diff options
| author | Samuel Leathers <samuel.leathers@iohk.io> | 2018-03-17 19:05:27 -0400 |
|---|---|---|
| committer | Samuel Leathers <samuel.leathers@iohk.io> | 2018-05-02 10:30:30 -0400 |
| commit | f515ca67f5b363c2da4ac9fe2cdd9e4079203e70 (patch) | |
| tree | 1637f2cc620094215a496424542af8b785477333 | |
| parent | 78b06757c29a0b662e9463a9b4a29162fae8ef65 (diff) | |
| download | nixpkgs-f515ca67f5b363c2da4ac9fe2cdd9e4079203e70.tar nixpkgs-f515ca67f5b363c2da4ac9fe2cdd9e4079203e70.tar.gz nixpkgs-f515ca67f5b363c2da4ac9fe2cdd9e4079203e70.tar.bz2 nixpkgs-f515ca67f5b363c2da4ac9fe2cdd9e4079203e70.tar.lz nixpkgs-f515ca67f5b363c2da4ac9fe2cdd9e4079203e70.tar.xz nixpkgs-f515ca67f5b363c2da4ac9fe2cdd9e4079203e70.tar.zst nixpkgs-f515ca67f5b363c2da4ac9fe2cdd9e4079203e70.zip | |
nixos/dnsdist: initial service
| -rw-r--r-- | nixos/modules/module-list.nix | 1 | ||||
| -rw-r--r-- | nixos/modules/services/networking/dnsdist.nix | 61 |
2 files changed, 62 insertions, 0 deletions
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 505c5497d36..4110fb6443a 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -467,6 +467,7 @@ ./services/networking/dnschain.nix ./services/networking/dnscrypt-proxy.nix ./services/networking/dnscrypt-wrapper.nix + ./services/networking/dnsdist.nix ./services/networking/dnsmasq.nix ./services/networking/ejabberd.nix ./services/networking/fakeroute.nix diff --git a/nixos/modules/services/networking/dnsdist.nix b/nixos/modules/services/networking/dnsdist.nix new file mode 100644 index 00000000000..12eee136e63 --- /dev/null +++ b/nixos/modules/services/networking/dnsdist.nix @@ -0,0 +1,61 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.dnsdist; + configFile = pkgs.writeText "dndist.conf" '' + setLocal('${cfg.listenAddress}:${toString cfg.listenPort}') + ${cfg.extraConfig} + ''; +in { + options = { + services.dnsdist = { + enable = mkEnableOption "dnsdist domain name server"; + + listenAddress = mkOption { + type = types.str; + description = "Listen IP Address"; + default = "0.0.0.0"; + }; + listenPort = mkOption { + type = types.int; + description = "Listen port"; + default = 53; + }; + + extraConfig = mkOption { + type = types.lines; + default = '' + ''; + description = '' + Extra lines to be added verbatim to dnsdist.conf. + ''; + }; + }; + }; + + config = mkIf config.services.dnsdist.enable { + systemd.services.dnsdist = { + description = "dnsdist load balancer"; + wantedBy = [ "multi-user.target" ]; + after = ["network.target"]; + + serviceConfig = { + Restart="on-failure"; + RestartSec="1"; + DynamicUser = true; + StartLimitInterval="0"; + PrivateTmp=true; + PrivateDevices=true; + CapabilityBoundingSet="CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID"; + ExecStart = "${pkgs.dnsdist}/bin/dnsdist --supervised --disable-syslog --config ${configFile}"; + ProtectSystem="full"; + ProtectHome=true; + RestrictAddressFamilies="AF_UNIX AF_INET AF_INET6"; + LimitNOFILE="16384"; + TasksMax="8192"; + }; + }; + }; +} |