From 7752b4da7d3b40a8b64161008ed583d1c958b06b Mon Sep 17 00:00:00 2001
From: Leonhard Kost <leonhard.kost@gmail.com>
Date: Mon, 9 Feb 2026 13:14:04 +0100
Subject: [PATCH] feat(dyndns): add additional secret and write dyndns script

---
 nixos/server/dyndns.nix            |  5 +++++
 nixos/server/dyndns.py             | 26 ++++++++++++++++++++++++--
 nixos/server/secrets/default.nix   |  4 ++++
 nixos/server/secrets/nc_domain.age | 17 +++++++++++++++++
 4 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100644 nixos/server/secrets/nc_domain.age

diff --git a/nixos/server/dyndns.nix b/nixos/server/dyndns.nix
index 3972735..94b770a 100644
--- a/nixos/server/dyndns.nix
+++ b/nixos/server/dyndns.nix
@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   ...
 }:
@@ -21,6 +22,10 @@
 
   systemd.services."dyndns" = {
     script = ''
+      NC_CUSTOMER=${"$(cat " + config.age.secrets.nc_customer.path + ")"}
+      NC_API_PASSWORD=${"$(cat " + config.age.secrets.nc_api_password.path + ")"}
+      NC_API_KEY=${"$(cat " + config.age.secrets.nc_api_key.path + ")"}
+      NC_DOMAIN=${"$(cat " + config.age.secrets.nc_domain.path + ")"}
       python3 -c "${builtins.readFile ./dyndns.py}"
     '';
     serviceConfig = {
diff --git a/nixos/server/dyndns.py b/nixos/server/dyndns.py
index f6cbdc3..9b8dda3 100644
--- a/nixos/server/dyndns.py
+++ b/nixos/server/dyndns.py
@@ -1,3 +1,25 @@
-from nc_dnsapi import Client, DNSRecord
+from nc_dnsapi import Client
+import os, urllib3
 
-pass
+customer = os.environ["NC_CUSTOMER"]
+api_password = os.environ["NC_API_PASSWORD"]
+api_key = os.environ["NC_API_KEY"]
+domain = os.environ["NC_DOMAIN"]
+
+ip = str(urllib3.request("GET", "https://api.ipify.org").data)
+
+with Client(customer, api_key, api_password) as api:
+    to_be_updated = []
+    records = api.dns_records(domain)
+
+    for record in records:
+        if record.type in ["A", "AAAA"] and record.destination != ip:
+            record.destination = ip
+            to_be_updated.append(record)
+
+
+    api.update_dns_records(domain, to_be_updated)
+
+    zone = api.dns_zone(domain)
+    zone.ttl = 300
+    api.update_dns_zone(domain, zone)
diff --git a/nixos/server/secrets/default.nix b/nixos/server/secrets/default.nix
index 413cb33..e881f1c 100644
--- a/nixos/server/secrets/default.nix
+++ b/nixos/server/secrets/default.nix
@@ -11,4 +11,8 @@
     file = ./nc_api_key.age;
     owner = "dyndns";
   };
+  age.secrets.nc_domain = {
+    file = ./nc_domain.age;
+    owner = "dyndns";
+  };
 }
diff --git a/nixos/server/secrets/nc_domain.age b/nixos/server/secrets/nc_domain.age
new file mode 100644
index 0000000..c43c5fc
--- /dev/null
+++ b/nixos/server/secrets/nc_domain.age
@@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-ed25519 RiiDcg JineodD1i5o56Z5gMieXLqfI31mltwwNYgW/F+Dyoy8
+mjASjjLWIjKcmZlZYAnLX5qewbz0xU798cBNeUtygjY
+-> ssh-rsa t41wew
+H/4HrD8Cw6A7NrXgslzYbm+okXjY5PslDFQXtchQ4J4ZDp7upOZVyiSOHDkT3/XU
+zjKXSPaS3HkM/OilwG+sFufS3UUKiFsSInmQyYieztBwLTrjBCnLfEsh+y/JM/DF
+EMiiuZ6dAMT0HbRamFYh0E5XMyrRuMgngvDrjkFnYsWWCGPwT5jzNjf19p+dAX6g
+7svxMaQEkAgA0jZU16MGG0i31L8SRKkSPadGh3EqoFMw/fg/ECjK27WVonj+UMM9
+SHq/Ahu6eYOIf69Ayk5P/iyi4hyDpNXXCBd2TigSZmedhkx6mH/PVR5LwAHYcNQQ
+VKroeDCHhO4C6lKQ0M0xvhj/lgoBMd+Tp03aL5RohqGnrkQNIppY5vsXcKWolcvB
+cC8OGu+fu2NBSDNALCDwbglzs3TLLk7GbqWYltqpzbzX7fi+CE5lxkG8ecsygMpY
+jXLggB2R5rgtjYti/56ux7DLuRVAY9FoYZOt9+PJRj45YnwS2Z1Er/A5TejC4TuL
+VcYMVyt8D8PjmbEefZWbvT4eYAWgZFqIUwGTGD+qKWY1iiA1kruebOoMeyUxM3ow
+9aZglWA378kwbSCRyGrMPjV8UzIPoQmrzqqjF5Ow6GGLvEuw3DRoLC2aTH3ZfY1k
+u9K8j29Nl3Sj/hBFPSnW0YR05diMZbWFrybhQQ9x3HM
+--- O4TEPeHph/lRMujfo8YPF6d6EjJpDd+BBNtlWGfQWQI
+_N�[,`E�,��Fy�T�J"��bXC�F
m�T�g&J5z ��Ĉ��

���
\ No newline at end of file