nixos/unbound: add enableRemoteAccess option #79559
Conversation
ofborg
bot
added
6.topic: nixos
| installPhase = '' | ||
| mkdir -p "$out/bin" | ||
| makeWrapper ${pkgs.unbound}/bin/unbound-control $out/bin/unbound-control \ | ||
| --add-flags "-c ${stateDir}/unbound.conf" | ||
| makeWrapper ${pkgs.unbound}/bin/unbound-checkconf $out/bin/unbound-checkconf \ | ||
| --add-flags "${stateDir}/unbound.conf" | ||
| ''; |
There was a problem hiding this comment.
Very nice, I was supremely annoyed with the previous behavior.
| server-key-file: ${stateDir}/unbound_server.key | ||
| server-cert-file: ${stateDir}/unbound_server.pem | ||
| control-key-file: ${stateDir}/unbound_control.key | ||
| control-cert-file: ${stateDir}/unbound_control.pem |
There was a problem hiding this comment.
Are these going to be correctly auto-gen'd when the cfg is enabled?
There was a problem hiding this comment.
There was a problem hiding this comment.
Just verified this since it was a long time since I wrote this and it works for me 👍
Option that sets remote-control setting to true in unbound.conf which in turn enables the new wrapping of unbound-control to access the server locally. Also includes options 'remoteAccessInterfaces' and 'remoteAccessPort' for remote access.
| }; | ||
|
|
||
| remoteAccessInterfaces = mkOption { | ||
| default = [ "127.0.0.1" ] ++ optional config.networking.enableIPv6 "::1"; |
There was a problem hiding this comment.
Added check for enableIPv6
|
I'd rather we went with a design as described in RFC 42 for this module. I guess we can keep the existing options and build on top of that. I'll try something and mention it here. |
| @@ -126,11 +188,12 @@ in | |||
| ''} | |||
| touch ${stateDir}/dev/random | |||
| ${pkgs.utillinux}/bin/mount --bind -n /dev/urandom ${stateDir}/dev/random | |||
| ${optionalString cfg.enableRemoteAccess "${pkgs.unbound}/bin/unbound-control-setup -d ${stateDir}"} | |||
There was a problem hiding this comment.
Honestly don't know. Saw your new PR, gj 👍. Keeping this one open til your is merged.
|
I marked this as stale due to inactivity. → More info |
stale
bot
added
the
2.status: stale
SuperSandro2000
added
the
2.status: merge conflict
stale
bot
removed
the
2.status: stale
|
Closing as #89572 is merged 🎉 |
Motivation for this change
unbound-controlwhich is installed with packageunboundwhen activating the module wasn't able to access the server because it was looking for the config file in /etc so I thought I'd make options to enable this more easily.Things done
enableRemoteAccess, an option that sets remote-control setting to true in unbound.conf127.0.0.1and::1by default. The interface + port can be altered with the other optionsremoteAccessInterfacesandremoteAccessPortfor remote access.unbound-controlandunbound-checkconfso it points to the config file instateDirinstead of the packages default configuration dir in /etcunbound-anchorsay the default dir for root key fil is under /nix/storeThoughts
I added the wrapping to systemPackages because I added
unbound-checkconfto the wrapping.I could change this to
if that's better.
I am happy for pointers and tips of course :)
Checkboxes
sandboxinnix.confon non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"./result/bin/)nix path-info -Sbefore and after)