hosts/mermet/knot/autogeree.net.nix

   1 { inputs, pkgs, lib, config, hosts, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (builtins) attrValues;
   6   inherit (config) networking;
   7   inherit (config.security) gnupg;
   8   inherit (config.services) knot;
   9   inherit (config.users) users;
  10 in
  11 {
  12 services.knot.zones."${domain}" = {
  13   conf = ''
  14     acl:
  15       - id: acl_localhost_acme_${domainID}
  16         address: 127.0.0.1
  17         action: update
  18         update-owner: name
  19         update-owner-match: equal
  20         update-owner-name: [_acme-challenge]
  21         update-type: [TXT]
  22       - id: acl_tsig_acme_${domainID}
  23         key: acme_${domainID}
  24         action: update
  25         update-owner: name
  26         update-owner-match: equal
  27         update-owner-name: [_acme-challenge]
  28         update-type: [TXT]
  29
  30     zone:
  31       - domain: ${domain}
  32         file: ${domain}.zone
  33         serial-policy: increment
  34         semantic-checks: on
  35         notify: secondary_gandi
  36         #notify: secondary_muarf
  37         acl: acl_gandi
  38         #acl: acl_muarf
  39         acl: acl_localhost_acme_${domainID}
  40         acl: acl_tsig_acme_${domainID}
  41         dnssec-signing: off
  42         dnssec-policy: ed25519
  43   '';
  44   # TODO: increase the TTL once things have settled down
  45   data = ''
  46     $ORIGIN ${domain}.
  47     $TTL 500
  48
  49     ; SOA (Start Of Authority)
  50     @ SOA ns root (
  51       ${toString inputs.self.lastModified} ; Serial number
  52       24h   ; Refresh
  53       15m   ; Retry
  54       1000h ; Expire (1000h)
  55       1d    ; Negative caching
  56     )
  57
  58     ; NS (Name Server)
  59     @ NS ns
  60     @ NS ns6.gandi.net.
  61     ;@ NS ns0.muarf.org.
  62
  63     ; A (DNS -> IPv4)
  64     @          A ${hosts.mermet._module.args.ipv4}
  65     mermet     A ${hosts.mermet._module.args.ipv4}
  66     autoconfig A ${hosts.mermet._module.args.ipv4}
  67     code       A ${hosts.mermet._module.args.ipv4}
  68     git        A ${hosts.mermet._module.args.ipv4}
  69     imap       A ${hosts.mermet._module.args.ipv4}
  70     mail       A ${hosts.mermet._module.args.ipv4}
  71     ns         A ${hosts.mermet._module.args.ipv4}
  72     pop        A ${hosts.mermet._module.args.ipv4}
  73     smtp       A ${hosts.mermet._module.args.ipv4}
  74     submission A ${hosts.mermet._module.args.ipv4}
  75     www        A ${hosts.mermet._module.args.ipv4}
  76     chomsky    A 91.216.110.36
  77     alpes      A 195.88.84.51
  78
  79     ; SPF (Sender Policy Framework)
  80     @ 3600 IN SPF "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
  81     @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
  82
  83     ; MX (Mail eXchange)
  84     @ 180 MX 5 mail
  85
  86     ; SRV (SeRVice)
  87     _git._tcp.git 18000 IN SRV 0 0 9418 git
  88
  89     ; CAA (Certificate Authority Authorization)
  90     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
  91     @ CAA 128 issue "letsencrypt.org"
  92   '';
  93 };
  94 networking.nftables.ruleset = ''
  95   table inet filter {
  96     # Gandi DNS
  97     set output-net-knot-ipv4 { type ipv4_addr; elements = { 217.70.177.40 }; }
  98     set output-net-knot-ipv6 { type ipv6_addr; elements = { 2001:4b98:d:1::40 }; }
  99   }
 100 '';
 101 users.groups.keys.members = [ users.knot.name ];
 102 services.knot = {
 103   keyFiles = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".path ];
 104 };
 105 security.gnupg.secrets."knot/tsig/${domain}/acme.conf" = {
 106   # Generated with: keymgr -t acme_${domainID}
 107   user = users.knot.name;
 108 };
 109 systemd.services.knot = {
 110   after = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
 111   wants = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
 112 };
 113 /* Useless since the zone is public
 114 services.unbound.settings = {
 115   stub-zone = {
 116     name = domain;
 117     stub-addr = "127.0.0.1@5353";
 118   };
 119 };
 120 '';
 121 */
 122 }