Knot

Knot DNS is a high-performance authoritative-only DNS server which supports all key features of the modern domain name system.

Example

Below is a example setup for a public authoritive DNS server setup with two hosts.

Generating a TSIG-Key

keymgr -t tsig_ns

Save this to both servers to the path in keyFiles.

Example directory setup

/etc/nixos/
├─ zones/
│  ├─ example.com.zone
├─ configuration.nix

Shared config

≡︎ /etc/nixos/configuration.nix

{
  environment.etc = {
    "dns-zones" = {
      source = ./zones;
      user = "knot";
      group = "knot";
    };
  };

  services.knot = {
    enable = true;
    settings = {
      server.listen = [
        "0.0.0.0"
        "::"
      ];
      template.default = {
        file = "%s.zone";
        storage = "/etc/dns-zones";
      };
      zone = {
        "example.com" = { };
      };
    };
    # You will need to generate a TSIG-Key with keymgr (https://www.knot-dns.cz/docs/2.3/html/man_keymgr.html)
    keyFiles = [
      /var/secret/tsig_ns
    ];
  };
}

Primary server:

❄︎ /etc/nixos/configuration.nix

{
  services.knot = {
    settings = {
      remote = {
        remote_slave_ns = {
          address = [
            "192.168.1.1" # secondary server address
          ];
          key = "tsig_ns";
        };
      };
      log.syslog.any = "info";
      acl = {
        "acl_slave_ns" = {
          key = "tsig_ns";
          address = [
            "192.168.1.1" # secondary server address
          ];
          action = "transfer";
        };
      };
      template.default = {
        notify = [ "remote_slave_ns" ];
        acl = [ "acl_slave_ns" ];
        zonefile-sync = "-1";
        zonefile-load = "difference";
        journal-content = "changes";
      };
      template.local = {
        zonefile-sync = "-1";
        zonefile-load = "difference";
        journal-content = "changes";
      };
    };
  };

Secondary server

≡︎ /etc/nixos/configuration.nix

{
  services.knot = {
    settings = {
      remote = {
        master_ns1 = {
          address = [
            "192.168.1.2" # primary server address
          ];
          key = "tsig_ns";
        };
      };
      acl = {
        "acl_ns1" = {
          address = [
            "192.168.1.2" # primary server address
          ];
          action = "notify";
          key = "tsig_ns";
        };
      };
      template.default = {
        master = [ "master_ns1" ];
        acl = [ "acl_ns1" ];
      };
    };
  };
}