git.iko.soy/typeable/nixpkgs
on master help sign in
Merge pull request #168535 from rnhmjoj/pr-pdns-nixos

nixos/pdns-recursor: update default values

commite674ea69563efc502c2ed323fad28c42d8a192c3 authorMichele Guerini Rocco <rnhmjoj@users.noreply.github.com> dateThu 14 Apr 2022, 18:02 (5 years ago) parent289f38abad701b
4 files changed+47−8
compare with master
unifiedsplit
nixos/doc/manual/from_md/release-notes/rl-2205.section.xml+25 nixos/doc/manual/release-notes/rl-2205.section.md+6 nixos/modules/services/networking/pdns-recursor.nix+12−7 nixos/tests/pdns-recursor.nix+4−1
nixos/doc/manual/from_md/release-notes/rl-2205.section.xml+25
@@ -479,6 +479,31 @@
479479 relying on the insecure behaviour before upgrading.
480480 </para>
481481 </listitem>
482+ <listitem>
483+ <para>
484+ In the PowerDNS Recursor module
485+ (<literal>services.pdns-recursor</literal>), default values of
486+ several IP address-related NixOS options have been updated to
487+ match the default upstream behavior. In particular, Recursor
488+ by default will:
489+ </para>
490+ <itemizedlist spacing="compact">
491+ <listitem>
492+ <para>
493+ listen on (and allows connections from) both IPv4 and IPv6
494+ addresses
495+ (<literal>services.pdns-recursor.dns.address</literal>,
496+ <literal>services.pdns-recursor.dns.allowFrom</literal>);
497+ </para>
498+ </listitem>
499+ <listitem>
500+ <para>
501+ allow only local connections to the REST API server
502+ (<literal>services.pdns-recursor.api.allowFrom</literal>).
503+ </para>
504+ </listitem>
505+ </itemizedlist>
506+ </listitem>
482507 <listitem>
483508 <para>
484509 <literal>openssh</literal> has been update to 8.9p1, changing
nixos/doc/manual/release-notes/rl-2205.section.md+6
@@ -154,6 +154,12 @@ In addition to numerous new and upgraded packages, this release has the followin
154154
155155- `services.kubernetes.scheduler.{port,address}` now set `--secure-port` and `--bind-address` instead of `--port` and `--address`, since the former have been deprecated and are no longer functional in kubernetes>=1.23. Ensure that you are not relying on the insecure behaviour before upgrading.
156156
157+- In the PowerDNS Recursor module (`services.pdns-recursor`), default values of several IP address-related NixOS options have been updated to match the default upstream behavior.
158+ In particular, Recursor by default will:
159+ - listen on (and allows connections from) both IPv4 and IPv6 addresses
160+ (`services.pdns-recursor.dns.address`, `services.pdns-recursor.dns.allowFrom`);
161+ - allow only local connections to the REST API server (`services.pdns-recursor.api.allowFrom`).
162+
157163- `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.
158164
159165- `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
nixos/modules/services/networking/pdns-recursor.nix+12−7
@@ -30,10 +30,10 @@ in {
3030 enable = mkEnableOption "PowerDNS Recursor, a recursive DNS server";
3131
3232 dns.address = mkOption {
33− type = types.str;
34− default = "0.0.0.0";
33+ type = oneOrMore types.str;
34+ default = [ "::" "0.0.0.0" ];
3535 description = ''
36− IP address Recursor DNS server will bind to.
36+ IP addresses Recursor DNS server will bind to.
3737 '';
3838 };
3939
@@ -47,8 +47,12 @@ in {
4747
4848 dns.allowFrom = mkOption {
4949 type = types.listOf types.str;
50− default = [ "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" ];
51− example = [ "0.0.0.0/0" ];
50+ default = [
51+ "127.0.0.0/8" "10.0.0.0/8" "100.64.0.0/10"
52+ "169.254.0.0/16" "192.168.0.0/16" "172.16.0.0/12"
53+ "::1/128" "fc00::/7" "fe80::/10"
54+ ];
55+ example = [ "0.0.0.0/0" "::/0" ];
5256 description = ''
5357 IP address ranges of clients allowed to make DNS queries.
5458 '';
@@ -72,7 +76,8 @@ in {
7276
7377 api.allowFrom = mkOption {
7478 type = types.listOf types.str;
75− default = [ "0.0.0.0/0" ];
79+ default = [ "127.0.0.1" "::1" ];
80+ example = [ "0.0.0.0/0" "::/0" ];
7681 description = ''
7782 IP address ranges of clients allowed to make API requests.
7883 '';
@@ -96,7 +101,7 @@ in {
96101
97102 forwardZonesRecurse = mkOption {
98103 type = types.attrs;
99− example = { eth = "127.0.0.1:5353"; };
104+ example = { eth = "[::1]:5353"; };
100105 default = {};
101106 description = ''
102107 DNS zones to be forwarded to other recursive servers.
nixos/tests/pdns-recursor.nix+4−1
@@ -1,12 +1,15 @@
11import ./make-test-python.nix ({ pkgs, ... }: {
2− name = "powerdns";
2+ name = "powerdns-recursor";
33
44 nodes.server = { ... }: {
55 services.pdns-recursor.enable = true;
6+ services.pdns-recursor.exportHosts= true;
7+ networking.hosts."192.0.2.1" = [ "example.com" ];
68 };
79
810 testScript = ''
911 server.wait_for_unit("pdns-recursor")
1012 server.wait_for_open_port("53")
13+ assert "192.0.2.1" in server.succeed("host example.com localhost")
1114 '';
1215})