1 files changed, 149 insertions, 0 deletions
diff --git a/modules/dns.nix b/modules/dns.nix
new file mode 100644
index 0000000..ea284e3
--- /dev/null
+++ b/modules/dns.nix
@@ -0,0 +1,149 @@
+{ pkgs, ... }:
+
+let
+  serial = "2026100201";
+
+  public = {
+    hamano = "x.x.x.x";
+    lee = "x.x.x.x";
+    knuth = "x.x.x.x";
+    unused = "x.x.x.x";
+  };
+
+  tailnet = import ../tailnet.nix;
+
+  tailnetRecords = builtins.concatStringsSep "\n" (
+    builtins.map (name: "${name}.i IN A ${tailnet.${name}}") (builtins.attrNames tailnet)
+  );
+
+  mafiaSecondaries = [
+    "45.8.201.122"
+    "45.8.201.114"
+    "158.101.112.125"
+  ];
+
+  publicNameservers = ''
+    @ IN NS ns1.gae.moe.
+    @ IN NS ns1.inx.moe.
+    @ IN NS denise.charbroil.me.
+    @ IN NS ns1.shad.moe.
+  '';
+
+  mkPrimaryZone =
+    {
+      domain,
+      address,
+      extraRecords ? "",
+    }:
+    pkgs.writeText "zone-${domain}" ''
+      $ORIGIN ${domain}.
+      $TTL 300
+
+      @ IN SOA ns1.gae.moe. hostmaster.gae.moe. (
+        ${serial}
+        1h
+        15m
+        1w
+        5m
+      )
+
+      ${publicNameservers}
+
+      @ IN A ${address}
+      * IN A ${address}
+
+      ${extraRecords}
+    '';
+
+  mkSecondary =
+    master: zones:
+    builtins.listToAttrs (
+      map (zone: {
+        name = zone;
+        value = {
+          master = false;
+          masters = [ master ];
+          file = zone;
+        };
+      }) zones
+    );
+
+  mafiaZones =
+    mkSecondary "45.8.201.122" [
+      "inx.moe"
+      "doge-inc.net"
+      "foxy.software"
+      "swedish.fish"
+      "unreliable.email"
+      "funmafia.industries"
+      "vulcan.moe"
+    ]
+    // mkSecondary "45.8.201.114" [
+      "charbroil.me"
+      "puppy.observer"
+      "bdsm.equipment"
+      "ilovehewlettpackard.com"
+    ]
+    // mkSecondary "158.101.112.125" [
+      "shad.moe"
+      "konpeki.solutions"
+      "konpekisolutions.com"
+    ];
+
+in
+{
+  services.bind = {
+    enable = true;
+
+    cacheNetworks = [
+      "127.0.0.0/8"
+      "::1/128"
+      "100.64.0.0/10"
+    ];
+
+    zones = {
+      "gae.moe" = {
+        master = true;
+        slaves = mafiaSecondaries;
+
+        # Potentially could use DNAME forwarding while defining a Quad100 forwarder?
+        # https://github.com/tailscale/tailscale/issues/1543#issuecomment-4703759447
+        file = mkPrimaryZone {
+          domain = "gae.moe";
+          address = public.hamano;
+          extraRecords = ''
+            ns1 IN A ${public.hamano}
+
+            ${tailnetRecords}
+          '';
+        };
+      };
+
+      "grace.pink" = {
+        master = true;
+        slaves = mafiaSecondaries;
+
+        file = mkPrimaryZone {
+          domain = "grace.pink";
+          address = public.lee;
+        };
+      };
+
+      "words.gay" = {
+        master = true;
+        slaves = mafiaSecondaries;
+
+        file = mkPrimaryZone {
+          domain = "words.gay";
+          address = public.unused;
+        };
+      };
+    }
+    // mafiaZones;
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 ];
+  };
+}