privkey;
@@ -17,7 +15,7 @@ let
 
   generate-client-config = privkey-file: server-pubkey: network: server-ip: listen-port: dns-servers: ''
       [Interface]
-      Address = ${ip-util.networkMinIp network}
+      Address = ${ip.networkMinIp network}
       PrivateKey = ${fileContents privkey-file}
       ListenPort = ${toString listen-port}
       DNS = ${concatStringsSep ", " dns-servers}
@@ -86,8 +84,8 @@ in {
         name = peer.name;
         privkey-path = peer.privkey-path;
         network-range = let
-          base = ip-util.intToIpv4
-            ((ip-util.ipv4ToInt (ip-util.getNetworkBase cfg.network)) + (i * 256));
+          base = ip.intToIpv4
+            ((ip.ipv4ToInt (ip.getNetworkBase cfg.network)) + (i * 256));
         in "${base}/24";
       }) (mapAttrsToList (name: privkey-path: {
         name = name;