]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/knot/sourcephile.fr.nix
gitolite: update
[sourcephile-nix.git] / hosts / mermet / knot / sourcephile.fr.nix
1 { inputs, pkgs, lib, config, hosts, ... }:
2 let
3 domain = "sourcephile.fr";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 inherit (config) networking;
6 inherit (config.security) gnupg;
7 inherit (config.services) knot;
8 inherit (config.users) users;
9 in
10 {
11 services.knot.zones."${domain}" = {
12 conf = ''
13 acl:
14 - id: acl_localhost_acme_${domainID}
15 address: 127.0.0.1
16 action: update
17 update-owner: name
18 update-owner-match: equal
19 update-owner-name: [_acme-challenge, _acme-challenge.hut]
20 update-type: [TXT]
21 - id: acl_tsig_acme_${domainID}
22 key: acme_${domainID}
23 action: update
24 update-owner: name
25 update-owner-match: equal
26 update-owner-name: [_acme-challenge, _acme-challenge.hut]
27 update-type: [TXT]
28 - id: acl_tsig_bureau1_${domainID}
29 key: bureau1_${domainID}
30 action: update
31 update-owner: name
32 update-owner-match: equal
33 update-owner-name: [bureau1, lan.losurdo]
34 update-type: [A, AAAA]
35
36 zone:
37 - domain: ${domain}
38 file: ${domain}.zone
39 serial-policy: increment
40 semantic-checks: on
41 notify: secondary_gandi
42 acl: acl_gandi
43 acl: acl_localhost_acme_${domainID}
44 acl: acl_tsig_acme_${domainID}
45 acl: acl_tsig_bureau1_${domainID}
46 dnssec-signing: on
47 dnssec-policy: rsa
48 - domain: whoami4.${domain}
49 module: mod-whoami
50 file: "${pkgs.writeText "whoami4.zone" ''
51 $TTL 1
52 @ SOA ns root.${domain}. (
53 0 ; SERIAL
54 86400 ; REFRESH
55 86400 ; RETRY
56 86400 ; EXPIRE
57 1 ; MINIMUM
58 )
59 $TTL 86400
60 @ NS ns
61 ns A ${hosts.mermet.extraArgs.ipv4}
62 ''}"
63 '';
64 # TODO: increase the TTL once things have settled down
65 data = ''
66 $ORIGIN ${domain}.
67 $TTL 500
68
69 ; SOA (Start Of Authority)
70 @ SOA ns root (
71 ${toString inputs.self.lastModified} ; Serial number
72 24h ; Refresh
73 15m ; Retry
74 1000h ; Expire (1000h)
75 1d ; Negative caching
76 )
77
78 ; NS (Name Server)
79 @ NS ns
80 @ NS ns6.gandi.net.
81 whoami4 NS ns.whoami4
82 ns.whoami4 A ${hosts.mermet.extraArgs.ipv4}
83
84 ; A (DNS -> IPv4)
85 @ A ${hosts.mermet.extraArgs.ipv4}
86 mermet A ${hosts.mermet.extraArgs.ipv4}
87 autoconfig A ${hosts.mermet.extraArgs.ipv4}
88 doc A ${hosts.mermet.extraArgs.ipv4}
89 code A ${hosts.mermet.extraArgs.ipv4}
90 git A ${hosts.mermet.extraArgs.ipv4}
91 imap A ${hosts.mermet.extraArgs.ipv4}
92 mail A ${hosts.mermet.extraArgs.ipv4}
93 mails A ${hosts.mermet.extraArgs.ipv4}
94 news A ${hosts.mermet.extraArgs.ipv4}
95 public-inbox A ${hosts.mermet.extraArgs.ipv4}
96 ns A ${hosts.mermet.extraArgs.ipv4}
97 pop A ${hosts.mermet.extraArgs.ipv4}
98 smtp A ${hosts.mermet.extraArgs.ipv4}
99 submission A ${hosts.mermet.extraArgs.ipv4}
100 www A ${hosts.mermet.extraArgs.ipv4}
101 lemoutona5pattes A ${hosts.mermet.extraArgs.ipv4}
102 covid19 A ${hosts.mermet.extraArgs.ipv4}
103 croc A ${hosts.mermet.extraArgs.ipv4}
