]> Git — Sourcephile - sourcephile-nix.git/blob - servers/losurdo/acme/autogeree.net.nix
nftables: only use unbound for DNS resolving
[sourcephile-nix.git] / servers / losurdo / acme / autogeree.net.nix
1 { pkgs, lib, config, servers, ... }:
2 let
3 domain = "autogeree.net";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 credentialsFile = "/var/lib/acme/.lego/${domain}/rfc2136";
6 inherit (config.users) users groups;
7 in
8 {
9 systemd.services."acme-${domain}".after = [
10 "unbound.service"
11 ];
12 services.shorewall.configs.rules = ''
13 # for lego to update ACME DNS-01 challenge
14 DNS(ACCEPT) $FW net:${servers.mermet.ipv4}
15 # for lego to check DNS propagation on ns6.gandi.net
16 DNS(ACCEPT) $FW net:217.70.177.40 {user=${users.root.name}}
17 # for lego to check DNS propagation on ns0.muarf.org
18 DNS(ACCEPT) $FW net:78.192.65.63 {user=${users.root.name}}
19 '';
20 networking.nftables.ruleset = ''
21 # for lego to update ACME DNS-01 challenge
22 add rule inet filter fw2net ip daddr ${servers.mermet.ipv4} tcp dport 53 counter accept comment "DNS"
23 add rule inet filter fw2net ip daddr ${servers.mermet.ipv4} udp dport 53 counter accept comment "DNS"
24 # for lego to check DNS propagation on ns6.gandi.net
25 add rule inet filter fw2net ip daddr 217.70.177.40 tcp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
26 add rule inet filter fw2net ip daddr 217.70.177.40 udp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
27 # for lego to check DNS propagation on ns0.muarf.org
28 add rule inet filter fw2net ip daddr 78.192.65.63 tcp dport 53 skuid ${users.root.name} counter accept comment "DNS muarf"
29 add rule inet filter fw2net ip daddr 78.192.65.63 udp dport 53 skuid ${users.root.name} counter accept comment "DNS muarf"
30 '';
31 security.acme.certs."${domain}" = {
32 email = "root+letsencrypt@${domain}";
33 extraDomains = {
34 "*.${domain}" = null;
35 };
36 user = users.root.name;
37 group = groups.acme.name;
38 allowKeysForGroup = true;
39 keyType = "rsa4096";
40 dnsProvider = "rfc2136";
41 # ns6.gandi.net takes roughly 5min to update
42 # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
43 #dnsPropagationCheck = false;
44 inherit credentialsFile;
45 };
46 install.shellHook = ''
47 {
48 cat <<-EOF
49 RFC2136_NAMESERVER=ns.${domain}:53
50 RFC2136_TSIG_ALGORITHM=hmac-sha256.
51 RFC2136_TSIG_KEY=acme_${domainID}
52 RFC2136_PROPAGATION_TIMEOUT=1000
53 RFC2136_POLLING_INTERVAL=30
54 RFC2136_SEQUENCE_INTERVAL=30
55 RFC2136_DNS_TIMEOUT=1000
56 RFC2136_TTL=1
57 EOF
58 pass "servers/losurdo/lego/${domain}/rfc2136"
59 } |
60 ssh "$target" install -D -m 0400 -o root -g root /dev/stdin \
61 ${credentialsFile}
62 '';
63 }