From 641a68715f3b5d70d249deb3f9206ee86f200a6b Mon Sep 17 00:00:00 2001
From: Alex Auvolat <alex@adnab.me>
Date: Wed, 1 Jun 2022 14:46:00 +0200
Subject: [PATCH] Configure Consul DNS

---
 cluster/staging/site/neptune.nix |  3 +--
 cluster/staging/site/pluton.nix  | 10 ++++------
 nix/deuxfleurs.nix               | 26 +++++++++++++++++++++++---
 3 files changed, 28 insertions(+), 11 deletions(-)

diff --git a/cluster/staging/site/neptune.nix b/cluster/staging/site/neptune.nix
index 034c634..3a79315 100644
--- a/cluster/staging/site/neptune.nix
+++ b/cluster/staging/site/neptune.nix
@@ -5,8 +5,7 @@
   deuxfleurs.lan_default_gateway = "192.168.1.1";
   deuxfleurs.lan_ip_prefix_length = 24;
   deuxfleurs.ipv6_prefix_length = 64;
-
-  networking.nameservers = [ "192.168.1.1" ];
+  deuxfleurs.nameservers = [ "192.168.1.1" ];
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];
 
diff --git a/cluster/staging/site/pluton.nix b/cluster/staging/site/pluton.nix
index 9f972c0..570cdd8 100644
--- a/cluster/staging/site/pluton.nix
+++ b/cluster/staging/site/pluton.nix
@@ -1,13 +1,11 @@
 { config, pkgs, ... }:
 
 {
-  networking.defaultGateway = {
-    address = "192.168.0.1";
-    interface = "enp0s25";
-  };
-  networking.nameservers = [ "213.186.33.99" "172.104.136.243" ];
-
   deuxfleurs.site_name = "pluton";
+  deuxfleurs.lan_default_gateqay = "192.168.0.1";
+  deuxfleurs.lan_ip_prefix_length = 24;
+  deuxfleurs.ipv6_prefix_length = 64;
+  deuxfleurs.nameservers = [ "213.186.33.99" "172.104.136.243" ];
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];
 }
diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index d20ea5d..82bec18 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -60,6 +60,10 @@ in
       description = "Site (availability zone) on which this node is deployed";
       type = types.str;
     };
+    nameservers = mkOption {
+      description = "External DNS servers to use";
+      type = types.listOf types.str;
+    };
 
     # Parameters common to all nodes
     cluster_name = mkOption {
@@ -101,11 +105,16 @@ in
       };
     in
       (attrsets.setAttrByPath [ cfg.network_interface ] (ip4config // ip6config));
+
     networking.defaultGateway = {
       address = cfg.lan_default_gateway;
       interface = cfg.network_interface;
     };
 
+    networking.nameservers = [
+      cfg.lan_ip
+    ] ++ cfg.nameservers;
+
     # wesher overlay network
     services.wesher = {
       enable = true;
@@ -137,9 +146,17 @@ in
       ui = true;
       bind_addr = "${cfg.cluster_ip}";
 
-      ports.http = -1;
-      addresses.https = "0.0.0.0";
-      ports.https = 8501;
+      addresses = {
+        https = "0.0.0.0";
+        dns = "0.0.0.0";
+      };
+      ports = {
+        http = -1;
+        https = 8501;
+        dns = 53;
+      };
+
+      recursors = [ cfg.nameservers ];
 
       ca_file = "/var/lib/consul/pki/consul-ca.crt";
       cert_file = "/var/lib/consul/pki/consul2022.crt";
@@ -148,6 +165,9 @@ in
       verify_outgoing = true;
       verify_server_hostname = true;
     };
+    systemd.services.consul.serviceConfig = {
+      AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+    };
 
     services.nomad.enable = true;
     services.nomad.package = pkgs.nomad_1_1;