pyrox.dev
lol
kresd service: add listenTLS option
Also fix some deficiencies in the systemd multi-socket stuff.
+23
nixos/modules/services/networking/kresd.nix
+23
nixos/modules/services/networking/kresd.nix
···
46
46
What addresses the server should listen on. (UDP+TCP 53)
47
47
'';
48
48
};
49
+
listenTLS = mkOption {
50
+
type = with types; listOf str;
51
+
default = [];
52
+
example = [ "198.51.100.1:853" "[2001:db8::1]:853" "853" ];
53
+
description = ''
54
+
Addresses on which kresd should provide DNS over TLS (see RFC 7858).
55
+
For detailed syntax see ListenStream in man systemd.socket.
56
+
'';
57
+
};
49
58
# TODO: perhaps options for more common stuff like cache size or forwarding
50
59
};
51
60
···
75
84
socketConfig.FreeBind = true;
76
85
};
77
86
87
+
systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {
88
+
wantedBy = [ "sockets.target" ];
89
+
before = wantedBy;
90
+
partOf = [ "kresd.socket" ];
91
+
listenStreams = cfg.listenTLS;
92
+
socketConfig = {
93
+
FileDescriptorName = "tls";
94
+
FreeBind = true;
95
+
Service = "kresd.service";
96
+
};
97
+
};
98
+
78
99
systemd.sockets.kresd-control = rec {
79
100
wantedBy = [ "sockets.target" ];
80
101
before = wantedBy;
···
97
118
Type = "notify";
98
119
WorkingDirectory = cfg.cacheDir;
99
120
Restart = "on-failure";
121
+
Sockets = [ "kresd.socket" "kresd-control.socket" ]
122
+
++ optional (cfg.listenTLS != []) "kresd-tls.socket";
100
123
};
101
124
102
125
# Trust anchor goes from dns-root-data by default.