hosts/mermet/knot/sourcephile.fr.nix

   1 { pkgs, lib, config, inputs, hostName, hosts, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (config) networking;
   6   inherit (config.services) knot;
   7   inherit (config.users) users;
   8 in
   9 {
  10 services.knot.zones."${domain}" = {
  11   conf = ''
  12     remote:
  13       - id: ns_iodine
  14         address: 127.0.0.1@1053
  15     acl:
  16       - id: acl_localhost_acme_${domainID}
  17         address: 127.0.0.1
  18         action: update
  19         update-owner: name
  20         update-owner-match: equal
  21         update-owner-name: [_acme-challenge, _acme-challenge.hut, _acme-challenge.code]
  22         update-type: [TXT]
  23       - id: acl_tsig_acme_${domainID}
  24         key: acme_${domainID}
  25         action: update
  26         update-owner: name
  27         update-owner-match: equal
  28         update-owner-name: [_acme-challenge]
  29         update-type: [TXT]
  30       - id: acl_tsig_losurdo_${domainID}
  31         key: losurdo_${domainID}
  32         action: update
  33         update-owner: name
  34         update-owner-match: equal
  35         update-owner-name: [losurdo, lan.losurdo]
  36         update-type: [A, AAAA]
  37
  38     mod-dnsproxy:
  39       - id: proxy_iodine
  40         remote: ns_iodine
  41         fallback: off
  42
  43     zone:
  44       - domain: ${domain}
  45         file: ${domain}.zone
  46         serial-policy: increment
  47         semantic-checks: on
  48         notify: secondary_gandi
  49         acl: acl_gandi
  50         acl: acl_localhost_acme_${domainID}
  51         acl: acl_tsig_acme_${domainID}
  52         acl: acl_tsig_losurdo_${domainID}
  53         dnssec-signing: on
  54         dnssec-policy: rsa
  55
  56       - domain: i.${domain}
  57         module: mod-dnsproxy/proxy_iodine
  58
  59       - domain: whoami4.${domain}
  60         module: mod-whoami
  61         file: "${pkgs.writeText "whoami4.zone" ''
  62           $TTL 1
  63           @ SOA ns root.${domain}. (
  64             0     ; SERIAL
  65             86400 ; REFRESH
  66             86400 ; RETRY
  67             86400 ; EXPIRE
  68             1 ; MINIMUM
  69           )
  70           $TTL 86400
  71           @ NS ns
  72           ns A ${hosts.mermet._module.args.ipv4}
  73         ''}"
  74   '';
  75   # TODO: increase the TTL once things have settled down
  76   data = ''
  77     $ORIGIN ${domain}.
  78     $TTL 500
  79
  80     ; SOA (Start Of Authority)
  81     @ SOA ns root (
  82       ${toString inputs.self.lastModified} ; Serial number
  83       24h   ; Refresh
  84       15m   ; Retry
  85       1000h ; Expire (1000h)
  86       1d    ; Negative caching
  87     )
  88
  89     ; NS (Name Server)
  90     @ NS ns
  91     @ NS ns6.gandi.net.
  92     i NS ns
  93     whoami4 NS ns.whoami4
  94     ns.whoami4 A ${hosts.mermet._module.args.ipv4}
  95
  96     ; A (DNS -> IPv4)
  97     @            A ${hosts.mermet._module.args.ipv4}
  98     mermet       A ${hosts.mermet._module.args.ipv4}
  99     autoconfig   A ${hosts.mermet._module.args.ipv4}
 100     doc          A ${hosts.mermet._module.args.ipv4}
 101     git          A ${hosts.mermet._module.args.ipv4}
 102     imap         A ${hosts.mermet._module.args.ipv4}
 103     mail         A ${hosts.mermet._module.args.ipv4}
 104     mails        A ${hosts.mermet._module.args.ipv4}
 105     news         A ${hosts.mermet._module.args.ipv4}
 106     public-inbox A ${hosts.mermet._module.args.ipv4}
 107     ns           A ${hosts.mermet._module.args.ipv4}
 108     pop          A ${hosts.mermet._module.args.ipv4}
 109     smtp         A ${hosts.mermet._module.args.ipv4}
 110     submission   A ${hosts.mermet._module.args.ipv4}
 111     www          A ${hosts.mermet._module.args.ipv4}
 112     lemoutona5pattes A ${hosts.mermet._module.args.ipv4}
 113     covid19      A ${hosts.mermet._module.args.ipv4}
 114     croc         A ${hosts.mermet._module.args.ipv4}
 115     stun         A ${hosts.mermet._module.args.ipv4}
