diff --git a/deploy/ansible/roles/opnsense/files/dnsmasq/edns0.conf b/deploy/ansible/roles/opnsense/files/dnsmasq/edns0.conf deleted file mode 100644 index d8ce5fbd..00000000 --- a/deploy/ansible/roles/opnsense/files/dnsmasq/edns0.conf +++ /dev/null @@ -1,2 +0,0 @@ -add-mac -add-subnet=32,128 diff --git a/deploy/ansible/roles/opnsense/tasks/dnsmasq.yml b/deploy/ansible/roles/opnsense/tasks/dnsmasq.yml index 3d2f5e97..45dd0e1c 100644 --- a/deploy/ansible/roles/opnsense/tasks/dnsmasq.yml +++ b/deploy/ansible/roles/opnsense/tasks/dnsmasq.yml @@ -1,18 +1,12 @@ --- -# - name: Copy edns0.conf -# ansible.builtin.copy: -# src: dnsmasq/edns0.conf -# dest: "/usr/local/etc/dnsmasq.conf.d/edns0.conf" -# owner: root -# group: wheel -# mode: "0400" -# backup: true - - name: Configure dnsmasq oxlorg.opnsense.dnsmasq_general: enabled: true port: 53 + dhcp_authoritative: true dhcp_fqdn: true + dhcp_domain: satan.network + dhcp_local: true dhcpfirst: true domain_needed: true forward_private_reverse: false @@ -21,13 +15,26 @@ resolv_system: true strict_order: true +- name: Set DHCP option 6 to Blocky on controller + oxlorg.opnsense.dnsmasq_option: + description: "[Ansible] DNS server for {{ item.interface }}" + type: set + option: 6 + interface: "{{ item.interface }}" + value: "{{ item.address }}" + loop: + - { interface: "LAN", address: "192.168.1.2" } + - { interface: "Management", address: "10.2.1.2" } + - { interface: "Homelab", address: "10.10.1.2" } + - { interface: "IoT", address: "10.100.1.2" } + - name: Create LAN dnsmasq DHCP range oxlorg.opnsense.dnsmasq_range: description: "[Ansible] LAN DHCP range" interface: "LAN" start_addr: 192.168.1.50 end_addr: 192.168.1.254 - lease_time: 86400 + lease_time: 3600 - name: Create Management dnsmasq DHCP range oxlorg.opnsense.dnsmasq_range: @@ -35,7 +42,11 @@ interface: "Management" start_addr: 10.2.100.2 end_addr: 10.2.255.254 - lease_time: 86400 + # Stated explicitly rather than derived from the interface, so the mask the + # clients get can't drift from the /16 these ranges assume. LAN and Guest + # are genuine /24s and keep the auto-calculated mask. + subnet_mask: 255.255.0.0 + lease_time: 3600 - name: Create Homelab dnsmasq DHCP range oxlorg.opnsense.dnsmasq_range: @@ -43,7 +54,8 @@ interface: "Homelab" start_addr: 10.10.100.2 end_addr: 10.10.255.254 - lease_time: 86400 + subnet_mask: 255.255.0.0 + lease_time: 3600 - name: Create Guest dnsmasq DHCP range oxlorg.opnsense.dnsmasq_range: @@ -51,7 +63,7 @@ interface: "Guest" start_addr: 10.50.0.2 end_addr: 10.50.0.254 - lease_time: 86400 + lease_time: 3600 - name: Create IoT dnsmasq DHCP range oxlorg.opnsense.dnsmasq_range: @@ -59,7 +71,8 @@ interface: "IoT" start_addr: 10.100.100.1 end_addr: 10.100.255.254 - lease_time: 86400 + subnet_mask: 255.255.0.0 + lease_time: 3600 - name: Create plex.direct dnsmasq domain oxlorg.opnsense.dnsmasq_domain: diff --git a/hosts/builder/configuration.nix b/hosts/builder/configuration.nix index 82497017..6767bd54 100644 --- a/hosts/builder/configuration.nix +++ b/hosts/builder/configuration.nix @@ -49,7 +49,7 @@ addresses = [ { address = "10.10.2.102"; - prefixLength = 24; + prefixLength = 