Nix-dns: A Nix DSL for DNS zone files

#1

Many years ago I migrated the VPS that hosts my DNS zone from OpenVZ to KVM and switched to NixOS. When setting up nsd, I was surprised that I had to builtins.readFile my existing horrible zone instead of rewriting it in Nix. I recently had to write another zone file by hand, and that was too much, therefore:

nix-dns is a Nix library that exports types for DNS-related stuff, such as zones and records, and also provides a couple of combinators to simplify your life. I see two primary use cases:

  1. Whenever you need a zone file, instead of writing it by hand, you define it in Nix, convert to a zone, write to a file, and then use normally.
  2. One can extend existing Nix-based solutions with DNS functionality:
    • NixOps, instead of using Route 53, could generate a DNS zone from the network description and deploy a server running nsd and serving this zone.
    • NixOS modules can (optionally) configure DNS records related to them, and all these get merged automatically by the module system.

Here is a short zone just to give you a taste of it (there are more examples in the readme):

with dns.combinators {
  SOA = {
    nameServer = "ns1";
    adminEmail = "admin@example.com";
    serial = 2019030800;
  };

  NS = [
    "ns1.example.com."
    "ns2.example.com."
  ];

  CAA = letsEncrypt "admin@example.com";

  MX = mx.google;

  TXT = [ (with spf; strict [google]) ];

  A = [ "203.0.113.1" ];
  AAAA = [ "4321:0:1:2:3:4:567:89ab" ];

  subdomains = rec {
    foobar = host "203.0.113.2" "4321:0:1:2:3:4:567:89bb";

    ns1 = foobar;
    ns2 = host "203.0.113.3" "4321:0:1:2:3:4:567:89cc";
  };
}

I am considering upstreaming this into Nixpkgs, so that existing modules can use it. I see two possible approaches: 1) add a new module, such as networking.dns that will keep all zone definitions and will configure enabled dns servers accordingly; 2) integrate everything directly into DNS server modules, so that, e.g., services.nsd.zones will be able to take not only strings, but these structured zones as well. I am not sure which way to do it, and, honestly, whether it is worth it at all and whether anyone will be using it, so let me know what you think.

3 Likes