Skip to content

Commit eebd349

Browse files
rnhmjojrnhmjoj
authored
nixos/pdns-recursor: deprecate settings, add yaml-settings (#406534)
2 parents ddade58 + ab8653a commit eebd349

File tree

4 files changed

+130
-49
lines changed

4 files changed

+130
-49
lines changed

‎nixos/doc/manual/release-notes/rl-2505.section.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,13 @@ Alongside many enhancements to NixOS modules and general system improvements, th
273273
[not recommended by upstream](https://docs.nextcloud.com/server/30/admin_manual/installation/system_requirements.html)
274274
and thus doesn't qualify as default.
275275

276+
- PowerDNS Recursor has been updated to version 5.1.2, which comes with a new YAML configuration format (`recursor.yml`)
277+
and deprecates the previous format (`recursor.conf`). Accordingly, the NixOS option `services.pdns-recursor.settings`
278+
has been renamed to [old-settings](#opt-services.pdns-recursor.old-settings) and will be provided for backward compatibility
279+
until the next NixOS release. Users are asked to migrate their settings to the new [yaml-settings](#opt-services.pdns-recursor.old-settings)
280+
option following this [guide](https://doc.powerdns.com/recursor/appendices/yamlconversion.html).
281+
Note that options other than `services.pdns-recursor.settings` are unaffacted by this change.
282+
276283
- Nextcloud's default FPM pool settings have been increased according to upstream recommentations. It's advised
277284
to review the new defaults and description of
278285
[](#opt-services.nextcloud.poolSettings).

‎nixos/modules/services/networking/pdns-recursor.nix‎

Lines changed: 102 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,34 @@ let
3838
else
3939
"";
4040

41-
configDir = pkgs.writeTextDir "recursor.conf" (
42-
concatStringsSep "\n" (flip mapAttrsToList cfg.settings (name: val: "${name}=${serialize val}"))
43-
);
41+
settingsFormat = pkgs.formats.yaml { };
4442

4543
mkDefaultAttrs = mapAttrs (n: v: mkDefault v);
4644

45+
mkForwardZone = mapAttrsToList (
46+
zone: uri: {
47+
inherit zone;
48+
forwarders = [ uri ];
49+
}
50+
);
51+
52+
configFile =
53+
if cfg.old-settings != { } then
54+
# Convert recursor.conf to recursor.yml and merge it
55+
let
56+
conf = pkgs.writeText "recursor.conf" (
57+
concatStringsSep "\n" (mapAttrsToList (name: val: "${name}=${serialize val}") cfg.old-settings)
58+
);
59+
60+
yaml = settingsFormat.generate "recursor.yml" cfg.yaml-settings;
61+
in
62+
pkgs.runCommand "recursor-merged.yml" { } ''
63+
${pkgs.pdns-recursor}/bin/rec_control show-yaml --config ${conf} > override.yml
64+
${pkgs.yq-go}/bin/yq '. *= load("override.yml")' ${yaml} > $out
65+
''
66+
else
67+
settingsFormat.generate "recursor.yml" cfg.yaml-settings;
68+
4769
in
4870
{
4971
options.services.pdns-recursor = {
@@ -175,7 +197,7 @@ in
175197
'';
176198
};
177199

178-
settings = mkOption {
200+
old-settings = mkOption {
179201
type = configType;
180202
default = { };
181203
example = literalExpression ''
@@ -184,11 +206,34 @@ in
184206
log-common-errors = true;
185207
}
186208
'';
209+
description = ''
210+
Older PowerDNS Recursor settings. Use this option to configure
211+
Recursor settings not exposed in a NixOS option or to bypass one.
212+
See the full documentation at
213+
<https://doc.powerdns.com/recursor/settings.html>
214+
for the available options.
215+
216+
::: {.warning}
217+
This option is provided for backward compatibility only
218+
and will be removed in the next release of NixOS.
219+
:::
220+
'';
221+
};
222+
223+
yaml-settings = mkOption {
224+
type = settingsFormat.type;
225+
default = { };
226+
example = literalExpression ''
227+
{
228+
loglevel = 8;
229+
log-common-errors = true;
230+
}
231+
'';
187232
description = ''
188233
PowerDNS Recursor settings. Use this option to configure Recursor
189234
settings not exposed in a NixOS option or to bypass one.
190235
See the full documentation at
191-
<https://doc.powerdns.com/recursor/settings.html>
236+
<https://doc.powerdns.com/recursor/yamlsettings.html>
192237
for the available options.
193238
'';
194239
};
@@ -205,42 +250,44 @@ in
205250

206251
config = mkIf cfg.enable {
207252

208-
environment.etc."pdns-recursor".source = configDir;
253+
environment.etc."/pdns-recursor/recursor.yml".source = configFile;
209254

210-
services.pdns-recursor.settings = mkDefaultAttrs {
211-
local-address = cfg.dns.address;
212-
local-port = cfg.dns.port;
213-
allow-from = cfg.dns.allowFrom;
255+
services.pdns-recursor.yaml-settings = {
256+
incoming = mkDefaultAttrs {
257+
listen = cfg.dns.address;
258+
port = cfg.dns.port;
259+
allow_from = cfg.dns.allowFrom;
260+
};
261+
262+
webservice = mkDefaultAttrs {
263+
address = cfg.api.address;
264+
port = cfg.api.port;
265+
allow_from = cfg.api.allowFrom;
266+
};
214267

