gnu: Add knot-service-type.
* gnu/services/dns.scm: New file. * gnu/local.mk (GNU_SYSTEM_MODULES): Add it. * doc/guix.texi (DNS Services): New subsubsection.
This commit is contained in:
Julien Lepiller
parent
d771ba62f8
commit
ba69e8f7ce
410
doc/guix.texi
410
doc/guix.texi
|
|
@ -218,6 +218,7 @@ Services
|
|||
* Messaging Services:: Messaging services.
|
||||
* Kerberos Services:: Kerberos services.
|
||||
* Web Services:: Web servers.
|
||||
* DNS Services:: DNS daemons.
|
||||
* VPN Services:: VPN daemons.
|
||||
* Network File System:: NFS related services.
|
||||
* Continuous Integration:: The Cuirass service.
|
||||
|
|
@ -8737,6 +8738,7 @@ declaration.
|
|||
* Messaging Services:: Messaging services.
|
||||
* Kerberos Services:: Kerberos services.
|
||||
* Web Services:: Web servers.
|
||||
* DNS Services:: DNS daemons.
|
||||
* VPN Services:: VPN daemons.
|
||||
* Network File System:: NFS related services.
|
||||
* Continuous Integration:: The Cuirass service.
|
||||
|
|
@ -13520,6 +13522,414 @@ Whether the server should add its configuration to response.
|
|||
@end table
|
||||
@end deftp
|
||||
|
||||
@node DNS Services
|
||||
@subsubsection DNS Services
|
||||
@cindex DNS (domain name system)
|
||||
@cindex domain name system (DNS)
|
||||
|
||||
The @code{(gnu services dns)} module provides services related to the
|
||||
@dfn{domain name system} (DNS). It provides a server service for hosting
|
||||
an @emph{authoritative} DNS server for multiple zones, slave or master.
|
||||
This service uses @uref{https://www.knot-dns.cz/, Knot DNS}.
|
||||
|
||||
An example configuration of an authoritative server for two zones, one master
|
||||
and one slave, is:
|
||||
|
||||
@lisp
|
||||
(define-zone-entries example.org.zone
|
||||
;; Name TTL Class Type Data
|
||||
("@@" "" "IN" "A" "127.0.0.1")
|
||||
("@@" "" "IN" "NS" "ns")
|
||||
("ns" "" "IN" "A" "127.0.0.1"))
|
||||
|
||||
(define master-zone
|
||||
(knot-zone-configuration
|
||||
(domain "example.org")
|
||||
(zone (zone-file
|
||||
(origin "example.org")
|
||||
(entries example.org.zone)))))
|
||||
|
||||
(define slave-zone
|
||||
(knot-zone-configuration
|
||||
(domain "plop.org")
|
||||
(dnssec-policy "default")
|
||||
(master (list "plop-master"))))
|
||||
|
||||
(define plop-master
|
||||
(knot-remote-configuration
|
||||
(id "plop-master")
|
||||
(address (list "208.76.58.171"))))
|
||||
|
||||
(operating-system
|
||||
;; ...
|
||||
(services (cons* (service knot-service-type
|
||||
(knot-confifguration
|
||||
(remotes (list plop-master))
|
||||
(zones (list master-zone slave-zone))))
|
||||
;; ...
|
||||
%base-services)))
|
||||
@end lisp
|
||||
|
||||
@deffn {Scheme Variable} knot-service-type
|
||||
This is the type for the Knot DNS server.
|
||||
|
||||
Knot DNS is an authoritative DNS server, meaning that it can serve multiple
|
||||
zones, that is to say domain names you would buy from a registrar. This server
|
||||
is not a resolver, meaning that it can only resolve names for which it is
|
||||
authoritative. This server can be configured to serve zones as a master server
|
||||
or a slave server as a per-zone basis. Slave zones will get their data from
|
||||
masters, and will serve it as an authoritative server. From the point of view
|
||||
of a resolver, there is no difference between master and slave.
|
||||
|
||||
The following data types are used to configure the Knot DNS server:
|
||||
@end deffn
|
||||
|
||||
@deftp {Data Type} knot-key-configuration
|
||||
Data type representing a key.
|
||||
This type has the following parameters:
|
||||
|
||||
@table @asis
|
||||
@item @code{id} (default: @code{""})
|
||||
An identifier for other configuration fields to refer to this key. IDs must
|
||||
be unique and must not be empty.
|
||||
|
||||
@item @code{algorithm} (default: @code{#f})
|
||||
The algorithm to use. Choose between @code{#f}, @code{'hmac-md5},
|
||||
@code{'hmac-sha1}, @code{'hmac-sha224}, @code{'hmac-sha256}, @code{'hmac-sha384}
|
||||
and @code{'hmac-sha512}.
|
||||
|
||||
@item @code{secret} (default: @code{""})
|
||||
The secret key itself.
|
||||
|
||||
@end table
|
||||
@end deftp
|
||||
|
||||
@deftp {Data Type} knot-acl-configuration
|
||||
Data type representing an Access Control List (ACL) configuration.
|
||||
This type has the following parameters:
|
||||
|
||||
@table @asis
|
||||
@item @code{id} (default: @code{""})
|
||||
An identifier for ether configuration fields to refer to this key. IDs must be
|
||||
unique and must not be empty.
|
||||
|
||||
@item @code{address} (default: @code{'()})
|
||||
An ordered list of IP addresses, network subnets, or network ranges represented
|
||||
with strings. The query must match one of them. Empty value means that
|
||||
address match is not required.
|
||||
|
||||
@item @code{key} (default: @code{'()})
|
||||
An ordered list of references to keys represented with strings. The string
|
||||
must match a key ID defined in a @code{knot-key-configuration}. No key means
|
||||
that a key is not require to match that ACL.
|
||||
|
||||
@item @code{action} (default: @code{'()})
|
||||
An ordered list of actions that are permitted or forbidden by this ACL. Possible
|
||||
values are lists of zero or more elements from @code{'transfer}, @code{'notify}
|
||||
and @code{'update}.
|
||||
|
||||
@item @code{deny?} (default: @code{#f})
|
||||
When true, the ACL defines restrictions. Listed actions are forbidden. When
|
||||
false, listed actions are allowed.
