Unverified Commit 40567b6b authored by Sirio Balmelli's avatar Sirio Balmelli
Browse files

nixos/nebula: add DNS options 



Add the options:

- lighthouse.serve_dns
- lighthouse.dns.host
- lighthouse.dns.port

Improve systemd capabilities handling:

- do not give CAP_NET_ADMIN when tunnel interface is disabled
- give CAP_NET_BIND_SERVICE when DNS is enabled

Add self as maintainer: I'm using Nebula on NixOS in prod.

Signed-off-by: default avatarSirio Balmelli <sirio@b-ad.ch>
parent 08ed55e6

nixos/modules/services/networking/nebula.nix

+45 −7
Original line number Diff line number Diff line
@@ -84,6 +84,28 @@ in 
                description = "Whether this node is a relay.";

              };



              lighthouse.dns.enable = lib.mkOption {

                type = lib.types.bool;

                default = false;

                description = "Whether this lighthouse node should serve DNS.";

              };



              lighthouse.dns.host = lib.mkOption {

                type = lib.types.str;

                default = "localhost";

                description = ''

                  IP address on which nebula lighthouse should serve DNS.

                  'localhost' is a good default to ensure the service does not listen on public interfaces;

                  use a Nebula address like 10.0.0.5 to make DNS resolution available to nebula hosts only.

                '';

              };



              lighthouse.dns.port = lib.mkOption {

                type = lib.types.nullOr lib.types.port;

                default = 5353;

                description = "UDP port number for lighthouse DNS server.";

              };



              lighthouses = lib.mkOption {

                type = lib.types.listOf lib.types.str;

                default = [ ];
@@ -172,10 +194,7 @@ in 
                '';

                example = lib.literalExpression ''

                  {

                    lighthouse.dns = {

                      host = "0.0.0.0";

                      port = 53;

                    };

                    lighthouse.interval = 15;

                  }

                '';

              };
@@ -203,6 +222,9 @@ in 
            lighthouse = {

              am_lighthouse = netCfg.isLighthouse;

              hosts = netCfg.lighthouses;

              serve_dns = netCfg.lighthouse.dns.enable;

              dns.host = netCfg.lighthouse.dns.host;

              dns.port = netCfg.lighthouse.dns.port;

            };

            relay = {

              am_relay = netCfg.isRelay;
@@ -231,6 +253,19 @@ in 
              ''

              settings

          );

          capabilities =

            let

              nebulaPort = if !settings.tun.disabled then settings.listen.port else 0;

              dnsPort = if settings.lighthouse.serve_dns then settings.lighthouse.dns.port else 0;

            in

            lib.concatStringsSep " " (

              # creation of tunnel interfaces

              lib.optional (!settings.tun.disabled) "CAP_NET_ADMIN"

              # binding to privileged ports

              ++ lib.optional (

                nebulaPort > 0 && nebulaPort < 1024 || dnsPort > 0 && dnsPort < 1024

              ) "CAP_NET_BIND_SERVICE"

            );

        in

        {

          # Create the systemd service for Nebula.
@@ -248,8 +283,8 @@ in 
              Restart = "always";

              ExecStart = "${netCfg.package}/bin/nebula -config ${configFile}";

              UMask = "0027";

              CapabilityBoundingSet = "CAP_NET_ADMIN";

              AmbientCapabilities = "CAP_NET_ADMIN";

              CapabilityBoundingSet = capabilities;

              AmbientCapabilities = capabilities;

              LockPersonality = true;

              NoNewPrivileges = true;

              PrivateDevices = false; # needs access to /dev/net/tun (below)
@@ -302,5 +337,8 @@ in 
    );

  };



  meta.maintainers = with lib.maintainers; [ numinit ];

  meta.maintainers = with lib.maintainers; [

    numinit

    siriobalmelli

  ];

}