75 lines
1.9 KiB
Nix
75 lines
1.9 KiB
Nix
{ lib, pkgs, ... }:
|
|
let
|
|
#pdns_database = "/var/lib/powerdns/pdns.sqlite3";
|
|
#pdnsa_database = "/var/lib/powerdns-admin/pdnsa.sqlite3";
|
|
pdns_database = "pdns";
|
|
pdns_user = "pdns";
|
|
pdns_password = builtins.readFile /etc/nixos/keys/powerdns-dbpassword;
|
|
pdnsa_database = "powerdnsadmin";
|
|
pdnsa_password = builtins.readFile /etc/nixos/keys/powerdnsadmin-dbpassword;
|
|
pgsql_host = "/run/postgresql";
|
|
pdns_web_port = "8081";
|
|
pdns_api_key = builtins.readFile /etc/nixos/keys/powerdns-apikey;
|
|
in
|
|
{
|
|
services.powerdns = {
|
|
enable = true;
|
|
extraConfig = ''
|
|
launch=gpgsql
|
|
gpgsql-host=${pgsql_host}
|
|
gpgsql-dbname=${pdns_database}
|
|
gpgsql-user=${pdns_user}
|
|
gpgsql-password=${pdns_password}
|
|
webserver=yes
|
|
webserver-port=${pdns_web_port}
|
|
api=yes
|
|
api-key=${pdns_api_key}
|
|
'';
|
|
};
|
|
|
|
services.powerdns-admin = {
|
|
enable = true;
|
|
secretKeyFile = "/etc/nixos/keys/powerdns-secret";
|
|
saltFile = "/etc/nixos/keys/powerdns-salt";
|
|
extraArgs = [ "-b" "0.0.0.0:8000" ];
|
|
config = ''
|
|
SQLALCHEMY_DATABASE_URI = 'postgresql://${pdnsa_database}@/${pdnsa_database}?host=/run/postgresql'
|
|
'';
|
|
};
|
|
|
|
imports = [ ./postgresql.nix ];
|
|
|
|
services.postgresql = {
|
|
ensureDatabases = [ pdns_database pdnsa_database];
|
|
ensureUsers = [
|
|
{
|
|
name = pdns_user;
|
|
ensurePermissions = {
|
|
"DATABASE ${pdns_database}" = "ALL PRIVILEGES";
|
|
};
|
|
}
|
|
{
|
|
name = pdnsa_database;
|
|
ensurePermissions = {
|
|
"DATABASE ${pdnsa_database}" = "ALL PRIVILEGES";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
services.postgresqlBackup.databases = [
|
|
pdns_database
|
|
pdnsa_database
|
|
];
|
|
|
|
systemd.services."powerdns-admin" = {
|
|
serviceConfig = {
|
|
BindReadOnlyPaths = [ "/run/postgresql/.s.PGSQL.5432" ];
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
}
|
|
|
|
# vim: set et ts=2 sw=2 ai:
|