|
||||
|
||||
@end table
|
||||
@end deftp
|
||||
|
||||
@deftp {Data Type} zone-entry
|
||||
Data type represnting a record entry in a zone file.
|
||||
This type has the following parameters:
|
||||
|
||||
@table @asis
|
||||
@item @code{name} (default: @code{"@@"})
|
||||
The name of the record. @code{"@@"} refers to the origin of the zone. Names
|
||||
are relative to the origin of the zone. For example, in the @code{example.org}
|
||||
zone, @code{"ns.example.org"} actually refers to @code{ns.example.org.example.org}.
|
||||
Names ending with a dot are absolute, which means that @code{"ns.example.org."}
|
||||
refers to @code{ns.example.org}.
|
||||
|
||||
@item @code{ttl} (default: @code{""})
|
||||
The Time-To-Live (TTL) of this record. If not set, the default TTL is used.
|
||||
|
||||
@item @code{class} (default: @code{"IN"})
|
||||
The class of the record. Knot currently supports only @code{"IN"} and
|
||||
partially @code{"CH"}.
|
||||
|
||||
@item @code{type} (default: @code{"A"})
|
||||
The type of the record. Common types include A (IPv4 address), AAAA (IPv6
|
||||
address), NS (Name Server) and MX (Mail eXchange). Many other types are
|
||||
defined.
|
||||
|
||||
@item @code{data} (default: @code{""})
|
||||
The data contained in the record. For instance an IP address associated with
|
||||
an A record, or a domain name associated with an NS record. Remember that
|
||||
domain names are relative to the origin unless they end with a dot.
|
||||
|
||||
@end table
|
||||
@end deftp
|
||||
|
||||
@deftp {Data Type} zone-file
|
||||
Data type representing the content of a zone file.
|
||||
This type has the following parameters:
|
||||
|
||||
@table @asis
|
||||
@item @code{entries} (default: @code{'()})
|
||||
The list of entries. The SOA record is taken care of, so you don't need to
|
||||
put it in the list of entries. This list should probably contain an entry
|
||||
for your primary authoritative DNS server. Other than using a list of entries
|
||||
directly, you can use @code{define-zone-entries} to define a object containing
|
||||
the list of entries more easily, that you can later pass to the @code{entries}
|
||||
field of the @code{zone-file}.
|
||||
|
||||
@item @code{origin} (default: @code{""})
|
||||
The name of your zone. This parameter cannot be empty.
|
||||
|
||||
@item @code{ns} (default: @code{"ns"})
|
||||
The domain of your primary authoritative DNS server. The name is relative to
|
||||
the origin, unless it ends with a dot. It is mandatory that this primary
|
||||
DNS server corresponds to an NS record in the zone and that it is associated
|
||||
to an IP address in the list of entries.
|
||||
|
||||
@item @code{mail} (default: @code{"hostmaster"})
|
||||
An email address people can contact you at, as the owner of the zone. This
|
||||
is translated as @code{<mail>@@<origin>}.
|
||||
|
||||
@item @code{serial} (default: @code{1})
|
||||
The serial number of the zone. As this is used to keep track of changes by
|
||||
both slaves and resolvers, it is mandatory that it @emph{never} decreases.
|
||||
Always increment it when you make a change in your zone.
|
||||
|
||||
@item @code{refresh} (default: @code{"2d"})
|
||||
The frequency at which slaves will do a zone transfer. This value can be
|
||||
a number of seconds or a number of some unit between:
|
||||
@itemize
|
||||
@item m: minute
|
||||
@item h: hour
|
||||
@item d: day
|
||||
@item w: week
|
||||
@end itemize
|
||||
|
||||
@item @code{retry} (default: @code{"15m"})
|
||||
The period after which a slave will retry to contact its master when it fails
|
||||
to do so a first time.
|
||||
|
||||
@item @code{expiry} (default: @code{"2w"})
|
||||
Default TTL of records. Existing records are considered correct for at most
|
||||
this amount of time. After this period, resolvers will invalidate their cache
|
||||
and check again that it still exists.
|
||||
|
||||
@item @code{nx} (default: @code{"1h"})
|
||||
Default TTL of inexistant records. This delay is usually short because you want
|
||||
your new domains to reach everyone quickly.
|
||||
|
||||
@end table
|
||||
@end deftp
|
||||
|
||||
@deftp {Data Type} knot-remote-configuration
|
||||
Data type representing a remote configuration.
|
||||
This type has the following parameters:
|
||||
|
||||
@table @asis
|
||||
@item @code{id} (default: @code{""})
|
||||
An identifier for other configuration fields to refer to this remote. IDs must
|
||||
be unique and must not be empty.
|
||||
|
||||
@item @code{address} (default: @code{'()})
|
||||
An ordered list of destination IP addresses. Addresses are tried in sequence.
|
||||
An optional port can be given with the @@ separator. For instance:
|
||||
@code{(list "1.2.3.4" "2.3.4.5@@53")}. Default port is 53.
|
||||
|
||||
@item @code{via} (default: @code{'()})
|
||||
An ordered list of source IP addresses. An empty list will have Knot choose
|
||||
an appropriate source IP. An optional port can be given with the @@ separator.
|
||||
The default is to choose at random.
|
||||
|
||||
@item @code{key} (default: @code{#f})
|
||||
A reference to a key, that is a string containing the identifier of a key
|
||||
defined in a @code{knot-key-configuration} field.
|
||||
|
||||
@end table
|
||||
@end deftp
|
||||
|
||||
@deftp {Data Type} knot-keystore-configuration
|
||||
Data type representing a keystore to hold dnssec keys.
|
||||
This type has the following parameters:
|
||||
|
||||
@table @asis
|
||||
@item @code{id} (default: @code{""})
|
||||
The id of the keystore. It must not be empty.
|
||||
|
||||
@item @code{backend} (default: @code{'pem})
|
||||
The backend to store the keys in. Can be @code{'pem} or @code{'pkcs11}.
|
||||
|
||||
@item @code{config} (default: @code{"/var/lib/knot/keys/keys"})
|
||||
The configuration string of the backend. An example for the PKCS#11 is:
|
||||
@code{"pkcs11:token=knot;pin-value=1234 /gnu/store/.../lib/pkcs11/libsofthsm2.so"}.
|
||||
For the pem backend, the string reprensents a path in the filesystem.
