From patchwork Sat Jan 27 12:10:41 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?S=C3=B6ren_Tempel?= X-Patchwork-Id: 59465 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id 9A71627BBE2; Sat, 27 Jan 2024 12:13:25 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-3.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL, SPF_HELO_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id 0D06B27BBE9 for ; Sat, 27 Jan 2024 12:13:22 +0000 (GMT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rThYU-00057l-FX; Sat, 27 Jan 2024 07:13:02 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rThYN-00057I-FJ for guix-patches@gnu.org; Sat, 27 Jan 2024 07:12:56 -0500 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1rThYN-0007lB-7S for guix-patches@gnu.org; Sat, 27 Jan 2024 07:12:55 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1rThYU-0002vi-0s for guix-patches@gnu.org; Sat, 27 Jan 2024 07:13:02 -0500 X-Loop: help-debbugs@gnu.org Subject: [bug#68757] [PATCH] services: dns: Add unbound service Resent-From: soeren@soeren-tempel.net Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sat, 27 Jan 2024 12:13:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 68757 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 68757@debbugs.gnu.org X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.170635752611188 (code B ref -1); Sat, 27 Jan 2024 12:13:01 +0000 Received: (at submit) by debbugs.gnu.org; 27 Jan 2024 12:12:06 +0000 Received: from localhost ([127.0.0.1]:53592 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1rThXZ-0002uN-Md for submit@debbugs.gnu.org; Sat, 27 Jan 2024 07:12:06 -0500 Received: from lists.gnu.org ([2001:470:142::17]:59416) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1rThXW-0002tk-5O for submit@debbugs.gnu.org; Sat, 27 Jan 2024 07:12:05 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rThXJ-0004tE-2b for guix-patches@gnu.org; Sat, 27 Jan 2024 07:11:49 -0500 Received: from magnesium.8pit.net ([45.76.88.171]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rThXD-0007Wh-Jg; Sat, 27 Jan 2024 07:11:47 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; s=opensmtpd; bh=bTZJRnalDt WWJSD9rIdKlZZ85mZ+7U9Fkn3soXPBmrE=; h=date:subject:to:from; d=soeren-tempel.net; b=OV1aSZDDpwKsjmfVmyEPYrDDAgbhebycDjCFrWZzS/kPG57 QrKmIS+hEHW2NhNrK8qF5WgW7LlJ6cBP0SjZIAKxlxgCsf3A0l4ffRDZ56UU+rON6bvF5P R7mb4HespRO06k0QyhdjVtsevUmks8H3rLii7OwPstq54exKV4cUWc= Received: from localhost (dynamic-2a02-3102-49da-001b-ba57-b46b-a3ed-689f.310.pool.telefonica.de [2a02:3102:49da:1b:ba57:b46b:a3ed:689f]) by magnesium.8pit.net (OpenSMTPD) with ESMTPSA id b4d280ed (TLSv1.3:TLS_AES_256_GCM_SHA384:256:YES); Sat, 27 Jan 2024 13:11:38 +0100 (CET) From: soeren@soeren-tempel.net Date: Sat, 27 Jan 2024 13:10:41 +0100 Message-ID: <20240127121040.7156-2-soeren@soeren-tempel.net> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Received-SPF: pass client-ip=45.76.88.171; envelope-from=soeren@soeren-tempel.net; helo=magnesium.8pit.net X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches From: Sören Tempel This allows using Unbound as a local DNSSEC-enabled resolver. This commit also allows configuration of the Unbound DNS resolver via a Scheme API. Conceptually, the Unbound configuration consists of several "sections" that contain key-value pairs (see unbound.conf(5)). The configuration sections are modeled in Scheme using record-type fields, where each field expects a list of pairs. A sample configuration, which uses a DoT forwarder, looks as follows: (service unbound-service-type (unbound-configuration (forward-zone '((name . ".") (forward-addr . "149.112.112.112#dns.quad9.net") (forward-addr . "2620:fe::9#dns.quad9.net") (forward-tls-upstream . yes))))) * gnu/service/dns.scm (serialize-list): New procedure. * gnu/service/dns.scm (unbound-configuration): New record. * gnu/service/dns.scm (unbound-config-file): New procedure. * gnu/service/dns.scm (unbound-shepherd-service): New