talexander/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

nixos/nebula: add DNS options

Browse Source 
Add the options:

- lighthouse.serve_dns
- lighthouse.dns.host
- lighthouse.dns.port

Improve systemd capabilities handling:

- do not give CAP_NET_ADMIN when tunnel interface is disabled
- give CAP_NET_BIND_SERVICE when DNS is enabled

Add self as maintainer: I'm using Nebula on NixOS in prod.

Signed-off-by: Sirio Balmelli <sirio@b-ad.ch>
This commit is contained in:
Sirio Balmelli 2025-03-06 10:56:52 +01:00
parent 08ed55e60a
commit 40567b6b8d
No known key found for this signature in database
GPG Key ID: 0437A96EFE4C426E
1 changed files with 45 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
nixos/modules/services/networking/nebula.nix
View File

@ -84,6 +84,28 @@ in
description = "Whether this node is a relay.";
};
lighthouse.dns.enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether this lighthouse node should serve DNS.";
};
lighthouse.dns.host = lib.mkOption {
type = lib.types.str;
default = "localhost";
description = ''
IP address on which nebula lighthouse should serve DNS.
'localhost' is a good default to ensure the service does not listen on public interfaces;
use a Nebula address like 10.0.0.5 to make DNS resolution available to nebula hosts only.
'';
};
lighthouse.dns.port = lib.mkOption {
type = lib.types.nullOr lib.types.port;
default = 5353;
description = "UDP port number for lighthouse DNS server.";
};
lighthouses = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
@ -172,10 +194,7 @@ in
'';
example = lib.literalExpression ''
{
lighthouse.dns = {
host = "0.0.0.0";
port = 53;
};
lighthouse.interval = 15;
}
'';
};
@ -203,6 +222,9 @@ in
lighthouse = {
am_lighthouse = netCfg.isLighthouse;
hosts = netCfg.lighthouses;
serve_dns = netCfg.lighthouse.dns.enable;
dns.host = netCfg.lighthouse.dns.host;
dns.port = netCfg.lighthouse.dns.port;
};
relay = {
am_relay = netCfg.isRelay;
@ -231,6 +253,19 @@ in
''
settings
);
capabilities =
let
nebulaPort = if !settings.tun.disabled then settings.listen.port else 0;
dnsPort = if settings.lighthouse.serve_dns then settings.lighthouse.dns.port else 0;
in
lib.concatStringsSep " " (
# creation of tunnel interfaces
lib.optional (!settings.tun.disabled) "CAP_NET_ADMIN"
# binding to privileged ports
++ lib.optional (
nebulaPort > 0 && nebulaPort < 1024 || dnsPort > 0 && dnsPort < 1024
) "CAP_NET_BIND_SERVICE"
);
in
{
# Create the systemd service for Nebula.
@ -248,8 +283,8 @@ in
Restart = "always";
ExecStart = "${netCfg.package}/bin/nebula -config ${configFile}";
UMask = "0027";
CapabilityBoundingSet = "CAP_NET_ADMIN";
AmbientCapabilities = "CAP_NET_ADMIN";
CapabilityBoundingSet = capabilities;
AmbientCapabilities = capabilities;
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = false; # needs access to /dev/net/tun (below)
@ -302,5 +337,8 @@ in
);
};
meta.maintainers = with lib.maintainers; [ numinit ];
meta.maintainers = with lib.maintainers; [
numinit
siriobalmelli
];
}