|
||||
|
||||
@end table
|
||||
@end deftp
|
||||
|
||||
@deftp {Data Type} knot-policy-configuration
|
||||
Data type representing a dnssec policy. Knot DNS is able to automatically
|
||||
sign your zones. It can either generate and manage your keys automatically or
|
||||
use keys that you generate.
|
||||
|
||||
Dnssec is usually implemented using two keys: a Key Signing Key (KSK) that is
|
||||
used to sign the second, and a Zone Signing Key (ZSK) that is used to sign the
|
||||
zone. In order to be trusted, the KSK needs to be present in the parent zone
|
||||
(usually a top-level domain). If your registrar supports dnssec, you will
|
||||
have to send them your KSK's hash so they can add a DS record in their zone.
|
||||
This is not automated and need to be done each time you change your KSK.
|
||||
|
||||
The policy also defines the lifetime of keys. Usually, ZSK can be changed
|
||||
easily and use weaker cryptographic functions (they use lower parameters) in
|
||||
order to sign records quickly, so they are changed often. The KSK however
|
||||
requires manual interaction with the registrar, so they are changed less often
|
||||
and use stronger parameters because they sign only one record.
|
||||
|
||||
This type has the following parameters:
|
||||
|
||||
@table @asis
|
||||
@item @code{id} (default: @code{""})
|
||||
The id of the policy. It must not be empty.
|
||||
|
||||
@item @code{keystore} (default: @code{"default"})
|
||||
A reference to a keystore, that is a string containing the identifier of a
|
||||
keystore defined in a @code{knot-keystore-configuration} field. The
|
||||
@code{"default"} identifier means the default keystore (a kasp database that
|
||||
was setup by this service).
|
||||
|
||||
@item @code{manual?} (default: @code{#f})
|
||||
Whether the key management is manual or automatic.
|
||||
|
||||
@item @code{single-type-signing?} (default: @code{#f})
|
||||
When @code{#t}, use the Single-Type Signing Scheme.
|
||||
|
||||
@item @code{algorithm} (default: @code{"ecdsap256sha256"})
|
||||
An algorithm of signing keys and issued signatures.
|
||||
|
||||
@item @code{ksk-size} (default: @code{256})
|
||||
The length of the KSK. Note that this value is correct for the default
|
||||
algorithm, but would be unsecure for other algorithms.
|
||||
|
||||
@item @code{zsk-size} (default: @code{256})
|
||||
The length of the ZSK. Note that this value is correct for the default
|
||||
algorithm, but would be unsecure for other algorithms.
|
||||
|
||||
@item @code{dnskey-ttl} (default: @code{'default})
|
||||
The TTL value for DNSKEY records added into zone apex. The special
|
||||
@code{'default} value means same as the zone SOA TTL.
|
||||
|
||||
@item @code{zsk-lifetime} (default: @code{"30d"})
|
||||
The period between ZSK publication and the next rollover initiation.
|
||||
|
||||
@item @code{propagation-delay} (default: @code{"1d"})
|
||||
An extra delay added for each key rollover step. This value should be high
|
||||
enough to cover propagation of data from the master server to all slaves.
|
||||
|
||||
@item @code{rrsig-lifetime} (default: @code{"14d"})
|
||||
A validity period of newly issued signatures.
|
||||
|
||||
@item @code{rrsig-refresh} (default: @code{"7d"})
|
||||
A period how long before a signature expiration the signature will be refreshed.
|
||||
|
||||
@item @code{nsec3?} (default: @code{#f})
|
||||
When @code{#t}, NSEC3 will be used instead of NSEC.
|
||||
|
||||
@item @code{nsec3-iterations} (default: @code{5})
|
||||
The number of additional times the hashing is performed.
|
||||
|
||||
@item @code{nsec3-salt-length} (default: @code{8})
|
||||
The length of a salt field in octets, which is appended to the original owner
|
||||
name before hashing.
|
||||
|
||||
@item @code{nsec3-salt-lifetime} (default: @code{"30d"})
|
||||
The validity period of newly issued salt field.
|
||||
|
||||
@end table
|
||||
@end deftp
|
||||
|
||||
@deftp {Data Type} knot-zone-configuration
|
||||
Data type representing a zone served by Knot.
|
||||
This type has the following parameters:
|
||||
|
||||
@table @asis
|
||||
@item @code{domain} (default: @code{""})
|
||||
The domain served by this configuration. It must not be empty.
|
||||
|
||||
@item @code{file} (default: @code{""})
|
||||
The file where this zone is saved. This parameter is ignored by master zones.
|
||||
Empty means default location that depends on the domain name.
|
||||
|
||||
@item @code{zone} (default: @code{(zone-file)})
|
||||
The content of the zone file. This parameter is ignored by slave zones. It
|
||||
must contain a zone-file record.
|
||||
|
||||
@item @code{master} (default: @code{'()})
|
||||
A list of master remotes. When empty, this zone is a master. When set, this
|
||||
zone is a slave. This is a list of remotes identifiers.
|
||||
|
||||
@item @code{ddns-master} (default: @code{#f})
|
||||
The main master. When empty, it defaults to the first master in the list of
|
||||
masters.
|
||||
|
||||
@item @code{notify} (default: @code{'()})
|
||||
A list of slave remote identifiers.
|
||||
|
||||
@item @code{acl} (default: @code{'()})
|
||||
A list of acl identifiers.
|
||||
|
||||
@item @code{semantic-checks?} (default: @code{#f})
|
||||
When set, this adds more semantic checks to the zone.
|
||||
|
||||
@item @code{disable-any?} (default: @code{#f})
|
||||
When set, this forbids queries of the ANY type.
|
||||
|
||||
@item @code{zonefile-sync} (default: @code{0})
|
||||
The delay between a modification in memory and on disk. 0 means immediate
|
||||
synchronization.
|
||||
|
||||
@item @code{serial-policy} (default: @code{'increment})
|
||||
A policy between @code{'increment} and @code{'unixtime}.
|
||||
|
||||
@end table
|
||||
@end deftp
|
||||
|
||||
@deftp {Data Type} knot-configuration
|
||||
Data type representing the Knot configuration.
|
||||
This type has the following parameters:
|
||||
|
||||
@table @asis
|
||||
@item @code{knot} (default: @code{knot})
|
||||
The Knot package.
