servers/mermet/nsd/sourcephile.nix

   1 {pkgs, lib, config, ...}:
   2 with builtins;
   3 let inherit (builtins.extraBuiltins) pass;
   4     inherit (pkgs.lib) unlinesAttrs;
   5     inherit (config) networking;
   6     inherit (config.services) nsd /*dkim*/;
   7     serial = zone: toString (extraBuiltins.git ./. [ "log" "-1" "--format=%ct" "--" (zone + ".nix") ]);
   8     /*
   9     serial = file: lib.removeSuffix "\n" (readFile
  10       (pkgs.runCommand "zone-serial"
  11         { buildInputs      = [ pkgs.git ];
  12           buildDepends     = [ (toPath ./. + file) ];
  13           preferLocalBuild = true;
  14           allowSubstitutes = false;
  15         } ''
  16         cd ${toPath ./.}
  17         ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
  18       ''));
  19     */
  20     ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
  21     ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
  22     sourcephileZone = domain: ''
  23       ; A (DNS -> IPv4)
  24       @                   A ${ipv4}
  25       autoconfig          A ${ipv4}
  26       code                A ${ipv4}
  27       git                 A ${ipv4}
  28       imap                A ${ipv4}
  29       mail                A ${ipv4}
  30       ns                  A ${ipv4}
  31       pop                 A ${ipv4}
  32       redmine             A ${ipv4}
  33       smtp                A ${ipv4}
  34       submission          A ${ipv4}
  35       www                 A ${ipv4}
  36
  37       ; SPF (Sender Policy Framework)
  38       @ 3600 IN SPF "v=spf1 mx ip4:${ipv4} -all"
  39       @ 3600 IN TXT "v=spf1 mx ip4:${ipv4} -all"
  40
  41       ; MX (Mail eXchange)
  42       @ 180 MX 5 mail
  43
  44       ; SRV (SeRVice)
  45       _git._tcp.git 18000 IN SRV 0 0 9418 git
  46
  47       ; TXT (TeXT)
  48       ''
  49       /*
  50       + unlinesAttrs
  51           (selector: sel: sel.dns)
  52           dkim.domains."${domain}".selectors
  53       */;
  54 in
  55 {
  56   services.nsd = {
  57     zones = {
  58       # NOTE: cannot use networking.domain as attr key: infinite recursion.
  59       "sourcephile.fr" = {
  60         data = ''
  61           $ORIGIN ${networking.domainBase}.fr.
  62           $TTL    86400
  63
  64           ; SOA (Start Of Authority)
  65           @ SOA ns admin (
  66             ${serial networking.domainBase} ; Serial number
  67             1d      ; Refresh
  68             15m     ; Retry
  69             2592000 ; Expire
  70             1d      ; TTL (Time To Live) minimum
  71           )
  72
  73           ; NS (Name Server)
  74           @ NS ns
  75           ;@ NS ns6.gandi.net.
  76         ''
  77         + sourcephileZone "${networking.domainBase}.fr";
  78       };
  79     };
  80   };
  81   /*
  82   services.dkim.domains =
  83     let domain = rec {
  84       selector = "2020010101";
  85       selectors = {
  86         "2020010101" = {
  87           key = pass "dkim/${networking.domainBase}/2020010101/key" + "\n";
  88           dns = ''
  89             2020010101._domainkey IN TXT ( "v=DKIM1; k=rsa; "
  90                     "p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7EKzverbG+5JF+yFjH3MrxLyauiHyLqBbV/8LEMunoKXF8sqhBpQtAQXruLqsyUkxR/4CAyPMyzmcdrU43boMj9yFqLrg/kEz2RIvai9jXBqRoWRW1y7F0LbZmdtOTncuDSP8Zzo02XUzsOC4f/C3tEQHS5rchzfhU5FY1CeO6eBMV79qKBOvGMKahQTrrtU6olAAJxOhn6wRuwSf"
  91                     "+m3on1OqiuXYYIgNHKdRhJ8gDwIm/3LEpYMD0gTgJiyclCLoLGHGtKZy1Wf9xV9/7V6fHE4JW5SDivwslVTL+KPXOlIpo5NDHpMxPYOcIg2K4Rj/j7jhavo+fG43q1LhwaPkEMQMbplgnjeMY8300odRiklTkMMpH0m35ZNeHQJSRpEtV8y5xUNxVaGzfqX5iStwV/mQ1KnZSe8ORTNq+eTTFnDk6zdUXjagcf0wO6QsSTeAz/G8CqOBbwmrU+q"
  92                     "F8WbGAeRnhz51mH6fTTfsQ1nwjAiF4ou+eQGTkTMN23KkCKpuozJnxqx4DCEr6J1bL83fhXw7CgcfgKgTOk/HFJpeiGhqodw18r4DWBA6G57z9utm7Mr/9SoVnMq6iK9iEcbCllLR8Sz4viatLSRzhodbk7hfvXS3jmCFjILAjFmA7aMTemDMBDQhpAGF9F8sjFUbEJIZjKrWWtSTdO8DilDqN8CAwEAAQ=="
  93             ) ;
  94           '';
  95         };
  96       };
  97     }; in
  98     {
  99       "${networking.domainBase}.fr" = domain;
 100     };
 101   */
 102 }