Initial framework: reusable modules, lib, pkgs, overlays, scripts, sample environment

2026-05-10 19:06:58 +02:00
commit c53d997d07
32 changed files with 1339 additions and 0 deletions
@@ -0,0 +1,79 @@
+{ config, lib, ... }:
+
+let
+  inherit (lib) types mkOption;
+in
+
+{
+  options.services.dns = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable the Technitium DNS Server";
+    };
+
+    package = mkOption {
+      type = types.package;
+      default = null;
+      description = "Technitium DNS Server package to use. Defaults to pkgs.technitium-dns-server.";
+    };
+
+    webPort = mkOption {
+      type = types.port;
+      default = 5380;
+      description = "HTTP port for the Technitium web administration interface";
+    };
+
+    dnsPort = mkOption {
+      type = types.port;
+      default = 53;
+      description = "DNS server port (both TCP and UDP)";
+    };
+
+    recursion = mkOption {
+      type = types.enum [ "AllowOnlyForPrivateNetworks" "AllowAll" "DenyAll" ];
+      default = "AllowOnlyForPrivateNetworks";
+      description = "Recursion policy for DNS queries";
+    };
+
+    forwarders = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "Upstream DNS forwarders (e.g. [ \"1.1.1.1\" \"8.8.8.8\" ]). Empty means use root hints";
+    };
+
+    configDir = mkOption {
+      type = types.str;
+      default = "/etc/dns";
+      description = "Directory for persistent Technitium DNS configuration and zone data";
+    };
+
+    adminPasswordFile = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        Path to a file containing the admin password for the web interface.
+        If not set, the default credentials (admin/admin) are used.
+        Use agenix or sops-nix to provide this file securely.
+      '';
+    };
+
+    listenAddresses = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "IP addresses to listen on. Empty means listen on all interfaces";
+    };
+
+    allowZoneTransfer = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "IP addresses or subnets allowed to request zone transfers (AXFR/IXFR)";
+    };
+
+    extraConfig = mkOption {
+      type = types.attrsOf types.anything;
+      default = { };
+      description = "Additional Technitium DNS configuration options as an attribute set";
+    };
+  };
+}