16; } ]; }; diff --git a/hosts/controller/configuration.nix b/hosts/controller/configuration.nix index c1109448..c9122385 100644 --- a/hosts/controller/configuration.nix +++ b/hosts/controller/configuration.nix @@ -58,21 +58,21 @@ vlan2.ipv4.addresses = [ { address = "10.2.1.2"; - prefixLength = 24; + prefixLength = 16; } ]; vlan10.ipv4.addresses = [ { address = "10.10.1.2"; - prefixLength = 24; + prefixLength = 16; } ]; vlan100.ipv4.addresses = [ { address = "10.100.1.2"; - prefixLength = 24; + prefixLength = 16; } ]; diff --git a/hosts/htpc/configuration.nix b/hosts/htpc/configuration.nix index 6ba27b16..01e938b1 100644 --- a/hosts/htpc/configuration.nix +++ b/hosts/htpc/configuration.nix @@ -75,7 +75,7 @@ addresses = [ { address = "10.10.2.101"; - prefixLength = 24; + prefixLength = 16; } ]; }; diff --git a/hosts/matrix/configuration.nix b/hosts/matrix/configuration.nix index 9a9a53fe..c61540ad 100644 --- a/hosts/matrix/configuration.nix +++ b/hosts/matrix/configuration.nix @@ -70,7 +70,7 @@ addresses = [ { address = "10.10.3.101"; - prefixLength = 24; + prefixLength = 16; } ]; }; diff --git a/hosts/omnibus/configuration.nix b/hosts/omnibus/configuration.nix index 57dd5dba..2125520d 100644 --- a/hosts/omnibus/configuration.nix +++ b/hosts/omnibus/configuration.nix @@ -72,7 +72,7 @@ addresses = [ { address = "10.10.1.101"; - prefixLength = 24; + prefixLength = 16; } ]; }; diff --git a/hosts/whirlwind/configuration.nix b/hosts/whirlwind/configuration.nix index f16b9fe0..d33a18e0 100644 --- a/hosts/whirlwind/configuration.nix +++ b/hosts/whirlwind/configuration.nix @@ -52,7 +52,7 @@ addresses = [ { address = "10.10.2.103"; - prefixLength = 24; + prefixLength = 16; } ]; }; diff --git a/modules/profiles/networking/blocky/default.nix b/modules/profiles/networking/blocky/default.nix index cdf42986..ff5d3838 100644 --- a/modules/profiles/networking/blocky/default.nix +++ b/modules/profiles/networking/blocky/default.nix @@ -1,6 +1,7 @@ { pkgs, lib, ... }: let - routerUpstream = "192.168.1.1:5335"; + unbound = "192.168.1.1:5335"; + dnsmasq = "192.168.1.1:53"; in { imports = [ @@ -89,7 +90,7 @@ in maxItemsCount = 0; }; clientLookup = { - upstream = routerUpstream; + upstream = dnsmasq; singleNameOrder = [ 1 2 @@ -97,15 +98,16 @@ in }; conditional = { mapping = { - "1.168.192.in-addr.arpa" = "192.168.1.1:5335"; - "10.10.in-addr.arpa" = "10.10.0.1:5335"; - "100.10.in-addr.arpa" = "10.100.0.1:5335"; - "168.192.in-addr.arpa" = "192.168.1.1:5335"; - "2.10.in-addr.arpa" = "10.2.0.1:5335"; - "5.10.in-addr.arpa" = "10.5.0.1:5335"; - "10.in-addr.arpa" = "192.168.1.1:5335"; - "arpa" = "192.168.1.1:5335"; - "." = "192.168.1.1:5335"; + "satan.network" = dnsmasq; + "1.168.192.in-addr.arpa" = dnsmasq; + "168.192.in-addr.arpa" = dnsmasq; + "2.10.in-addr.arpa" = dnsmasq; + "5.10.in-addr.arpa" = dnsmasq; + "10.10.in-addr.arpa" = dnsmasq; + "100.10.in-addr.arpa" = dnsmasq; + "10.in-addr.arpa" = dnsmasq; + "." = dnsmasq; + "arpa" = unbound; }; }; prometheus = { @@ -113,11 +115,6 @@ in path = "/metrics"; }; ede.enable = true; - ecs = { - useAsClient = true; - ipv4Mask = 32; - ipv6Mask = 128; - }; queryLog.type = lib.mkDefault "console"; }; };