diff options
| -rw-r--r-- | flake.lock | 21 | ||||
| -rw-r--r-- | flake.nix | 5 | ||||
| -rw-r--r-- | modules/ddns.nix | 48 | ||||
| -rw-r--r-- | secrets/secrets.nix | 1 |
4 files changed, 55 insertions, 20 deletions
@@ -71,6 +71,26 @@ "type": "github" } }, + "ddnnss": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1787257900, + "narHash": "sha256-yiD8CAY6T57f5kjGibSlX07+bBC0zheW4AiMI4/xAaM=", + "ref": "refs/heads/main", + "rev": "309f140d38d2358cc6056ed10596024d8c8a9d66", + "revCount": 8, + "type": "git", + "url": "https://git.rnrd.eu/ddnnss" + }, + "original": { + "type": "git", + "url": "https://git.rnrd.eu/ddnnss" + } + }, "flake-compat": { "locked": { "lastModified": 1767039857, @@ -366,6 +386,7 @@ "agenix": "agenix", "cloudflare-ips-v4": "cloudflare-ips-v4", "cloudflare-ips-v6": "cloudflare-ips-v6", + "ddnnss": "ddnnss", "flake-compat": "flake-compat", "hermes-agent": "hermes-agent", "home-manager": "home-manager", @@ -44,6 +44,11 @@ url = "git+https://git.rnrd.eu/mhs35-drm"; inputs.nixpkgs.follows = "nixpkgs"; }; + + ddnnss = { + url = "git+https://git.rnrd.eu/ddnnss"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = inputs @ { self, nixpkgs, nixpkgs-unstable, home-manager, agenix, ... }: diff --git a/modules/ddns.nix b/modules/ddns.nix index 253e3e4..0253d69 100644 --- a/modules/ddns.nix +++ b/modules/ddns.nix @@ -1,34 +1,42 @@ -{ me, config, ... }: +{ me, config, ddnnss, ... }: let domain = "rnrd.eu"; in { - age.secrets.cloudflare-dns = { - file = ../secrets/cloudflare-dns.age; + imports = [ ddnnss.nixosModules.default ]; + + age.secrets.bunny-dns = { + file = ../secrets/bunny-dns.age; }; - services.ddclient = { + services.ddnnss = { enable = true; + interval = "30min"; - # Cloudflare DNS API parameters + credentials = { + bunny-dns = config.age.secrets.bunny-dns.path; + }; - # dyn.com no longer supports HTTPS :( - # See: https://github.com/ddclient/ddclient/issues/597 - usev6 = "webv6, webv6=ipv6.icanhazip.com/"; - protocol = "cloudflare"; + settings = { + records = [ + { + zone = domain; + name = me.name; + type = "AAAA"; + provider = "bunny"; + source = "icanhazip"; + } + ]; - username = "token"; - zone = domain; - domains = [ "${me.name}.${domain}" ]; - passwordFile = config.age.secrets.cloudflare-dns.path; - }; + providers.bunny = { + kind = "bunny"; + keyFile = "$CREDENTIALS_DIRECTORY/bunny-dns"; + }; - systemd.services.ddclient = { - # ddclient likes failing the whole process when - # one part of the operation did not succeed, like - # setting the A record, which i do not want anyway. - # treat these failures as a success: - serviceConfig.SuccessExitStatus = [ 0 1 ]; + sources.icanhazip = { + kind = "icanhazip"; + }; + }; }; } diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 8b3e165..c07a003 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -19,6 +19,7 @@ in ] ++ allAdmins; "cloudflare-dns.age".publicKeys = allSystems ++ allAdmins; + "bunny-dns.age".publicKeys = allSystems ++ allAdmins; "pds-secrets.age".publicKeys = [ lapin |