diff options
| -rw-r--r-- | nixos/modules/services/networking/kresd.nix | 12 | ||||
| -rw-r--r-- | pkgs/servers/dns/knot-resolver/default.nix | 12 |
2 files changed, 14 insertions, 10 deletions
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix index ccb34163d5f3..6f1c4c48b430 100644 --- a/nixos/modules/services/networking/kresd.nix +++ b/nixos/modules/services/networking/kresd.nix @@ -23,18 +23,14 @@ let ''; configFile = pkgs.writeText "kresd.conf" ( - optionalString (cfg.listenDoH != []) '' - modules.load('http') - '' + "" + concatMapStrings (mkListen "dns") cfg.listenPlain + concatMapStrings (mkListen "tls") cfg.listenTLS - + concatMapStrings (mkListen "doh") cfg.listenDoH + + concatMapStrings (mkListen "doh2") cfg.listenDoH + cfg.extraConfig ); - package = if cfg.listenDoH == [] - then pkgs.knot-resolver # never force `extraFeatures = false` - else pkgs.knot-resolver.override { extraFeatures = true; }; + package = pkgs.knot-resolver; in { meta.maintainers = [ maintainers.vcunat /* upstream developer */ ]; @@ -92,7 +88,7 @@ in { default = []; example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ]; description = '' - Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 8484). + Addresses and ports on which kresd should provide DNS over HTTPS/2 (see RFC 8484). For detailed syntax see ListenStream in man systemd.socket. ''; }; diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix index aabfcd9796e4..f88772bda0bc 100644 --- a/pkgs/servers/dns/knot-resolver/default.nix +++ b/pkgs/servers/dns/knot-resolver/default.nix @@ -3,6 +3,7 @@ , runCommand, pkgconfig, meson, ninja, makeWrapper # build+runtime deps. , knot-dns, luajitPackages, libuv, gnutls, lmdb, systemd, dns-root-data +, nghttp2, libcap_ng # optionals, in principle # test-only deps. , cmocka, which, cacert , extraFeatures ? false /* catch-all if defaults aren't enough */ @@ -11,7 +12,7 @@ let # un-indented, over the whole file result = if extraFeatures then wrapped-full else unwrapped; -inherit (stdenv.lib) optional optionals; +inherit (stdenv.lib) optional optionals optionalString; lua = luajitPackages; unwrapped = stdenv.mkDerivation rec { @@ -38,6 +39,11 @@ unwrapped = stdenv.mkDerivation rec { # ExecStart can't be overwritten in overrides. # We need that to use wrapped executable and correct config file. sed '/^ExecStart=/d' -i systemd/kresd@.service.in + '' + # some tests have issues with network sandboxing, apparently + + optionalString doInstallCheck '' + echo 'os.exit(77)' > daemon/lua/trust_anchors.test/bootstrap.test.lua + sed '/^[[:blank:]]*test_dstaddr,$/d' -i tests/config/doh2.test.lua ''; preConfigure = '' @@ -49,6 +55,7 @@ unwrapped = stdenv.mkDerivation rec { # http://knot-resolver.readthedocs.io/en/latest/build.html#requirements buildInputs = [ knot-dns lua.lua libuv gnutls lmdb ] ++ optional stdenv.isLinux systemd # passing sockets, sd_notify + ++ [ nghttp2 libcap_ng ] ## optional dependencies; TODO: libedit, dnstap ; @@ -67,11 +74,12 @@ unwrapped = stdenv.mkDerivation rec { postInstall = '' rm "$out"/lib/libkres.a rm "$out"/lib/knot-resolver/upgrade-4-to-5.lua # not meaningful on NixOS + '' + optionalString stdenv.targetPlatform.isLinux '' rm -r "$out"/lib/sysusers.d/ # ATM more likely to harm than help ''; doInstallCheck = with stdenv; hostPlatform == buildPlatform; - installCheckInputs = [ cmocka which cacert lua.cqueues lua.basexx ]; + installCheckInputs = [ cmocka which cacert lua.cqueues lua.basexx lua.http ]; installCheckPhase = '' meson test --print-errorlogs ''; |