215-
webserver-address = cfg.api.address;
216-
webserver-port = cfg.api.port;
217-
webserver-allow-from = cfg.api.allowFrom;
268+
recursor = mkDefaultAttrs {
269+
forward_zones = mkForwardZone cfg.forwardZones;
270+
forward_zones_recurse = mkForwardZone cfg.forwardZonesRecurse;
271+
export_etc_hosts = cfg.exportHosts;
272+
serve_rfc1918 = cfg.serveRFC1918;
273+
lua_config_file = pkgs.writeText "recursor.lua" cfg.luaConfig;
274+
daemon = false;
275+
write_pid = false;
276+
};
218277

219-
forward-zones = mapAttrsToList (zone: uri: "${zone}.=${uri}") cfg.forwardZones;
220-
forward-zones-recurse = mapAttrsToList (zone: uri: "${zone}.=${uri}") cfg.forwardZonesRecurse;
221-
export-etc-hosts = cfg.exportHosts;
222-
dnssec = cfg.dnssecValidation;
223-
serve-rfc1918 = cfg.serveRFC1918;
224-
lua-config-file = pkgs.writeText "recursor.lua" cfg.luaConfig;
278+
dnssec = mkDefaultAttrs {
279+
validation = cfg.dnssecValidation;
280+
};
225281

226-
daemon = false;
227-
write-pid = false;
228-
log-timestamp = false;
229-
disable-syslog = true;
282+
logging = mkDefaultAttrs {
283+
timestamp = false;
284+
disable_syslog = true;
285+
};
230286
};
231287

232288
systemd.packages = [ pkgs.pdns-recursor ];
233289

234-
systemd.services.pdns-recursor = {
235-
wantedBy = [ "multi-user.target" ];
236-
237-
serviceConfig = {
238-
ExecStart = [
239-
""
240-
"${pkgs.pdns-recursor}/bin/pdns_recursor --config-dir=${configDir}"
241-
];
242-
};
243-
};
290+
systemd.services.pdns-recursor.wantedBy = [ "multi-user.target" ];
244291

245292
users.users.pdns-recursor = {
246293
isSystemUser = true;
@@ -250,6 +297,15 @@ in
250297

251298
users.groups.pdns-recursor = { };
252299

300+
warnings = lib.optional (cfg.old-settings != { }) ''
301+
pdns-recursor has changed its configuration file format from pdns-recursor.conf
302+
(mapped to `services.pdns-recursor.old-settings`) to the newer pdns-recursor.yml
303+
(mapped to `services.pdns-recursor.yaml-settings`).
304+
305+
Support for the older format will be removed in a future version, so please migrate
306+
your settings over. See <https://doc.powerdns.com/recursor/yamlsettings.html>.
307+
'';
308+
253309
};
254310

255311
imports = [
@@ -258,6 +314,19 @@ in
258314
"pdns-recursor"
259315
"extraConfig"
260316
] "To change extra Recursor settings use services.pdns-recursor.settings instead.")
317+
318+
(mkRenamedOptionModule
319+
[
320+
"services"
321+
"pdns-recursor"
322+
"settings"
323+
]
324+
[
325+
"services"
326+
"pdns-recursor"
327+
"old-settings"
328+
]
329+
)
261330
];
262331

263332
meta.maintainers = with lib.maintainers; [ rnhmjoj ];

‎nixos/tests/all-tests.nix‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1019,7 +1019,7 @@ in
10191019
paperless = handleTest ./paperless.nix { };
10201020
parsedmarc = handleTest ./parsedmarc { };
10211021
password-option-override-ordering = handleTest ./password-option-override-ordering.nix { };
1022-
pdns-recursor = handleTest ./pdns-recursor.nix { };
1022+
pdns-recursor = runTest ./pdns-recursor.nix;
10231023
pds = handleTest ./pds.nix { };
10241024
peerflix = handleTest ./peerflix.nix { };
10251025
peering-manager = handleTest ./web-apps/peering-manager.nix { };

‎nixos/tests/pdns-recursor.nix‎

Lines changed: 20 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,25 @@
1-
import ./make-test-python.nix (
2-
{ pkgs, ... }:
3-
{
4-
name = "powerdns-recursor";
1+
{ lib, pkgs, ... }:
52

6-
nodes.server =
7-
{ ... }:
8-
{
9-
services.pdns-recursor.enable = true;
10-
services.pdns-recursor.exportHosts = true;
11-
networking.hosts."192.0.2.1" = [ "example.com" ];
12-
};
3+
{
4+
name = "powerdns-recursor";
5+
meta.maintainers = with lib.maintainers; [ rnhmjoj ];
136

14-
testScript = ''
7+
nodes.server = {
8+
services.pdns-recursor.enable = true;
9+
services.pdns-recursor.exportHosts = true;
10+
services.pdns-recursor.old-settings.dnssec-log-bogus = true;
11+
networking.hosts."192.0.2.1" = [ "example.com" ];
12+
};
13+
14+
testScript = ''
15+
with subtest("pdns-recursor is running"):
1516
server.wait_for_unit("pdns-recursor")
1617
server.wait_for_open_port(53)
18+
19+
with subtest("can resolve names"):
1720
assert "192.0.2.1" in server.succeed("host example.com localhost")
18-
'';
19-
}
20-
)
21+
22+
with subtest("old-settings have been merged in"):
23+
server.succeed("${lib.getExe pkgs.yq-go} -e .dnssec.log_bogus /etc/pdns-recursor/recursor.yml")
24+
'';
25+
}

0 commit comments

Comments
 (0)