servers/mermet/knot/sourcephile.fr.nix

   1 { pkgs, lib, config, servers, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (builtins) attrValues;
   6   inherit (builtins.extraBuiltins) pass git;
   7   inherit (config) networking;
   8   inherit (config.services) knot;
   9   inherit (config.users) users groups;
  10   # Use the Git commit time of the ${domain}.nix file to set the serial number.
  11   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  12   # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
  13   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  14   includes = {
  15     "${domain}/acme.conf" = "/var/lib/knot/tsig/${domain}/acme.conf";
  16   };
  17 in
  18 {
  19 security.install.shellHook = ''
  20   # Generated with: keymgr -t acme_${domainID}
  21   pass "servers/mermet/knot/${domain}/acme.conf" |
  22   ssh "$target" install -D -m 0400 -o ${users."knot".name} -g root /dev/stdin \
  23     ${includes."${domain}/acme.conf"}
  24 '';
  25 services.knot = {
  26   keyFiles = attrValues includes;
  27 };
  28 services.knot.zones."${domain}" = {
  29   conf = ''
  30     acl:
  31       - id: acl_localhost_acme_${domainID}
  32         address: 127.0.0.1
  33         action: update
  34         update-owner: name
  35         update-owner-match: equal
  36         update-owner-name: [_acme-challenge.${domain}]
  37         update-type: [TXT]
  38       - id: acl_tsig_acme_${domainID}
  39         address: ${servers.losurdo.ipv4}
  40         key: acme_${domainID}
  41         action: update
  42         update-owner: name
  43         update-owner-match: equal
  44         update-owner-name: [_acme-challenge.${domain}]
  45         update-type: [TXT]
  46
  47     zone:
  48       - domain: ${domain}
  49         file: ${domain}.zone
  50         serial-policy: increment
  51         semantic-checks: on
  52         notify: secondary_gandi
  53         acl: acl_gandi
  54         acl: acl_localhost_acme_${domainID}
  55         acl: acl_tsig_acme_${domainID}
  56         dnssec-signing: on
  57         dnssec-policy: rsa
  58       - domain: whoami4.${domain}
  59         module: mod-whoami
  60         file: "${pkgs.writeText "whoami4.zone" ''
  61           $TTL 1
  62           @ SOA ns root.${domain}. (
  63             ${serial domain} ; SERIAL
  64             86400 ; REFRESH
  65             86400 ; RETRY
  66             86400 ; EXPIRE
  67             1 ; MINIMUM
  68           )
  69           $TTL 86400
  70           @ NS ns
  71           ns A ${servers.mermet.ipv4}
  72         ''}"
  73   '';
  74   # TODO: increase the TTL once things have settled down
  75   data = ''
  76     $ORIGIN ${domain}.
  77     $TTL 500
  78
  79     ; SOA (Start Of Authority)
  80     @ SOA ns root (
  81       ${serial domain} ; Serial number
  82       24h   ; Refresh
  83       15m   ; Retry
  84       1000h ; Expire (1000h)
  85       1d    ; Negative caching
  86     )
  87
  88     ; NS (Name Server)
  89     @ NS ns
  90     @ NS ns6.gandi.net.
  91     whoami4 NS ns.whoami4
  92     ns.whoami4 A ${servers.mermet.ipv4}
  93
  94     ; A (DNS -> IPv4)
  95     @            A ${servers.mermet.ipv4}
  96     mermet       A ${servers.mermet.ipv4}
  97     losurdo      A ${servers.losurdo.ipv4}
  98     autoconfig   A ${servers.mermet.ipv4}
  99     doc          A ${servers.mermet.ipv4}
 100     code         A ${servers.mermet.ipv4}
 101     git          A ${servers.mermet.ipv4}
 102     imap         A ${servers.mermet.ipv4}
 103     mail         A ${servers.mermet.ipv4}
 104     mails        A ${servers.mermet.ipv4}
 105     news         A ${servers.mermet.ipv4}
 106     public-inbox A ${servers.mermet.ipv4}
 107     ns           A ${servers.mermet.ipv4}
 108     pop          A ${servers.mermet.ipv4}
 109     smtp         A ${servers.mermet.ipv4}
 110     submission   A ${servers.mermet.ipv4}
 111     www          A ${servers.mermet.ipv4}
 112     lemoutona5pattes A ${servers.mermet.ipv4}
 113     covid19      A ${servers.mermet.ipv4}
 114     openconcerto A ${servers.losurdo.ipv4}
 115
 116     ; SPF (Sender Policy Framework)
 117     @ 3600 IN SPF "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
 118     @ 3600 IN TXT "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
 119
 120     ; MX (Mail eXchange)
 121     @ 180 MX 5 mail
 122
 123     ; SRV (SeRVice)
 124     _git._tcp.git 18000 IN SRV 0 0 9418 git
 125
 126     ; CAA (Certificate Authority Authorization)
 127     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
 128     @ CAA 128 issue "letsencrypt.org"
 129   '';
 130 };
 131 /* Useless since the zone is public
 132 services.unbound.extraConfig = ''
 133   stub-zone:
 134     name: "sourcephile.fr"
 135     stub-addr: 127.0.0.1@5353
 136 '';
 137 */
 138 }