]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/knot/autogeree.net.nix
acme: start unbound before
[sourcephile-nix.git] / servers / mermet / knot / autogeree.net.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (builtins.extraBuiltins) pass git;
4 inherit (pkgs.lib) unlinesAttrs types;
5 inherit (config) networking;
6 inherit (config.services) knot;
7 inherit (config) users;
8 # Use the Git commit time of the ${domain}.nix file to set the serial number.
9 # WARNING: the ${domain}.nix must be committed into Git for this to work.
10 # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
11 serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
12 mermetIPv4 = "80.67.180.129";
13 domain = "autogeree.net";
14 in
15 {
16 systemd.services."acme-${domain}".after = [
17 "unbound.service"
18 ];
19 security.acme.certs."${domain}" = {
20 email = "root+letsencrypt@${domain}";
21 extraDomains = {
22 "*.${domain}" = null;
23 };
24 group = users.groups.acme.name;
25 allowKeysForGroup = true;
26 keyType = "rsa4096";
27 dnsProvider = "rfc2136";
28 credentialsFile = pkgs.writeText "credentials" ''
29 RFC2136_NAMESERVER=127.0.0.1:5353
30 LEGO_EXPERIMENTAL_CNAME_SUPPORT=1
31 '';
32 };
33 services.knot.zones."${domain}" = {
34 conf = ''
35 acl:
36 - id: acl_acme_challenge_autogeree_net
37 address: 127.0.0.1
38 action: update
39 update-owner: name
40 update-owner-match: equal
41 update-owner-name: [_acme-challenge.${domain}]
42 update-type: [TXT]
43
44 zone:
45 - domain: ${domain}
46 file: ${domain}.zone
47 serial-policy: increment
48 semantic-checks: on
49 notify: secondary_gandi
50 notify: secondary_muarf
51 acl: acl_gandi
52 acl: acl_muarf
53 acl: acl_acme_challenge_autogeree_net
54 dnssec-signing: off
55 dnssec-policy: ed25519
56 '';
57 # TODO: increase the TTL once things have settled down
58 data = ''
59 $ORIGIN ${domain}.
60 $TTL 500
61
62 ; SOA (Start Of Authority)
63 @ SOA ns admin (
64 ${serial domain} ; Serial number
65 24h ; Refresh
66 15m ; Retry
67 1000h ; Expire (1000h)
68 1d ; Negative caching
69 )
70
71 ; NS (Name Server)
72 @ NS ns
73 @ NS ns6.gandi.net.
74 @ NS ns0.muarf.org.
75
76 ; A (DNS -> IPv4)
77 @ A ${mermetIPv4}
78 mermet A ${mermetIPv4}
79 autoconfig A ${mermetIPv4}
80 code A ${mermetIPv4}
81 git A ${mermetIPv4}
82 imap A ${mermetIPv4}
83 mail A ${mermetIPv4}
84 ns A ${mermetIPv4}
85 pop A ${mermetIPv4}
86 smtp A ${mermetIPv4}
87 submission A ${mermetIPv4}
88 www A ${mermetIPv4}
89 chomsky A 91.216.110.36
90 alpes A 195.88.84.51
91
92 ; SPF (Sender Policy Framework)
93 @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
94 @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"
95
96 ; MX (Mail eXchange)
97 @ 180 MX 5 mail
98
99 ; SRV (SeRVice)
100 _git._tcp.git 18000 IN SRV 0 0 9418 git
101
102 ; CAA (Certificate Authority Authorization)
103 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
104 @ CAA 128 issue "letsencrypt.org"
105 '';
106 };
107 /* Useless since the zone is public
108 services.unbound.extraConfig = ''
109 stub-zone:
110 name: "autogeree.net"
111 stub-addr: 127.0.0.1@5353
112 '';
113 */
114 }