radicle-infra/os/module/iroh-dns-server.nix

{
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.services.iroh.dns;
  settingsFormat = pkgs.formats.toml {};
  configFile = settingsFormat.generate "iroh-dns-server.toml" cfg.settings;
in {
  options.services.iroh.dns = {
    enable = lib.mkEnableOption "iroh DNS Server";

    package = lib.mkPackageOption pkgs "iroh-dns-server" {};

    user = lib.mkOption {
      type = lib.types.str;
      default = "iroh";
      description = "User under which iroh-dns-server runs.";
    };

    group = lib.mkOption {
      type = lib.types.str;
      default = "iroh";
      description = "Group under which iroh-dns-server runs.";
    };

    domain = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = "dns.example.org";
      description = "Public hostname used for DNS over HTTPS.";
    };

    settings = lib.mkOption {
      type = settingsFormat.type;
      default = {};
      description = ''
        Configuration written to iroh-dns-server.toml. See the upstream
        iroh-dns-server configuration for supported values.
      '';
    };

    nginx = {
      enable = lib.mkEnableOption "nginx virtual host for iroh DNS over HTTPS";
    };
  };

  config = lib.mkIf cfg.enable (lib.mkMerge [
    {
      services.iroh.dns.settings = {
        pkarr_put_rate_limit = lib.mkDefault "smart";
        data_dir = lib.mkDefault "/var/lib/iroh-dns-server";

        http = {
          bind_addr = lib.mkDefault "::1";
          port = lib.mkDefault 8080;
        };

        dns = {
          bind_addr = lib.mkDefault "::";
          port = lib.mkDefault 53;
          default_ttl = lib.mkDefault 30;
          origins = lib.mkDefault ["."];
        };

        mainline.enabled = lib.mkDefault false;

        metrics = {
          disabled = lib.mkDefault false;
          bind_addr = lib.mkDefault "127.0.0.1:9117";
        };
      };

      users = {
        users.${cfg.user} = {
          isSystemUser = true;
          group = cfg.group;
        };

        groups.${cfg.group} = {};
      };

      systemd.services.iroh-dns-server = {
        description = "iroh DNS Server";
        wantedBy = ["multi-user.target"];
        wants = ["network-online.target"];
        after = ["network-online.target"];

        serviceConfig = {
          Type = "simple";
          ExecStart = "${lib.getExe cfg.package} --config ${configFile}";
          Restart = "on-failure";
          RestartSec = 5;

          User = cfg.user;
          Group = cfg.group;

          AmbientCapabilities = ["CAP_NET_BIND_SERVICE"];
          CapabilityBoundingSet = ["CAP_NET_BIND_SERVICE"];

          RuntimeDirectory = "iroh-dns-server";
          StateDirectory = "iroh-dns-server";

          LockPersonality = true;
          MemoryDenyWriteExecute = true;
          NoNewPrivileges = true;
          PrivateDevices = true;
          PrivateIPC = true;
          PrivateTmp = true;
          ProtectClock = true;
          ProtectControlGroups = true;
          ProtectHome = true;
          ProtectHostname = true;
          ProtectKernelLogs = true;
          ProtectKernelModules = true;
          ProtectKernelTunables = true;
          ProtectSystem = "strict";
          RemoveIPC = true;
          RestrictNamespaces = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          SystemCallArchitectures = "native";
          SystemCallErrorNumber = "EPERM";
          SystemCallFilter = ["@system-service"];

          LimitNOFILE = 65536;
        };
      };
    }

    (lib.mkIf cfg.nginx.enable {
      assertions = [
        {
          assertion = cfg.domain != null;
          message = "services.iroh.dns.domain must be set when nginx is enabled";
        }
      ];

      services.nginx.virtualHosts.${cfg.domain} = {
        enableACME = true;
        forceSSL = true;
        quic = true;
        locations."/".proxyPass = "http://[::1]:${builtins.toString cfg.settings.http.port}";
      };
    })
  ]);
}