servers/mermet/nsd/sourcephile.nix

   1 {pkgs, lib, config, ...}:
   2 with builtins;
   3 let inherit (builtins.extraBuiltins) pass git;
   4     inherit (pkgs.lib) unlinesAttrs;
   5     inherit (config) networking;
   6     inherit (config.services) nsd rspamd;
   7     # Use the Git commit time of the ${zone}.nix file to set the serial number.
   8     # WARNING: the ${zone}.nix must be committed into Git for this to work.
   9     serial = zone: toString (git ./. [ "log" "-1" "--format=%ct" "--" (zone + ".nix") ]);
  10     /*
  11     serial = file: lib.removeSuffix "\n" (readFile
  12       (pkgs.runCommand "zone-serial"
  13         { buildInputs      = [ pkgs.git ];
  14           buildDepends     = [ (./. + file) ];
  15           preferLocalBuild = true;
  16           allowSubstitutes = false;
  17         } ''
  18         cd ${./.}
  19         ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
  20       ''));
  21     */
  22     # FIXME: make dedicated config options
  23     #ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
  24     ipv4 = "80.67.180.129";
  25     #ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
  26     sourcephileZone = domain: ''
  27       ; A (DNS -> IPv4)
  28       @ A ${ipv4}
  29       ${networking.hostName} A ${ipv4}
  30       autoconfig A ${ipv4}
  31       code       A ${ipv4}
  32       git        A ${ipv4}
  33       imap       A ${ipv4}
  34       mail       A ${ipv4}
  35       ns         A ${ipv4}
  36       pop        A ${ipv4}
  37       smtp       A ${ipv4}
  38       submission A ${ipv4}
  39       www        A ${ipv4}
  40
  41       ; SPF (Sender Policy Framework)
  42       @ 3600 IN SPF "v=spf1 mx ip4:${ipv4} -all"
  43       @ 3600 IN TXT "v=spf1 mx ip4:${ipv4} -all"
  44
  45       ; MX (Mail eXchange)
  46       @ 180 MX 5 mail
  47
  48       ; SRV (SeRVice)
  49       _git._tcp.git 18000 IN SRV 0 0 9418 git
  50
  51       ; TXT (TeXT)
  52       ''
  53       + lib.optionalString rspamd.dkim.enable
  54           (unlinesAttrs
  55             (selector: sel: sel.dns)
  56             rspamd.dkim.domains."${domain}".selectors)
  57       ;
  58 in
  59 {
  60   services.nsd = {
  61     zones = {
  62       # NOTE: cannot use networking.domain as attr key: infinite recursion.
  63       "sourcephile.fr" = {
  64         # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
  65         provideXFR = [ "217.70.177.40 NOKEY" ];
  66         notify     = [ "217.70.177.40 NOKEY" ];
  67         data = ''
  68           $ORIGIN ${networking.domainBase}.fr.
  69           $TTL    86400
  70
  71           ; SOA (Start Of Authority)
  72           @ SOA ns admin (
  73             ${serial networking.domainBase} ; Serial number
  74             1d      ; Refresh
  75             15m     ; Retry
  76             2592000 ; Expire
  77             1d      ; TTL (Time To Live) minimum
  78           )
  79
  80           ; NS (Name Server)
  81           @ NS ns
  82           @ NS ns6.gandi.net.
  83         ''
  84         + sourcephileZone "${networking.domainBase}.fr";
  85       };
  86     };
  87   };
  88 }