|
||||
|
||||
@item @code{run-directory} (default: @code{"/var/run/knot"})
|
||||
The run directory. This directory will be used for pid file and sockets.
|
||||
|
||||
@item @code{listen-v4} (default: @code{"0.0.0.0"})
|
||||
An ip address on which to listen.
|
||||
|
||||
@item @code{listen-v6} (default: @code{"::"})
|
||||
An ip address on which to listen.
|
||||
|
||||
@item @code{listen-port} (default: @code{53})
|
||||
A port on which to listen.
|
||||
|
||||
@item @code{keys} (default: @code{'()})
|
||||
The list of knot-key-configuration used by this configuration.
|
||||
|
||||
@item @code{acls} (default: @code{'()})
|
||||
The list of knot-acl-configuration used by this configuration.
|
||||
|
||||
@item @code{remotes} (default: @code{'()})
|
||||
The list of knot-remote-configuration used by this configuration.
|
||||
|
||||
@item @code{zones} (default: @code{'()})
|
||||
The list of knot-zone-configuration used by this configuration.
|
||||
|
||||
@end table
|
||||
@end deftp
|
||||
|
||||
@node VPN Services
|
||||
@subsubsection VPN Services
|
||||
@cindex VPN (virtual private network)
|
||||
|
|
|
|||
|
|
@ -426,6 +426,7 @@ GNU_SYSTEM_MODULES = \
|
|||
%D%/services/dbus.scm \
|
||||
%D%/services/desktop.scm \
|
||||
%D%/services/dict.scm \
|
||||
%D%/services/dns.scm \
|
||||
%D%/services/kerberos.scm \
|
||||
%D%/services/lirc.scm \
|
||||
%D%/services/mail.scm \
|
||||
|
|
|
|||
|
|
@ -0,0 +1,593 @@
|
|||
;;; GNU Guix --- Functional package management for GNU
|
||||
;;; Copyright © 2017 Julien Lepiller <julien@lepiller.eu>
|
||||
;;;
|
||||
;;; This file is part of GNU Guix.
|
||||
;;;
|
||||
;;; GNU Guix is free software; you can redistribute it and/or modify it
|
||||
;;; under the terms of the GNU General Public License as published by
|
||||
;;; the Free Software Foundation; either version 3 of the License, or (at
|
||||
;;; your option) any later version.
|
||||
;;;
|
||||
;;; GNU Guix is distributed in the hope that it will be useful, but
|
||||
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
;;; GNU General Public License for more details.
|
||||
;;;
|
||||
;;; You should have received a copy of the GNU General Public License
|
||||
;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
(define-module (gnu services dns)
|
||||
#:use-module (gnu services)
|
||||
#:use-module (gnu services configuration)
|
||||
#:use-module (gnu services shepherd)
|
||||
#:use-module (gnu system shadow)
|
||||
#:use-module (gnu packages admin)
|
||||
#:use-module (gnu packages dns)
|
||||
#:use-module (guix packages)
|
||||
#:use-module (guix records)
|
||||
#:use-module (guix gexp)
|
||||
#:use-module (srfi srfi-1)
|
||||
#:use-module (srfi srfi-34)
|
||||
#:use-module (srfi srfi-35)
|
||||
#:use-module (ice-9 match)
|
||||
#:use-module (ice-9 regex)
|
||||
#:export (knot-service-type
|
||||
knot-acl-configuration
|
||||
knot-key-configuration
|
||||
knot-keystore-configuration
|
||||
knot-zone-configuration
|
||||
knot-remote-configuration
|
||||
knot-policy-configuration
|
||||
knot-configuration
|
||||
define-zone-entries
|
||||
zone-file
|
||||
zone-entry))
|
||||
|
||||
;;;
|
||||
;;; Knot DNS.
|
||||
;;;
|
||||
|
||||
(define-record-type* <knot-key-configuration>
|
||||
knot-key-configuration make-knot-key-configuration
|
||||
knot-key-configuration?
|
||||
(id knot-key-configuration-id
|
||||
(default ""))
|
||||
(algorithm knot-key-configuration-algorithm
|
||||
(default #f)); one of #f, or an algorithm name
|
||||
(secret knot-key-configuration-secret
|
||||
(default "")))
|
||||
|
||||
(define-record-type* <knot-acl-configuration>
|
||||
knot-acl-configuration make-knot-acl-configuration
|
||||
knot-acl-configuration?
|
||||
(id knot-acl-configuration-id
|
||||
(default ""))
|
||||
(address knot-acl-configuration-address
|
||||
(default '()))
|
||||
(key knot-acl-configuration-key
|
||||
(default '()))
|
||||
(action knot-acl-configuration-action
|
||||
(default '()))
|
||||
(deny? knot-acl-configuration-deny?
|
||||
(default #f)))
|
||||
|
||||
(define-record-type* <zone-entry>
|
||||
zone-entry make-zone-entry
|
||||
zone-entry?
|
||||
(name zone-entry-name
|
||||
(default "@"))
|
||||
(ttl zone-entry-ttl
|
||||
(default ""))
|
||||
(class zone-entry-class
|
||||
(default "IN"))
|
||||
(type zone-entry-type
|
||||
(default "A"))
|
||||
(data zone-entry-data
|
||||
(default "")))
|
||||
|
||||
(define-record-type* <zone-file>
|
||||
zone-file make-zone-file
|
||||
zone-file?
|
||||
(entries zone-file-entries
|
||||
(default '()))
|
||||
(origin zone-file-origin
|
||||
(default ""))
|
||||
(ns zone-file-ns
|
||||
(default "ns"))
|
||||
(mail zone-file-mail
|
||||
(default "hostmaster"))
|
||||
(serial zone-file-serial
|
||||
(default 1))
|
||||
(refresh zone-file-refresh
|
||||
(default "2d"))
|
||||
(retry zone-file-retry
|
||||
(default "15m"))
|
||||
(expiry zone-file-expiry
|
||||
(default "2w"))
|
||||
(nx zone-file-nx
|
||||
(default "1h")))
|
||||
(define-record-type* <knot-keystore-configuration>
|
||||
knot-keystore-configuration make-knot-keystore-configuration
|
||||
knot-keystore-configuration?
