radicle-infra/os/host/network/iris/iroh.nix

{
  imports = [
    ../../../module/iroh-dns-server.nix
    ../../../module/iroh-relay.nix
  ];

  networking.firewall = {
    allowedTCPPorts = [
      53 # dns-server
    ];
    allowedUDPPorts = [
      53 # dns-server
      7824 # relay
    ];
  };

  services.iroh = {
    relay = {
      enable = true;
      domain = "1.eu.relay.iroh.radicle.network";
      nginx.enable = true;
    };

    dns = {
      enable = true;
      domain = "1.eu.dns.iroh.radicle.network";
      nginx.enable = true;

      settings = {
        http.port = 8053;
        dns = {
          port = 53;
          bind_addr = "::";
          default_soa = ". team.radicle.network. 0 10800 3600 604800 3600";
          origins = ["."];
        };
      };
    };
  };
}