 116     turn         A ${hosts.mermet._module.args.ipv4}
 117     whoami       A ${hosts.mermet._module.args.ipv4}
 118     code          A ${hosts.mermet._module.args.ipv4}
 119     builds.code   A ${hosts.mermet._module.args.ipv4}
 120     dispatch.code A ${hosts.mermet._module.args.ipv4}
 121     git.code      A ${hosts.mermet._module.args.ipv4}
 122     hg.code       A ${hosts.mermet._module.args.ipv4}
 123     hub.code      A ${hosts.mermet._module.args.ipv4}
 124     lists.code    A ${hosts.mermet._module.args.ipv4}
 125     meta.code     A ${hosts.mermet._module.args.ipv4}
 126     man.code      A ${hosts.mermet._module.args.ipv4}
 127     pages.code    A ${hosts.mermet._module.args.ipv4}
 128     paste.code    A ${hosts.mermet._module.args.ipv4}
 129     todo.code     A ${hosts.mermet._module.args.ipv4}
 130     miniflux      A ${hosts.mermet._module.args.ipv4}
 131
 132     ; CNAME (Canonical Name)
 133     openconcerto     CNAME losurdo
 134     xmpp             CNAME mermet
 135     tmp              CNAME mermet
 136     proxy65          CNAME mermet
 137     cryptpad         CNAME losurdo
 138     cryptpad-api     CNAME losurdo
 139     cryptpad-files   CNAME losurdo
 140     cryptpad-sandbox CNAME losurdo
 141     mumble           CNAME mermet
 142     freeciv          CNAME losurdo
 143     nix-serve        CNAME losurdo
 144     nix-extracache   CNAME losurdo
 145     nix-localcache   CNAME lan.losurdo
 146     hut              CNAME code
 147     builds.hut       CNAME builds.code
 148     dispatch.hut     CNAME dispatch.code
 149     git.hut          CNAME git.code
 150     hg.hut           CNAME hg.code
 151     hub.hut          CNAME hub.code
 152     lists.hut        CNAME lists.code
 153     meta.hut         CNAME meta.code
 154     man.hut          CNAME man.code
 155     pages.hut        CNAME pages.code
 156     paste.hut        CNAME paste.code
 157     todo.hut         CNAME todo.code
 158     sftp             CNAME losurdo
 159
 160     ; DMARC (Domain-based Message Authentication, Reporting and Conformance)
 161     _dmarc 3600 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:root+dmarc+aggregate@sourcephile.fr; ruf=mailto:root+dmarc+forensic@sourcephile.fr"
 162
 163     ; SPF (Sender Policy Framework)
 164     @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
 165
 166     ; MX (Mail eXchange)
 167     @ 1800 MX 5 mail
 168     lists.code 1800 MX 5 mail
 169     todo.code  1800 MX 5 mail
 170
 171     ; SRV (SeRVice)
 172     _git._tcp.git             18000 IN SRV 0 0 9418 git
 173     _stun._udp                18000 IN SRV 0 5 3478 stun
 174     _xmpp-client._tcp         18000 IN SRV 0 5 5222 xmpp
 175     _xmpp-server._tcp         18000 IN SRV 0 5 5269 xmpp
 176     _xmpp-server._tcp.salons  18000 IN SRV 0 5 5269 xmpp
 177
 178     ; CAA (Certificate Authority Authorization)
 179     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
 180     @ CAA 128 issue "letsencrypt.org"
 181   '';
 182 };
 183 services.knot = {
 184   keyFiles = [
 185     "/run/credentials/knot.service/${domain}.acme.conf"
 186     # Generated with: keymgr -t losurdo_${domainID}
 187     "/run/credentials/knot.service/losurdo.conf"
 188   ];
 189 };
 190 systemd.services.knot = {
 191   serviceConfig = {
 192     LoadCredentialEncrypted = [
 193       "${domain}.acme.conf:${inputs.self}/hosts/${hostName}/${domain}/acme.conf.cred"
 194       "losurdo.conf:${inputs.self}/hosts/${hostName}/${domain}/losurdo.conf.cred"
 195     ];
 196   };
 197 };
 198 networking.nftables.ruleset = ''
 199   table inet filter {
 200     # Gandi DNS
 201     set output-net-knot-ipv4 {
 202       type ipv4_addr
 203       elements = { 217.70.177.40 }
 204     }
 205     set output-net-knot-ipv6 {
 206       type ipv6_addr
 207       elements = { 2001:4b98:d:1::40 }
 208     }
 209   }
 210 '';
 211 /* Useless since the zone is public
 212 services.unbound.settings = {
 213   stub-zone = {
 214     name = domain;
 215     stub-addr = "127.0.0.1@5353";
 216   };
 217 };
 218 '';
 219 */
 220 }