|
||||
(id knot-keystore-configuration-id
|
||||
(default ""))
|
||||
(backend knot-keystore-configuration-backend
|
||||
(default 'pem))
|
||||
(config knot-keystore-configuration-config
|
||||
(default "/var/lib/knot/keys/keys")))
|
||||
|
||||
(define-record-type* <knot-policy-configuration>
|
||||
knot-policy-configuration make-knot-policy-configuration
|
||||
knot-policy-configuration?
|
||||
(id knot-policy-configuration-id
|
||||
(default ""))
|
||||
(keystore knot-policy-configuration-keystore
|
||||
(default "default"))
|
||||
(manual? knot-policy-configuration-manual?
|
||||
(default #f))
|
||||
(single-type-signing? knot-policy-configuration-single-type-signing?
|
||||
(default #f))
|
||||
(algorithm knot-policy-configuration-algorithm
|
||||
(default "ecdsap256sha256"))
|
||||
(ksk-size knot-policy-configuration-ksk-size
|
||||
(default 256))
|
||||
(zsk-size knot-policy-configuration-zsk-size
|
||||
(default 256))
|
||||
(dnskey-ttl knot-policy-configuration-dnskey-ttl
|
||||
(default 'default))
|
||||
(zsk-lifetime knot-policy-configuration-zsk-lifetime
|
||||
(default "30d"))
|
||||
(propagation-delay knot-policy-configuration-propagation-delay
|
||||
(default "1d"))
|
||||
(rrsig-lifetime knot-policy-configuration-rrsig-lifetime
|
||||
(default "14d"))
|
||||
(rrsig-refresh knot-policy-configuration-rrsig-refresh
|
||||
(default "7d"))
|
||||
(nsec3? knot-policy-configuration-nsec3?
|
||||
(default #f))
|
||||
(nsec3-iterations knot-policy-configuration-nsec3-iterations
|
||||
(default 5))
|
||||
(nsec3-salt-length knot-policy-configuration-nsec3-salt-length
|
||||
(default 8))
|
||||
(nsec3-salt-lifetime knot-policy-configuration-nsec3-salt-lifetime
|
||||
(default "30d")))
|
||||
|
||||
(define-record-type* <knot-zone-configuration>
|
||||
knot-zone-configuration make-knot-zone-configuration
|
||||
knot-zone-configuration?
|
||||
(domain knot-zone-configuration-domain
|
||||
(default ""))
|
||||
(file knot-zone-configuration-file
|
||||
(default "")) ; the file where this zone is saved.
|
||||
(zone knot-zone-configuration-zone
|
||||
(default (zone-file))) ; initial content of the zone file
|
||||
(master knot-zone-configuration-master
|
||||
(default '()))
|
||||
(ddns-master knot-zone-configuration-ddns-master
|
||||
(default #f))
|
||||
(notify knot-zone-configuration-notify
|
||||
(default '()))
|
||||
(acl knot-zone-configuration-acl
|
||||
(default '()))
|
||||
(semantic-checks? knot-zone-configuration-semantic-checks?
|
||||
(default #f))
|
||||
(disable-any? knot-zone-configuration-disable-any?
|
||||
(default #f))
|
||||
(zonefile-sync knot-zone-configuration-zonefile-sync
|
||||
(default 0))
|
||||
(dnssec-policy knot-zone-configuration-dnssec-policy
|
||||
(default #f))
|
||||
(serial-policy knot-zone-configuration-serial-policy
|
||||
(default 'increment)))
|
||||
|
||||
(define-record-type* <knot-remote-configuration>
|
||||
knot-remote-configuration make-knot-remote-configuration
|
||||
knot-remote-configuration?
|
||||
(id knot-remote-configuration-id
|
||||
(default ""))
|
||||
(address knot-remote-configuration-address
|
||||
(default '()))
|
||||
(via knot-remote-configuration-via
|
||||
(default '()))
|
||||
(key knot-remote-configuration-key
|
||||
(default #f)))
|
||||
|
||||
(define-record-type* <knot-configuration>
|
||||
knot-configuration make-knot-configuration
|
||||
knot-configuration?
|
||||
(knot knot-configuration-knot
|
||||
(default knot))
|
||||
(run-directory knot-configuration-run-directory
|
||||
(default "/var/run/knot"))
|
||||
(listen-v4 knot-configuration-listen-v4
|
||||
(default "0.0.0.0"))
|
||||
(listen-v6 knot-configuration-listen-v6
|
||||
(default "::"))
|
||||
(listen-port knot-configuration-listen-port
|
||||
(default 53))
|
||||
(keys knot-configuration-keys
|
||||
(default '()))
|
||||
(keystores knot-configuration-keystores
|
||||
(default '()))
|
||||
(acls knot-configuration-acls
|
||||
(default '()))
|
||||
(remotes knot-configuration-remotes
|
||||
(default '()))
|
||||
(policies knot-configuration-policies
|
||||
(default '()))
|
||||
(zones knot-configuration-zones
|
||||
(default '())))
|
||||
|
||||
(define-syntax define-zone-entries
|
||||
(syntax-rules ()
|
||||
((_ id (name ttl class type data) ...)
|
||||
(define id (list (make-zone-entry name ttl class type data) ...)))))
|
||||
|
||||
(define (error-out msg)
|
||||
(raise (condition (&message (message msg)))))
|
||||
|
||||
(define (verify-knot-key-configuration key)
|
||||
(unless (knot-key-configuration? key)
|
||||
(error-out "keys must be a list of only knot-key-configuration."))
|
||||
(let ((id (knot-key-configuration-id key)))
|
||||
(unless (and (string? id) (not (equal? id "")))
|
||||
(error-out "key id must be a non empty string.")))
|
||||
(unless (memq '(#f hmac-md5 hmac-sha1 hmac-sha224 hmac-sha256 hmac-sha384 hmac-sha512)
|
||||
(knot-key-configuration-algorithm key))
|
||||
(error-out "algorithm must be one of: #f, 'hmac-md5, 'hmac-sha1,
|
||||
'hmac-sha224, 'hmac-sha256, 'hmac-sha384 or 'hmac-sha512")))
|
||||
|
||||
(define (verify-knot-keystore-configuration keystore)
|
||||
(unless (knot-keystore-configuration? keystore)
|
||||
(error-out "keystores must be a list of only knot-keystore-configuration."))
