blob: 8249da69bc1a800b348b546f7b9bc4c763911a48 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.dnsdist;
configFile = pkgs.writeText "dndist.conf" ''
setLocal('${cfg.listenAddress}:${toString cfg.listenPort}')
${cfg.extraConfig}
'';
in {
options = {
services.dnsdist = {
enable = mkEnableOption "dnsdist domain name server";
listenAddress = mkOption {
type = types.str;
description = "Listen IP Address";
default = "0.0.0.0";
};
listenPort = mkOption {
type = types.int;
description = "Listen port";
default = 53;
};
extraConfig = mkOption {
type = types.lines;
default = ''
'';
description = ''
Extra lines to be added verbatim to dnsdist.conf.
'';
};
};
};
config = mkIf config.services.dnsdist.enable {
systemd.services.dnsdist = {
description = "dnsdist load balancer";
wantedBy = [ "multi-user.target" ];
after = ["network.target"];
serviceConfig = {
Restart="on-failure";
RestartSec="1";
DynamicUser = true;
StartLimitInterval="0";
PrivateDevices=true;
AmbientCapabilities="CAP_NET_BIND_SERVICE";
CapabilityBoundingSet="CAP_NET_BIND_SERVICE";
ExecStart = "${pkgs.dnsdist}/bin/dnsdist --supervised --disable-syslog --config ${configFile}";
ProtectHome=true;
RestrictAddressFamilies="AF_UNIX AF_INET AF_INET6";
LimitNOFILE="16384";
TasksMax="8192";
};
};
};
}
|