procedure. * gnu/service/dns.scm (unbound-account-service): New constant. * gnu/service/dns.scm (unbound-service-type): New services. Signed-off-by: Sören Tempel --- gnu/services/dns.scm | 115 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 114 insertions(+), 1 deletion(-) diff --git a/gnu/services/dns.scm b/gnu/services/dns.scm index 6608046909..224a4d4c32 100644 --- a/gnu/services/dns.scm +++ b/gnu/services/dns.scm @@ -3,6 +3,7 @@ ;;; Copyright © 2020 Pierre Langlois ;;; Copyright © 2021 Maxime Devos ;;; Copyright © 2022 Remco van 't Veer +;;; Copyright © 2024 Sören Tempel ;;; ;;; This file is part of GNU Guix. ;;; @@ -52,7 +53,19 @@ (define-module (gnu services dns) knot-resolver-configuration dnsmasq-service-type - dnsmasq-configuration)) + dnsmasq-configuration + + unbound-service-type + unbound-configuration + unbound-configuration? + unbound-configuration-server + unbound-configuration-remote-control + unbound-configuration-forward-zone + unbound-configuration-stub-zone + unbound-configuration-auth-zone + unbound-configuration-view + unbound-configuration-python + unbound-configuration-dynlib)) ;;; ;;; Knot DNS. @@ -897,3 +910,103 @@ (define dnsmasq-service-type dnsmasq-activation))) (default-value (dnsmasq-configuration)) (description "Run the dnsmasq DNS server."))) + + +;;; +;;; Unbound. +;;; + +(define-maybe list) + +(define (serialize-list field-name lst) + ;; Ensure that strings within the unbound configuration + ;; are not enclosed in double quotes by the serialization. + (define (->string obj) + (if (string? obj) + obj + (object->string obj))) + + #~(string-append + #$(string-append (symbol->string field-name) ":\n") + #$(apply string-append + (map + (lambda (pair) + (string-append "\t" + (symbol->string (car pair)) + ": " + (->string (cdr pair)) + "\n")) + lst)))) + +(define-configuration unbound-configuration + (server + (maybe-list '((interface . "127.0.0.1") + (interface . "::1") + + ;; TLS certificate bundle for DNS over TLS. + (tls-cert-bundle . "/etc/ssl/certs/ca-certificates.crt") + + (hide-identity . yes) + (hide-version . yes))) + "The server section of the configuration.") + (remote-control + (maybe-list '((control-enable . yes) + (control-interface . "/run/unbound.sock"))) + "Configuration of the remote control facility.") + (forward-zone + maybe-list + "Configuration of nameservers to forward queries to.") + (stub-zone + maybe-list + "Configuration of stub zones.") + (auth-zone + maybe-list + "Zones for which unbound should response as an authority server.") + (view + maybe-list + "Configuration of view clauses.") + (python + maybe-list + "Configuration of the Python module.") + (dynlib + maybe-list + "Dynamic library module configuration.")) + +(define (unbound-config-file config) + (mixed-text-file "unbound.conf" + (serialize-configuration + config + unbound-configuration-fields))) + +(define (unbound-shepherd-service config) + (let ((config-file (unbound-config-file config))) + (list (shepherd-service + (documentation "Unbound daemon.") + (provision '(unbound dns)) + (requirement '(networking)) + (actions (list (shepherd-configuration-action config-file))) + (start #~(make-forkexec-constructor + (list (string-append #$unbound "/sbin/unbound") + "-d" "-p" "-c" #$config-file))) + (stop #~(make-kill-destructor)))))) + +(define unbound-account-service + (list (user-group (name "unbound") (system? #t)) + (user-account + (name "unbound") + (group "unbound") + (system? #t) + (comment "Unbound daemon user") + (home-directory "/var/empty") + (shell "/run/current-system/profile/sbin/nologin")))) + +(define unbound-service-type + (service-type (name 'unbound) + (description "Run the unbound DNS resolver.") + (extensions + (list (service-extension account-service-type + (const unbound-account-service)) + (service-extension shepherd-root-service-type + unbound-shepherd-service))) + (compose concatenate) + (default-value (unbound-configuration))))