|
||||
(let ((id (knot-keystore-configuration-id keystore)))
|
||||
(unless (and (string? id) (not (equal? id "")))
|
||||
(error-out "keystore id must be a non empty string.")))
|
||||
(unless (memq '(pem pkcs11)
|
||||
(knot-keystore-configuration-backend keystore))
|
||||
(error-out "backend must be one of: 'pem or 'pkcs11")))
|
||||
|
||||
(define (verify-knot-policy-configuration policy)
|
||||
(unless (knot-keystore-configuration? policy)
|
||||
(error-out "policies must be a list of only knot-policy-configuration."))
|
||||
(let ((id (knot-policy-configuration-id policy)))
|
||||
(unless (and (string? id) (not (equal? id "")))
|
||||
(error-out "policy id must be a non empty string."))))
|
||||
|
||||
(define (verify-knot-acl-configuration acl)
|
||||
(unless (knot-acl-configuration? acl)
|
||||
(error-out "acls must be a list of only knot-acl-configuration."))
|
||||
(let ((id (knot-acl-configuration-id acl))
|
||||
(address (knot-acl-configuration-address acl))
|
||||
(key (knot-acl-configuration-key acl))
|
||||
(action (knot-acl-configuration-action acl)))
|
||||
(unless (and (string? id) (not (equal? id "")))
|
||||
(error-out "acl id must be a non empty string."))
|
||||
(unless (and (list? address)
|
||||
(fold (lambda (x1 x2) (and (string? x1) (string? x2))) "" address))
|
||||
(error-out "acl address must be a list of strings.")))
|
||||
(unless (boolean? (knot-acl-configuration-deny? acl))
|
||||
(error-out "deny? must be #t or #f.")))
|
||||
|
||||
(define (verify-knot-zone-configuration zone)
|
||||
(unless (knot-zone-configuration? zone)
|
||||
(error-out "zones must be a list of only knot-zone-configuration."))
|
||||
(let ((domain (knot-zone-configuration-domain zone)))
|
||||
(unless (and (string? domain) (not (equal? domain "")))
|
||||
(error-out "zone domain must be a non empty string."))))
|
||||
|
||||
(define (verify-knot-remote-configuration remote)
|
||||
(unless (knot-remote-configuration? remote)
|
||||
(error-out "remotes must be a list of only knot-remote-configuration."))
|
||||
(let ((id (knot-remote-configuration-id remote)))
|
||||
(unless (and (string? id) (not (equal? id "")))
|
||||
(error-out "remote id must be a non empty string."))))
|
||||
|
||||
(define (verify-knot-configuration config)
|
||||
(unless (package? (knot-configuration-knot config))
|
||||
(error-out "knot configuration field must be a package."))
|
||||
(unless (string? (knot-configuration-run-directory config))
|
||||
(error-out "run-directory must be a string."))
|
||||
(unless (list? (knot-configuration-keys config))
|
||||
(error-out "keys must be a list of knot-key-configuration."))
|
||||
(for-each (lambda (key) (verify-knot-key-configuration key))
|
||||
(knot-configuration-keys config))
|
||||
(unless (list? (knot-configuration-keystores config))
|
||||
(error-out "keystores must be a list of knot-keystore-configuration."))
|
||||
(for-each (lambda (keystore) (verify-knot-keystore-configuration keystore))
|
||||
(knot-configuration-keystores config))
|
||||
(unless (list? (knot-configuration-acls config))
|
||||
(error-out "acls must be a list of knot-acl-configuration."))
|
||||
(for-each (lambda (acl) (verify-knot-acl-configuration acl))
|
||||
(knot-configuration-acls config))
|
||||
(unless (list? (knot-configuration-zones config))
|
||||
(error-out "zones must be a list of knot-zone-configuration."))
|
||||
(for-each (lambda (zone) (verify-knot-zone-configuration zone))
|
||||
(knot-configuration-zones config))
|
||||
(unless (list? (knot-configuration-policies config))
|
||||
(error-out "policies must be a list of knot-policy-configuration."))
|
||||
(for-each (lambda (policy) (verify-knot-policy-configuration policy))
|
||||
(knot-configuration-policies config))
|
||||
(unless (list? (knot-configuration-remotes config))
|
||||
(error-out "remotes must be a list of knot-remote-configuration."))
|
||||
(for-each (lambda (remote) (verify-knot-remote-configuration remote))
|
||||
(knot-configuration-remotes config))
|
||||
#t)
|
||||
|
||||
(define (format-string-list l)
|
||||
"Formats a list of string in YAML"
|
||||
(if (eq? l '())
|
||||
""
|
||||
(let ((l (reverse l)))
|
||||
(string-append
|
||||
"["
|
||||
(fold (lambda (x1 x2)
|
||||
(string-append (if (symbol? x1) (symbol->string x1) x1) ", "
|
||||
(if (symbol? x2) (symbol->string x2) x2)))
|
||||
(car l) (cdr l))
|
||||
"]"))))
|
||||
|
||||
(define (knot-acl-config acls)
|
||||
(with-output-to-string
|
||||
(lambda ()
|
||||
(for-each
|
||||
(lambda (acl-config)
|
||||
(let ((id (knot-acl-configuration-id acl-config))
|
||||
(address (knot-acl-configuration-address acl-config))
|
||||
(key (knot-acl-configuration-key acl-config))
|
||||
(action (knot-acl-configuration-action acl-config))
|
||||
(deny? (knot-acl-configuration-deny? acl-config)))
|
||||
(format #t " - id: ~a\n" id)
|
||||
(unless (eq? address '())
|
||||
(format #t " address: ~a\n" (format-string-list address)))
|
||||
(unless (eq? key '())
|
||||
(format #t " key: ~a\n" (format-string-list key)))
|
||||
(unless (eq? action '())
|
||||
(format #t " action: ~a\n" (format-string-list action)))
|
||||
(format #t " deny: ~a\n" (if deny? "on" "off"))))
|
||||
acls))))
|
||||
|
||||
(define (knot-key-config keys)
|
||||
(with-output-to-string
|
||||
(lambda ()
|
||||
(for-each
|
||||
(lambda (key-config)
|
||||
(let ((id (knot-key-configuration-id key-config))
|
||||
(algorithm (knot-key-configuration-algorithm key-config))
|
||||
(secret (knot-key-configuration-secret key-config)))
|
||||
(format #t " - id: ~a\n" id)
|
||||
(if algorithm
|
||||
(format #t " algorithm: ~a\n" (symbol->string algorithm)))
|
||||
(format #t " secret: ~a\n" secret)))
|
||||
keys))))
|
||||
|
||||
(define (knot-keystore-config keystores)
|
||||
(with-output-to-string
|
||||
(lambda ()
|
||||
(for-each
|
||||
(lambda (keystore-config)
|
||||
(let ((id (knot-keystore-configuration-id keystore-config))
|
||||
(backend (knot-keystore-configuration-backend keystore-config))
|
||||
(config (knot-keystore-configuration-config keystore-config)))
|
||||
(format #t " - id: ~a\n" id)
|
||||
(format #t " backend: ~a\n" (symbol->string backend))
|
||||
(format #t " config: \"~a\"\n" config)))
|
||||
keystores))))
|
||||
|
||||
(define (knot-policy-config policies)
|
||||
(with-output-to-string
|
||||
(lambda ()
|
||||
(for-each
|
||||
(lambda (policy-config)
|
||||
(let ((id (knot-policy-configuration-id policy-config))
|
||||
(keystore (knot-policy-configuration-keystore policy-config))
|
||||
(manual? (knot-policy-configuration-manual? policy-config))
|
||||
(single-type-signing? (knot-policy-configuration-single-type-signing?
