hosts/mermet/knot/autogeree.net.nix

   1 { pkgs, lib, config, inputs, hostName, hosts, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (builtins) attrValues;
   6   inherit (config) networking;
   7   inherit (config.services) knot;
   8   inherit (config.users) users;
   9 in
  10 {
  11 services.knot.zones.${domain} = {
  12   conf = ''
  13     acl:
  14       - id: acl_localhost_acme_${domainID}
  15         address: 127.0.0.1
  16         action: update
  17         update-owner: name
  18         update-owner-match: equal
  19         update-owner-name: [_acme-challenge]
  20         update-type: [TXT]
  21       - id: acl_tsig_acme_${domainID}
  22         key: acme_${domainID}
  23         action: update
  24         update-owner: name
  25         update-owner-match: equal
  26         update-owner-name: [_acme-challenge]
  27         update-type: [TXT]
  28
  29     zone:
  30       - domain: ${domain}
  31         file: ${domain}.zone
  32         serial-policy: increment
  33         semantic-checks: on
  34         notify: secondary_gandi
  35         #notify: secondary_muarf
  36         acl: acl_gandi
  37         #acl: acl_muarf
  38         acl: acl_localhost_acme_${domainID}
  39         acl: acl_tsig_acme_${domainID}
  40         dnssec-signing: off
  41         dnssec-policy: ed25519
  42   '';
  43   # TODO: increase the TTL once things have settled down
  44   data = ''
  45     $ORIGIN ${domain}.
  46     $TTL 500
  47
  48     ; SOA (Start Of Authority)
  49     @ SOA ns root (
  50       ${toString inputs.self.lastModified} ; Serial number
  51       24h   ; Refresh
  52       15m   ; Retry
  53       1000h ; Expire (1000h)
  54       1d    ; Negative caching
  55     )
  56
  57     ; NS (Name Server)
  58     @ NS ns
  59     @ NS ns6.gandi.net.
  60     ;@ NS ns0.muarf.org.
  61
  62     ; A (DNS -> IPv4)
  63     @          A ${hosts.mermet._module.args.ipv4}
  64     mermet     A ${hosts.mermet._module.args.ipv4}
  65     autoconfig A ${hosts.mermet._module.args.ipv4}
  66     code       A ${hosts.mermet._module.args.ipv4}
  67     git        A ${hosts.mermet._module.args.ipv4}
  68     imap       A ${hosts.mermet._module.args.ipv4}
  69     mail       A ${hosts.mermet._module.args.ipv4}
  70     ns         A ${hosts.mermet._module.args.ipv4}
  71     pop        A ${hosts.mermet._module.args.ipv4}
  72     smtp       A ${hosts.mermet._module.args.ipv4}
  73     submission A ${hosts.mermet._module.args.ipv4}
  74     www        A ${hosts.mermet._module.args.ipv4}
  75     chomsky    A 91.216.110.36
  76     alpes      A 195.88.84.51
  77
  78     ; SPF (Sender Policy Framework)
  79     @ 3600 IN SPF "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
  80     @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
  81
  82     ; MX (Mail eXchange)
  83     @ 180 MX 5 mail
  84
  85     ; SRV (SeRVice)
  86     _git._tcp.git 18000 IN SRV 0 0 9418 git
  87
  88     ; CAA (Certificate Authority Authorization)
  89     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
  90     @ CAA 128 issue "letsencrypt.org"
  91   '';
  92 };
  93 networking.nftables.ruleset = ''
  94   table inet filter {
  95     # Gandi DNS
  96     set output-net-knot-ipv4 { type ipv4_addr; elements = { 217.70.177.40 }; }
  97     set output-net-knot-ipv6 { type ipv6_addr; elements = { 2001:4b98:d:1::40 }; }
  98   }
  99 '';
 100 services.knot = {
 101   keyFiles = [
 102     "/run/credentials/knot.service/${domain}.acme.conf"
 103   ];
 104 };
 105 systemd.services.knot.serviceConfig = {
 106   LoadCredentialEncrypted = [
 107     "${domain}.acme.conf:${inputs.self}/hosts/${hostName}/${domain}/acme.conf.cred"
 108   ];
 109 };
 110 /* Useless since the zone is public
 111 services.unbound.settings = {
 112   stub-zone = {
 113     name = domain;
 114     stub-addr = "127.0.0.1@5353";
 115   };
 116 };
 117 '';
 118 */
 119 }