Knot - Revision history

Pilz0: correct directory example

2026-10-03T09:24:39Z

correct directory example

← Older revision		Revision as of 09:24, 3 October 2026
Line 13:		Line 13:
	/etc/nixos/		/etc/nixos/
	├─ zones/		├─ zones/
	│ ├─ example.com		│ ├─ example.com.zone
	├─ configuration.nix		├─ configuration.nix
	</syntaxhighlight>		</syntaxhighlight>

Pilz0: Add information to generate a TSIG-Key

2026-09-27T11:05:06Z

Add information to generate a TSIG-Key

← Older revision		Revision as of 11:05, 27 September 2026
Line 3:		Line 3:
	== Example ==		== Example ==
	Below is a example setup for a public authoritive DNS server setup with two hosts.		Below is a example setup for a public authoritive DNS server setup with two hosts.

			=== Generating a TSIG-Key ===
			<code>keymgr -t tsig_ns</code>

			Save this to both servers to the path in keyFiles.

	=== Example directory setup ===		=== Example directory setup ===

Pilz0: Update example directory setup

2026-09-27T10:02:36Z

Update example directory setup

← Older revision		Revision as of 10:02, 27 September 2026
Line 8:		Line 8:
	/etc/nixos/		/etc/nixos/
	├─ zones/		├─ zones/
			│ ├─ example.com
	├─ configuration.nix		├─ configuration.nix
	</syntaxhighlight>		</syntaxhighlight>

Pilz0: Add page for knot-dns

2026-09-27T10:01:39Z

Add page for knot-dns

New page

[https://www.knot-dns.cz/ Knot DNS] is a high-performance authoritative-only DNS server which supports all key features of the modern domain name system.

== Example ==
Below is a example setup for a public authoritive DNS server setup with two hosts.

=== Example directory setup ===
<syntaxhighlight>
/etc/nixos/
├─ zones/
├─ configuration.nix
</syntaxhighlight>

=== Shared config ===
{{File|name=/etc/nixos/configuration.nix|3={
environment.etc = {
"dns-zones" = {
source = ./zones;
user = "knot";
group = "knot";
};
};

services.knot = {
enable = true;
settings = {
server.listen = [
"0.0.0.0"
"::"
];
template.default = {
file = "%s.zone";
storage = "/etc/dns-zones";
};
zone = {
"example.com" = { };
};
};
# You will need to generate a TSIG-Key with keymgr (https://www.knot-dns.cz/docs/2.3/html/man_keymgr.html)
keyFiles = [
/var/secret/tsig_ns
];
};
}|lang=nixos}}

=== Primary server: ===
{{File|name=/etc/nixos/configuration.nix|3={
services.knot = {
settings = {
remote = {
remote_slave_ns = {
address = [
"192.168.1.1" # secondary server address
];
key = "tsig_ns";
};
};
log.syslog.any = "info";
acl = {
"acl_slave_ns" = {
key = "tsig_ns";
address = [
"192.168.1.1" # secondary server address
];
action = "transfer";
};
};
template.default = {
notify = [ "remote_slave_ns" ];
acl = [ "acl_slave_ns" ];
zonefile-sync = "-1";
zonefile-load = "difference";
journal-content = "changes";
};
template.local = {
zonefile-sync = "-1";
zonefile-load = "difference";
journal-content = "changes";
};
};
};|lang=nix}}

=== Secondary server ===
{{File|name=/etc/nixos/configuration.nix|3={
services.knot = {
settings = {
remote = {
master_ns1 = {
address = [
"192.168.1.2" # primary server address
];
key = "tsig_ns";
};
};
acl = {
"acl_ns1" = {
address = [
"192.168.1.2" # primary server address
];
action = "notify";
key = "tsig_ns";
};
};
template.default = {
master = [ "master_ns1" ];
acl = [ "acl_ns1" ];
};
};
};
}|lang=nixos}}

== See also ==

* https://nohup.no/posts/knot-dns-on-nixos/
* https://git.darmstadt.ccc.de/ffda/infra/nixos-config/-/tree/610ac16c150ed8b8f65ec6cd9150c2856e24d22d/config/roles/dns
* https://www.knot-dns.cz/docs/latest/html/