]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/knot/autogeree.net.nix
nix: remove old files
[sourcephile-nix.git] / machines / mermet / knot / autogeree.net.nix
1 { inputs, pkgs, lib, config, machines, ... }:
2 let
3 domain = "autogeree.net";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 inherit (builtins) attrValues;
6 inherit (config) networking;
7 inherit (config.security) gnupg;
8 inherit (config.services) knot;
9 inherit (config.users) users;
10 in
11 {
12 services.knot.zones."${domain}" = {
13 conf = ''
14 acl:
15 - id: acl_localhost_acme_${domainID}
16 address: 127.0.0.1
17 action: update
18 update-owner: name
19 update-owner-match: equal
20 update-owner-name: [_acme-challenge.${domain}]
21 update-type: [TXT]
22 - id: acl_tsig_acme_${domainID}
23 address: ${machines.losurdo.extraArgs.ipv4}
24 key: acme_${domainID}
25 action: update
26 update-owner: name
27 update-owner-match: equal
28 update-owner-name: [_acme-challenge.${domain}]
29 update-type: [TXT]
30
31 zone:
32 - domain: ${domain}
33 file: ${domain}.zone
34 serial-policy: increment
35 semantic-checks: on
36 notify: secondary_gandi
37 notify: secondary_muarf
38 acl: acl_gandi
39 acl: acl_muarf
40 acl: acl_localhost_acme_${domainID}
41 acl: acl_tsig_acme_${domainID}
42 dnssec-signing: off
43 dnssec-policy: ed25519
44 '';
45 # TODO: increase the TTL once things have settled down
46 data = ''
47 $ORIGIN ${domain}.
48 $TTL 500
49
50 ; SOA (Start Of Authority)
51 @ SOA ns root (
52 ${toString inputs.self.lastModified} ; Serial number
53 24h ; Refresh
54 15m ; Retry
55 1000h ; Expire (1000h)
56 1d ; Negative caching
57 )
58
59 ; NS (Name Server)
60 @ NS ns
61 @ NS ns6.gandi.net.
62 @ NS ns0.muarf.org.
63
64 ; A (DNS -> IPv4)
65 @ A ${machines.mermet.extraArgs.ipv4}
66 mermet A ${machines.mermet.extraArgs.ipv4}
67 autoconfig A ${machines.mermet.extraArgs.ipv4}
68 code A ${machines.mermet.extraArgs.ipv4}
69 git A ${machines.mermet.extraArgs.ipv4}
70 imap A ${machines.mermet.extraArgs.ipv4}
71 mail A ${machines.mermet.extraArgs.ipv4}
72 ns A ${machines.mermet.extraArgs.ipv4}
73 pop A ${machines.mermet.extraArgs.ipv4}
74 smtp A ${machines.mermet.extraArgs.ipv4}
75 submission A ${machines.mermet.extraArgs.ipv4}
76 www A ${machines.mermet.extraArgs.ipv4}
77 chomsky A 91.216.110.36
78 alpes A 195.88.84.51
79
80 ; SPF (Sender Policy Framework)
81 @ 3600 IN SPF "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
82 @ 3600 IN TXT "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
83
84 ; MX (Mail eXchange)
85 @ 180 MX 5 mail
86
87 ; SRV (SeRVice)
88 _git._tcp.git 18000 IN SRV 0 0 9418 git
89
90 ; CAA (Certificate Authority Authorization)
91 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
92 @ CAA 128 issue "letsencrypt.org"
93 '';
94 };
95 users.groups.keys.members = [ users.knot.name ];
96 services.knot = {
97 keyFiles = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".path ];
98 };
99 security.gnupg.secrets."knot/tsig/${domain}/acme.conf" = {
100 # Generated with: keymgr -t acme_${domainID}
101 user = users.knot.name;
102 };
103 systemd.services.knot = {
104 after = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
105 wants = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
106 };
107 /* Useless since the zone is public
108 services.unbound.extraConfig = ''
109 stub-zone:
110 name: "autogeree.net"
111 stub-addr: 127.0.0.1@5353
112 '';
113 */
114 }