|
||||
policy-config))
|
||||
(algorithm (knot-policy-configuration-algorithm policy-config))
|
||||
(ksk-size (knot-policy-configuration-ksk-size policy-config))
|
||||
(zsk-size (knot-policy-configuration-zsk-size policy-config))
|
||||
(dnskey-ttl (knot-policy-configuration-dnskey-ttl policy-config))
|
||||
(zsk-lifetime (knot-policy-configuration-zsk-lifetime policy-config))
|
||||
(propagation-delay (knot-policy-configuration-propagation-delay
|
||||
policy-config))
|
||||
(rrsig-lifetime (knot-policy-configuration-rrsig-lifetime
|
||||
policy-config))
|
||||
(nsec3? (knot-policy-configuration-nsec3? policy-config))
|
||||
(nsec3-iterations (knot-policy-configuration-nsec3-iterations
|
||||
policy-config))
|
||||
(nsec3-salt-length (knot-policy-configuration-nsec3-salt-length
|
||||
policy-config))
|
||||
(nsec3-salt-lifetime (knot-policy-configuration-nsec3-salt-lifetime
|
||||
policy-config)))
|
||||
(format #t " - id: ~a\n" id)
|
||||
(format #t " keystore: ~a\n" keystore)
|
||||
(format #t " manual: ~a\n" (if manual? "on" "off"))
|
||||
(format #t " single-type-signing: ~a\n" (if single-type-signing?
|
||||
"on" "off"))
|
||||
(format #t " algorithm: ~a\n" algorithm)
|
||||
(format #t " ksk-size: ~a\n" (number->string ksk-size))
|
||||
(format #t " zsk-size: ~a\n" (number->string zsk-size))
|
||||
(unless (eq? dnskey-ttl 'default)
|
||||
(format #t " dnskey-ttl: ~a\n" dnskey-ttl))
|
||||
(format #t " zsk-lifetime: ~a\n" zsk-lifetime)
|
||||
(format #t " propagation-delay: ~a\n" propagation-delay)
|
||||
(format #t " rrsig-lifetime: ~a\n" rrsig-lifetime)
|
||||
(format #t " nsec3: ~a\n" (if nsec3? "on" "off"))
|
||||
(format #t " nsec3-iterations: ~a\n"
|
||||
(number->string nsec3-iterations))
|
||||
(format #t " nsec3-salt-length: ~a\n"
|
||||
(number->string nsec3-salt-length))
|
||||
(format #t " nsec3-salt-lifetime: ~a\n" nsec3-salt-lifetime)))
|
||||
policies))))
|
||||
|
||||
(define (knot-remote-config remotes)
|
||||
(with-output-to-string
|
||||
(lambda ()
|
||||
(for-each
|
||||
(lambda (remote-config)
|
||||
(let ((id (knot-remote-configuration-id remote-config))
|
||||
(address (knot-remote-configuration-address remote-config))
|
||||
(via (knot-remote-configuration-via remote-config))
|
||||
(key (knot-remote-configuration-key remote-config)))
|
||||
(format #t " - id: ~a\n" id)
|
||||
(unless (eq? address '())
|
||||
(format #t " address: ~a\n" (format-string-list address)))
|
||||
(unless (eq? via '())
|
||||
(format #t " via: ~a\n" (format-string-list via)))
|
||||
(if key
|
||||
(format #t " key: ~a\n" key))))
|
||||
remotes))))
|
||||
|
||||
(define (serialize-zone-entries entries)
|
||||
(with-output-to-string
|
||||
(lambda ()
|
||||
(for-each
|
||||
(lambda (entry)
|
||||
(let ((name (zone-entry-name entry))
|
||||
(ttl (zone-entry-ttl entry))
|
||||
(class (zone-entry-class entry))
|
||||
(type (zone-entry-type entry))
|
||||
(data (zone-entry-data entry)))
|
||||
(format #t "~a ~a ~a ~a ~a\n" name ttl class type data)))
|
||||
entries))))
|
||||
|
||||
(define (serialize-zone-file zone domain)
|
||||
(computed-file (string-append domain ".zone")
|
||||
#~(begin
|
||||
(call-with-output-file #$output
|
||||
(lambda (port)
|
||||
(format port "$ORIGIN ~a.\n"
|
||||
#$(zone-file-origin zone))
|
||||
(format port "@ IN SOA ~a ~a (~a ~a ~a ~a ~a)\n"
|
||||
#$(zone-file-ns zone)
|
||||
#$(zone-file-mail zone)
|
||||
#$(zone-file-serial zone)
|
||||
#$(zone-file-refresh zone)
|
||||
#$(zone-file-retry zone)
|
||||
#$(zone-file-expiry zone)
|
||||
#$(zone-file-nx zone))
|
||||
(format port "~a\n"
|
||||
#$(serialize-zone-entries (zone-file-entries zone))))))))
|
||||
|
||||
(define (knot-zone-config zone)
|
||||
(let ((content (knot-zone-configuration-zone zone)))
|
||||
#~(with-output-to-string
|
||||
(lambda ()
|
||||
(let ((domain #$(knot-zone-configuration-domain zone))
|
||||
(file #$(knot-zone-configuration-file zone))
|
||||
(master (list #$@(knot-zone-configuration-master zone)))
|
||||
(ddns-master #$(knot-zone-configuration-ddns-master zone))
|
||||
(notify (list #$@(knot-zone-configuration-notify zone)))
|
||||
(acl (list #$@(knot-zone-configuration-acl zone)))
|
||||
(semantic-checks? #$(knot-zone-configuration-semantic-checks? zone))
|
||||
(disable-any? #$(knot-zone-configuration-disable-any? zone))
|
||||
(dnssec-policy #$(knot-zone-configuration-dnssec-policy zone))
|
||||
