]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/knot/sourcephile.fr.nix
nix: remove old files
[sourcephile-nix.git] / machines / mermet / knot / sourcephile.fr.nix
1 { inputs, pkgs, lib, config, machines, ... }:
2 let
3 domain = "sourcephile.fr";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 inherit (builtins) attrValues;
6 inherit (config) networking;
7 inherit (config.security) gnupg;
8 inherit (config.services) knot;
9 inherit (config.users) users;
10 in
11 {
12 services.knot.zones."${domain}" = {
13 conf = ''
14 acl:
15 - id: acl_localhost_acme_${domainID}
16 address: 127.0.0.1
17 action: update
18 update-owner: name
19 update-owner-match: equal
20 update-owner-name: [_acme-challenge.${domain}]
21 update-type: [TXT]
22 - id: acl_tsig_acme_${domainID}
23 address: ${machines.losurdo.extraArgs.ipv4}
24 key: acme_${domainID}
25 action: update
26 update-owner: name
27 update-owner-match: equal
28 update-owner-name: [_acme-challenge.${domain}]
29 update-type: [TXT]
30
31 zone:
32 - domain: ${domain}
33 file: ${domain}.zone
34 serial-policy: increment
35 semantic-checks: on
36 notify: secondary_gandi
37 acl: acl_gandi
38 acl: acl_localhost_acme_${domainID}
39 acl: acl_tsig_acme_${domainID}
40 dnssec-signing: on
41 dnssec-policy: rsa
42 - domain: whoami4.${domain}
43 module: mod-whoami
44 file: "${pkgs.writeText "whoami4.zone" ''
45 $TTL 1
46 @ SOA ns root.${domain}. (
47 0 ; SERIAL
48 86400 ; REFRESH
49 86400 ; RETRY
50 86400 ; EXPIRE
51 1 ; MINIMUM
52 )
53 $TTL 86400
54 @ NS ns
55 ns A ${machines.mermet.extraArgs.ipv4}
56 ''}"
57 '';
58 # TODO: increase the TTL once things have settled down
59 data = ''
60 $ORIGIN ${domain}.
61 $TTL 500
62
63 ; SOA (Start Of Authority)
64 @ SOA ns root (
65 ${toString inputs.self.lastModified} ; Serial number
66 24h ; Refresh
67 15m ; Retry
68 1000h ; Expire (1000h)
69 1d ; Negative caching
70 )
71
72 ; NS (Name Server)
73 @ NS ns
74 @ NS ns6.gandi.net.
75 whoami4 NS ns.whoami4
76 ns.whoami4 A ${machines.mermet.extraArgs.ipv4}
77
78 ; A (DNS -> IPv4)
79 @ A ${machines.mermet.extraArgs.ipv4}
80 mermet A ${machines.mermet.extraArgs.ipv4}
81 losurdo A ${machines.losurdo.extraArgs.ipv4}
82 autoconfig A ${machines.mermet.extraArgs.ipv4}
83 doc A ${machines.mermet.extraArgs.ipv4}
84 code A ${machines.mermet.extraArgs.ipv4}
85 git A ${machines.mermet.extraArgs.ipv4}
86 imap A ${machines.mermet.extraArgs.ipv4}
87 mail A ${machines.mermet.extraArgs.ipv4}
88 mails A ${machines.mermet.extraArgs.ipv4}
89 news A ${machines.mermet.extraArgs.ipv4}
90 public-inbox A ${machines.mermet.extraArgs.ipv4}
91 ns A ${machines.mermet.extraArgs.ipv4}
92 pop A ${machines.mermet.extraArgs.ipv4}
93 smtp A ${machines.mermet.extraArgs.ipv4}
94 submission A ${machines.mermet.extraArgs.ipv4}
95 www A ${machines.mermet.extraArgs.ipv4}
96 lemoutona5pattes A ${machines.mermet.extraArgs.ipv4}
97 covid19 A ${machines.mermet.extraArgs.ipv4}
98 openconcerto A ${machines.losurdo.extraArgs.ipv4}
99 croc A ${machines.mermet.extraArgs.ipv4}
100 xmpp A ${machines.losurdo.extraArgs.ipv4}
101 tmp A ${machines.losurdo.extraArgs.ipv4}
102 stun A ${machines.mermet.extraArgs.ipv4}
103 turn A ${machines.mermet.extraArgs.ipv4}
104 proxy65 A ${machines.losurdo.extraArgs.ipv4}
105 cryptpad A ${machines.losurdo.extraArgs.ipv4}
106 cryptpad-api A ${machines.losurdo.extraArgs.ipv4}
107 cryptpad-files A ${machines.losurdo.extraArgs.ipv4}
108 cryptpad-sandbox A ${machines.losurdo.extraArgs.ipv4}
109
110 ; SPF (Sender Policy Framework)
111 @ 3600 IN SPF "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
112 @ 3600 IN TXT "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
113
114 ; MX (Mail eXchange)
115 @ 180 MX 5 mail
116
117 ; SRV (SeRVice)
118 _git._tcp.git 18000 IN SRV 0 0 9418 git
119 _stun._udp 18000 IN SRV 0 5 3478 stun
120 _xmpp-client._tcp 18000 IN SRV 0 5 5222 xmpp
121 _xmpp-server._tcp 18000 IN SRV 0 5 5269 xmpp
122 _xmpp-server._tcp.salons 18000 IN SRV 0 5 5269 xmpp
123
124 ; CAA (Certificate Authority Authorization)
125 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
126 @ CAA 128 issue "letsencrypt.org"
127 '';
128 };
129 users.groups.keys.members = [ users.knot.name ];
130 services.knot = {
131 keyFiles = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".path ];
132 };
133 security.gnupg.secrets."knot/tsig/${domain}/acme.conf" = {
134 # Generated with: keymgr -t acme_${domainID}
135 user = users.knot.name;
136 };
137 systemd.services.knot = {
138 after = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
139 wants = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
140 };
141 /* Useless since the zone is public
142 services.unbound.extraConfig = ''
143 stub-zone:
144 name: "sourcephile.fr"
145 stub-addr: 127.0.0.1@5353
146 '';
147 */
148 }