machines/mermet/knot/sourcephile.fr.nix

   1 { pkgs, lib, config, machines, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (builtins) attrValues;
   6   inherit (builtins.extraBuiltins) git;
   7   inherit (config) networking;
   8   inherit (config.security) gnupg;
   9   inherit (config.services) knot;
  10   inherit (config.users) users groups;
  11   # Use the Git commit time of the ${domain}.nix file to set the serial number.
  12   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  13   # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
  14   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  15 in
  16 {
  17 services.knot.zones."${domain}" = {
  18   conf = ''
  19     acl:
  20       - id: acl_localhost_acme_${domainID}
  21         address: 127.0.0.1
  22         action: update
  23         update-owner: name
  24         update-owner-match: equal
  25         update-owner-name: [_acme-challenge.${domain}]
  26         update-type: [TXT]
  27       - id: acl_tsig_acme_${domainID}
  28         address: ${machines.losurdo.extraArgs.ipv4}
  29         key: acme_${domainID}
  30         action: update
  31         update-owner: name
  32         update-owner-match: equal
  33         update-owner-name: [_acme-challenge.${domain}]
  34         update-type: [TXT]
  35
  36     zone:
  37       - domain: ${domain}
  38         file: ${domain}.zone
  39         serial-policy: increment
  40         semantic-checks: on
  41         notify: secondary_gandi
  42         acl: acl_gandi
  43         acl: acl_localhost_acme_${domainID}
  44         acl: acl_tsig_acme_${domainID}
  45         dnssec-signing: on
  46         dnssec-policy: rsa
  47       - domain: whoami4.${domain}
  48         module: mod-whoami
  49         file: "${pkgs.writeText "whoami4.zone" ''
  50           $TTL 1
  51           @ SOA ns root.${domain}. (
  52             ${serial domain} ; SERIAL
  53             86400 ; REFRESH
  54             86400 ; RETRY
  55             86400 ; EXPIRE
  56             1 ; MINIMUM
  57           )
  58           $TTL 86400
  59           @ NS ns
  60           ns A ${machines.mermet.extraArgs.ipv4}
  61         ''}"
  62   '';
  63   # TODO: increase the TTL once things have settled down
  64   data = ''
  65     $ORIGIN ${domain}.
  66     $TTL 500
  67
  68     ; SOA (Start Of Authority)
  69     @ SOA ns root (
  70       ${serial domain} ; Serial number
  71       24h   ; Refresh
  72       15m   ; Retry
  73       1000h ; Expire (1000h)
  74       1d    ; Negative caching
  75     )
  76
  77     ; NS (Name Server)
  78     @ NS ns
  79     @ NS ns6.gandi.net.
  80     whoami4 NS ns.whoami4
  81     ns.whoami4 A ${machines.mermet.extraArgs.ipv4}
  82
  83     ; A (DNS -> IPv4)
  84     @            A ${machines.mermet.extraArgs.ipv4}
  85     mermet       A ${machines.mermet.extraArgs.ipv4}
  86     losurdo      A ${machines.losurdo.extraArgs.ipv4}
  87     autoconfig   A ${machines.mermet.extraArgs.ipv4}
  88     doc          A ${machines.mermet.extraArgs.ipv4}
  89     code         A ${machines.mermet.extraArgs.ipv4}
  90     git          A ${machines.mermet.extraArgs.ipv4}
  91     imap         A ${machines.mermet.extraArgs.ipv4}
  92     mail         A ${machines.mermet.extraArgs.ipv4}
  93     mails        A ${machines.mermet.extraArgs.ipv4}
  94     news         A ${machines.mermet.extraArgs.ipv4}
  95     public-inbox A ${machines.mermet.extraArgs.ipv4}
  96     ns           A ${machines.mermet.extraArgs.ipv4}
  97     pop          A ${machines.mermet.extraArgs.ipv4}
  98     smtp         A ${machines.mermet.extraArgs.ipv4}
  99     submission   A ${machines.mermet.extraArgs.ipv4}
 100     www          A ${machines.mermet.extraArgs.ipv4}
 101     lemoutona5pattes A ${machines.mermet.extraArgs.ipv4}
 102     covid19      A ${machines.mermet.extraArgs.ipv4}
 103     openconcerto A ${machines.losurdo.extraArgs.ipv4}
 104     croc         A ${machines.mermet.extraArgs.ipv4}
 105
 106     ; SPF (Sender Policy Framework)
 107     @ 3600 IN SPF "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
 108     @ 3600 IN TXT "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
 109
 110     ; MX (Mail eXchange)
 111     @ 180 MX 5 mail
 112
 113     ; SRV (SeRVice)
 114     _git._tcp.git 18000 IN SRV 0 0 9418 git
 115
 116     ; CAA (Certificate Authority Authorization)
 117     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
 118     @ CAA 128 issue "letsencrypt.org"
 119   '';
 120 };
 121 users.users.knot.extraGroups = [ groups.keys.name ];
 122 services.knot = {
 123   keyFiles = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".path ];
 124 };
 125 security.gnupg.secrets."knot/tsig/${domain}/acme.conf" = {
 126   # Generated with: keymgr -t acme_${domainID}
 127   user = users.knot.name;
 128 };
 129 systemd.services.knot = {
 130   after = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
 131   wants = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
 132 };
 133 /* Useless since the zone is public
 134 services.unbound.extraConfig = ''
 135   stub-zone:
 136     name: "sourcephile.fr"
 137     stub-addr: 127.0.0.1@5353
 138 '';
 139 */
 140 }