104 stun A ${hosts.mermet.extraArgs.ipv4}
105 turn A ${hosts.mermet.extraArgs.ipv4}
106 whoami A ${hosts.mermet.extraArgs.ipv4}
107 hut A ${hosts.mermet.extraArgs.ipv4}
108 builds.hut A ${hosts.mermet.extraArgs.ipv4}
109 dispatch.hut A ${hosts.mermet.extraArgs.ipv4}
110 git.hut A ${hosts.mermet.extraArgs.ipv4}
111 hg.hut A ${hosts.mermet.extraArgs.ipv4}
112 hub.hut A ${hosts.mermet.extraArgs.ipv4}
113 lists.hut A ${hosts.mermet.extraArgs.ipv4}
114 meta.hut A ${hosts.mermet.extraArgs.ipv4}
115 man.hut A ${hosts.mermet.extraArgs.ipv4}
116 pages.hut A ${hosts.mermet.extraArgs.ipv4}
117 paste.hut A ${hosts.mermet.extraArgs.ipv4}
118 todo.hut A ${hosts.mermet.extraArgs.ipv4}
119
120 ; CNAME (Canonical Name)
121 losurdo CNAME bureau1
122 openconcerto CNAME losurdo
123 xmpp CNAME mermet
124 tmp CNAME mermet
125 proxy65 CNAME mermet
126 cryptpad CNAME losurdo
127 cryptpad-api CNAME losurdo
128 cryptpad-files CNAME losurdo
129 cryptpad-sandbox CNAME losurdo
130 mumble CNAME mermet
131 freeciv CNAME losurdo
132 nix-serve CNAME losurdo
133 nix-extracache CNAME losurdo
134 nix-localcache CNAME lan.losurdo
135
136 ; DMARC (Domain-based Message Authentication, Reporting and Conformance)
137 _dmarc 3600 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:root+dmarc+aggregate@sourcephile.fr; ruf=mailto:root+dmarc+forensic@sourcephile.fr"
138
139 ; SPF (Sender Policy Framework)
140 @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet.extraArgs.ipv4} -all"
141
142 ; MX (Mail eXchange)
143 @ 1800 MX 5 mail
144 lists.hut 1800 MX 5 mail
145
146 ; SRV (SeRVice)
147 _git._tcp.git 18000 IN SRV 0 0 9418 git
148 _stun._udp 18000 IN SRV 0 5 3478 stun
149 _xmpp-client._tcp 18000 IN SRV 0 5 5222 xmpp
150 _xmpp-server._tcp 18000 IN SRV 0 5 5269 xmpp
151 _xmpp-server._tcp.salons 18000 IN SRV 0 5 5269 xmpp
152
153 ; CAA (Certificate Authority Authorization)
154 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
155 @ CAA 128 issue "letsencrypt.org"
156 '';
157 };
158 users.groups.keys.members = [ users.knot.name ];
159 services.knot = {
160 keyFiles = [
161 gnupg.secrets."knot/tsig/${domain}/acme.conf".path
162 gnupg.secrets."knot/tsig/${domain}/bureau1.conf".path
163 ];
164 };
165 security.gnupg.secrets = {
166 "knot/tsig/${domain}/acme.conf" = {
167 # Generated with: keymgr -t acme_${domainID}
168 user = users.knot.name;
169 };
170 "knot/tsig/${domain}/bureau1.conf" = {
171 # Generated with: keymgr -t bureau1_${domainID}
172 user = users.knot.name;
173 };
174 };
175 systemd.services.knot = {
176 after = [
177 gnupg.secrets."knot/tsig/${domain}/acme.conf".service
178 gnupg.secrets."knot/tsig/${domain}/bureau1.conf".service
179 ];
180 wants = [
181 gnupg.secrets."knot/tsig/${domain}/acme.conf".service
182 gnupg.secrets."knot/tsig/${domain}/bureau1.conf".service
183 ];
184 };
185 /* Useless since the zone is public
186 services.unbound.settings = {
187 stub-zone = {
188 name = domain;
189 stub-addr = "127.0.0.1@5353";
190 };
191 };
192 '';
193 */
194 }