Use my own DDNS service 'ddnnss' instead of deprecated ddclient

Signed-off-by: Mel <mel@rnrd.eu>

4 files changed, 55 insertions, 20 deletions

diff --git a/flake.lock b/flake.lock
index 963c1d2..8ed7f33 100644
--- a/flake.lock
+++ b/flake.lock
@@ -71,6 +71,26 @@
         "type": "github"
       }
     },
+    "ddnnss": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1787257900,
+        "narHash": "sha256-yiD8CAY6T57f5kjGibSlX07+bBC0zheW4AiMI4/xAaM=",
+        "ref": "refs/heads/main",
+        "rev": "309f140d38d2358cc6056ed10596024d8c8a9d66",
+        "revCount": 8,
+        "type": "git",
+        "url": "https://git.rnrd.eu/ddnnss"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.rnrd.eu/ddnnss"
+      }
+    },
     "flake-compat": {
       "locked": {
         "lastModified": 1767039857,
@@ -366,6 +386,7 @@
         "agenix": "agenix",
         "cloudflare-ips-v4": "cloudflare-ips-v4",
         "cloudflare-ips-v6": "cloudflare-ips-v6",
+        "ddnnss": "ddnnss",
         "flake-compat": "flake-compat",
         "hermes-agent": "hermes-agent",
         "home-manager": "home-manager",
diff --git a/flake.nix b/flake.nix
index c5489eb..528b413 100644
--- a/flake.nix
+++ b/flake.nix
@@ -44,6 +44,11 @@
       url = "git+https://git.rnrd.eu/mhs35-drm";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    ddnnss = {
+      url = "git+https://git.rnrd.eu/ddnnss";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = inputs @ { self, nixpkgs, nixpkgs-unstable, home-manager, agenix, ... }:
diff --git a/modules/ddns.nix b/modules/ddns.nix
index 253e3e4..0253d69 100644
--- a/modules/ddns.nix
+++ b/modules/ddns.nix
@@ -1,34 +1,42 @@
-{ me, config, ... }:
+{ me, config, ddnnss, ... }:
 
 let
   domain = "rnrd.eu";
 in
 {
-  age.secrets.cloudflare-dns = {
-    file = ../secrets/cloudflare-dns.age;
+  imports = [ ddnnss.nixosModules.default ];
+
+  age.secrets.bunny-dns = {
+    file = ../secrets/bunny-dns.age;
   };
 
-  services.ddclient = {
+  services.ddnnss = {
     enable = true;
+    interval = "30min";
 
-    # Cloudflare DNS API parameters
+    credentials = {
+      bunny-dns = config.age.secrets.bunny-dns.path;
+    };
 
-    # dyn.com no longer supports HTTPS :(
-    # See: https://github.com/ddclient/ddclient/issues/597
-    usev6 = "webv6, webv6=ipv6.icanhazip.com/";
-    protocol = "cloudflare";
+    settings = {
+      records = [
+        {
+          zone = domain;
+          name = me.name;
+          type = "AAAA";
+          provider = "bunny";
+          source = "icanhazip";
+        }
+      ];
 
-    username = "token";
-    zone = domain;
-    domains = [ "${me.name}.${domain}" ];
-    passwordFile = config.age.secrets.cloudflare-dns.path;
-  };
+      providers.bunny = {
+        kind = "bunny";
+        keyFile = "$CREDENTIALS_DIRECTORY/bunny-dns";
+      };
 
-  systemd.services.ddclient = {
-    # ddclient likes failing the whole process when
-    # one part of the operation did not succeed, like
-    # setting the A record, which i do not want anyway.
-    # treat these failures as a success:
-    serviceConfig.SuccessExitStatus = [ 0 1 ];
+      sources.icanhazip = {
+        kind = "icanhazip";
+      };
+    };
   };
 }
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 8b3e165..c07a003 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -19,6 +19,7 @@ in
   ] ++ allAdmins;
 
   "cloudflare-dns.age".publicKeys = allSystems ++ allAdmins;
+  "bunny-dns.age".publicKeys = allSystems ++ allAdmins;
 
   "pds-secrets.age".publicKeys = [
     lapin