(serial-policy '#$(knot-zone-configuration-serial-policy zone)))
|
||||
(format #t " - domain: ~a\n" domain)
|
||||
(if (eq? master '())
|
||||
;; This server is a master
|
||||
(if (equal? file "")
|
||||
(format #t " file: ~a\n"
|
||||
#$(serialize-zone-file content
|
||||
(knot-zone-configuration-domain zone)))
|
||||
(format #t " file: ~a\n" file))
|
||||
;; This server is a slave (has masters)
|
||||
(begin
|
||||
(format #t " master: ~a\n"
|
||||
#$(format-string-list
|
||||
(knot-zone-configuration-master zone)))
|
||||
(if ddns-master (format #t " ddns-master ~a\n" ddns-master))))
|
||||
(unless (eq? notify '())
|
||||
(format #t " notify: ~a\n"
|
||||
#$(format-string-list
|
||||
(knot-zone-configuration-notify zone))))
|
||||
(unless (eq? acl '())
|
||||
(format #t " acl: ~a\n"
|
||||
#$(format-string-list
|
||||
(knot-zone-configuration-acl zone))))
|
||||
(format #t " semantic-checks: ~a\n" (if semantic-checks? "on" "off"))
|
||||
(format #t " disable-any: ~a\n" (if disable-any? "on" "off"))
|
||||
(if dnssec-policy
|
||||
(begin
|
||||
(format #t " dnssec-signing: on\n")
|
||||
(format #t " dnssec-policy: ~a\n" dnssec-policy)))
|
||||
(format #t " serial-policy: ~a\n"
|
||||
(symbol->string serial-policy)))))))
|
||||
|
||||
(define (knot-config-file config)
|
||||
(verify-knot-configuration config)
|
||||
(computed-file "knot.conf"
|
||||
#~(begin
|
||||
(call-with-output-file #$output
|
||||
(lambda (port)
|
||||
(format port "server:\n")
|
||||
(format port " rundir: ~a\n" #$(knot-configuration-run-directory config))
|
||||
(format port " user: knot\n")
|
||||
(format port " listen: ~a@~a\n"
|
||||
#$(knot-configuration-listen-v4 config)
|
||||
#$(knot-configuration-listen-port config))
|
||||
(format port " listen: ~a@~a\n"
|
||||
#$(knot-configuration-listen-v6 config)
|
||||
#$(knot-configuration-listen-port config))
|
||||
(format port "\nkey:\n")
|
||||
(format port #$(knot-key-config (knot-configuration-keys config)))
|
||||
(format port "\nkeystore:\n")
|
||||
(format port #$(knot-keystore-config (knot-configuration-keystores config)))
|
||||
(format port "\nacl:\n")
|
||||
(format port #$(knot-acl-config (knot-configuration-acls config)))
|
||||
(format port "\nremote:\n")
|
||||
(format port #$(knot-remote-config (knot-configuration-remotes config)))
|
||||
(format port "\npolicy:\n")
|
||||
(format port #$(knot-policy-config (knot-configuration-policies config)))
|
||||
(unless #$(eq? (knot-configuration-zones config) '())
|
||||
(format port "\nzone:\n")
|
||||
(format port "~a\n"
|
||||
(string-concatenate
|
||||
(list #$@(map knot-zone-config
|
||||
(knot-configuration-zones config)))))))))))
|
||||
|
||||
(define %knot-accounts
|
||||
(list (user-group (name "knot") (system? #t))
|
||||
(user-account
|
||||
(name "knot")
|
||||
(group "knot")
|
||||
(system? #t)
|
||||
(comment "knot dns server user")
|
||||
(home-directory "/var/empty")
|
||||
(shell (file-append shadow "/sbin/nologin")))))
|
||||
|
||||
(define (knot-activation config)
|
||||
#~(begin
|
||||
(use-modules (guix build utils))
|
||||
(define (mkdir-p/perms directory owner perms)
|
||||
(mkdir-p directory)
|
||||
(chown directory (passwd:uid owner) (passwd:gid owner))
|
||||
(chmod directory perms))
|
||||
(mkdir-p/perms #$(knot-configuration-run-directory config)
|
||||
(getpwnam "knot") #o755)
|
||||
(mkdir-p/perms "/var/lib/knot" (getpwnam "knot") #o755)
|
||||
(mkdir-p/perms "/var/lib/knot/keys" (getpwnam "knot") #o755)
|
||||
(mkdir-p/perms "/var/lib/knot/keys/keys" (getpwnam "knot") #o755)))
|
||||
|
||||
(define (knot-shepherd-service config)
|
||||
(let* ((config-file (knot-config-file config))
|
||||
(knot (knot-configuration-knot config)))
|
||||
(list (shepherd-service
|
||||
(documentation "Run the Knot DNS daemon.")
|
||||
(provision '(knot dns))
|
||||
(requirement '(networking))
|
||||
(start #~(make-forkexec-constructor
|
||||
(list (string-append #$knot "/sbin/knotd")
|
||||
"-c" #$config-file)))
|
||||
(stop #~(make-kill-destructor))))))
|
||||
|
||||
(define knot-service-type
|
||||
(service-type (name 'knot)
|
||||
(extensions
|
||||
(list (service-extension shepherd-root-service-type
|
||||
knot-shepherd-service)
|
||||
(service-extension activation-service-type
|
||||
knot-activation)
|
||||
(service-extension account-service-type
|
||||
(const %knot-accounts))))))
|
||||
Loading…
Reference in New Issue