servers/mermet/nsd/sourcephile.nix

   1 {pkgs, lib, config, ...}:
   2 with builtins;
   3 let inherit (builtins.extraBuiltins) pass git;
   4     inherit (pkgs.lib) unlinesAttrs;
   5     inherit (config) networking;
   6     inherit (config.services) nsd rspamd;
   7     # Use the Git commit time of the ${zone}.nix file to set the serial number.
   8     # WARNING: the ${zone}.nix must be committed into Git for this to work.
   9     serial = zone: toString (git ./. [ "log" "-1" "--format=%ct" "--" (zone + ".nix") ]);
  10     /*
  11     serial = file: lib.removeSuffix "\n" (readFile
  12       (pkgs.runCommand "zone-serial"
  13         { buildInputs      = [ pkgs.git ];
  14           buildDepends     = [ (toPath ./. + file) ];
  15           preferLocalBuild = true;
  16           allowSubstitutes = false;
  17         } ''
  18         cd ${toPath ./.}
  19         ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
  20       ''));
  21     */
  22     # FIXME: make dedicated config options
  23     ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
  24     ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
  25     sourcephileZone = domain: ''
  26       ; A (DNS -> IPv4)
  27       @ A ${ipv4}
  28       ${networking.hostName} A ${ipv4}
  29       autoconfig A ${ipv4}
  30       code       A ${ipv4}
  31       git        A ${ipv4}
  32       imap       A ${ipv4}
  33       mail       A ${ipv4}
  34       ns         A ${ipv4}
  35       pop        A ${ipv4}
  36       smtp       A ${ipv4}
  37       submission A ${ipv4}
  38       www        A ${ipv4}
  39
  40       ; SPF (Sender Policy Framework)
  41       @ 3600 IN SPF "v=spf1 mx ip4:${ipv4} -all"
  42       @ 3600 IN TXT "v=spf1 mx ip4:${ipv4} -all"
  43
  44       ; MX (Mail eXchange)
  45       @ 180 MX 5 mail
  46
  47       ; SRV (SeRVice)
  48       _git._tcp.git 18000 IN SRV 0 0 9418 git
  49
  50       ; TXT (TeXT)
  51       ''
  52       + lib.optionalString rspamd.dkim.enable
  53           (unlinesAttrs
  54             (selector: sel: sel.dns)
  55             rspamd.dkim.domains."${domain}".selectors)
  56       ;
  57 in
  58 {
  59   services.nsd = {
  60     zones = {
  61       # NOTE: cannot use networking.domain as attr key: infinite recursion.
  62       "sourcephile.fr" = {
  63         data = ''
  64           $ORIGIN ${networking.domainBase}.fr.
  65           $TTL    86400
  66
  67           ; SOA (Start Of Authority)
  68           @ SOA ns admin (
  69             ${serial networking.domainBase} ; Serial number
  70             1d      ; Refresh
  71             15m     ; Retry
  72             2592000 ; Expire
  73             1d      ; TTL (Time To Live) minimum
  74           )
  75
  76           ; NS (Name Server)
  77           @ NS ns
  78           ;@ NS ns6.gandi.net.
  79         ''
  80         + sourcephileZone "${networking.domainBase}.fr";
  81       };
  82     };
  83   };
  84 }