]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/knot/sourcephile.fr.nix
gitolite: update
[sourcephile-nix.git] / servers / mermet / knot / sourcephile.fr.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (builtins.extraBuiltins) pass git;
4 inherit (pkgs.lib) unlinesAttrs types;
5 inherit (config) networking;
6 inherit (config.services) knot;
7 inherit (config) users;
8 # Use the Git commit time of the ${domain}.nix file to set the serial number.
9 # WARNING: the ${domain}.nix must be committed into Git for this to work.
10 # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
11 serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
12 mermetIPv4 = "80.67.180.129";
13 domain = "sourcephile.fr";
14 in
15 {
16 systemd.services."acme-${domain}".after = [
17 "unbound.service"
18 ];
19 security.acme.certs."${domain}" = {
20 email = "root@${domain}";
21 extraDomains = {
22 "*.${domain}" = null;
23 };
24 group = users.groups.acme.name;
25 allowKeysForGroup = true;
26 keyType = "rsa4096";
27 dnsProvider = "rfc2136";
28 credentialsFile = pkgs.writeText "credentials" ''
29 RFC2136_NAMESERVER=127.0.0.1:5353
30 LEGO_EXPERIMENTAL_CNAME_SUPPORT=1
31 '';
32 };
33 services.knot.zones."${domain}" = {
34 conf = ''
35 acl:
36 - id: acl_acme_challenge_sourcephile_fr
37 address: 127.0.0.1
38 action: update
39 update-owner: name
40 update-owner-match: equal
41 update-owner-name: [_acme-challenge.${domain}]
42 update-type: [TXT]
43
44 zone:
45 - domain: ${domain}
46 file: ${domain}.zone
47 serial-policy: increment
48 semantic-checks: on
49 notify: secondary_gandi
50 acl: acl_gandi
51 acl: acl_acme_challenge_sourcephile_fr
52 dnssec-signing: on
53 dnssec-policy: rsa
54 '';
55 # TODO: increase the TTL once things have settled down
56 data = ''
57 $ORIGIN ${domain}.
58 $TTL 500
59
60 ; SOA (Start Of Authority)
61 @ SOA ns admin (
62 ${serial domain} ; Serial number
63 24h ; Refresh
64 15m ; Retry
65 1000h ; Expire (1000h)
66 1d ; Negative caching
67 )
68
69 ; NS (Name Server)
70 @ NS ns
71 @ NS ns6.gandi.net.
72
73 ; A (DNS -> IPv4)
74 @ A ${mermetIPv4}
75 mermet A ${mermetIPv4}
76 autoconfig A ${mermetIPv4}
77 doc A ${mermetIPv4}
78 code A ${mermetIPv4}
79 git A ${mermetIPv4}
80 imap A ${mermetIPv4}
81 mail A ${mermetIPv4}
82 ns A ${mermetIPv4}
83 pop A ${mermetIPv4}
84 smtp A ${mermetIPv4}
85 submission A ${mermetIPv4}
86 www A ${mermetIPv4}
87
88 ; SPF (Sender Policy Framework)
89 @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
90 @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"
91
92 ; MX (Mail eXchange)
93 @ 180 MX 5 mail
94
95 ; SRV (SeRVice)
96 _git._tcp.git 18000 IN SRV 0 0 9418 git
97
98 ; CAA (Certificate Authority Authorization)
99 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
100 @ CAA 128 issue "letsencrypt.org"
101 '';
102 };
103 /* Useless since the zone is public
104 services.unbound.extraConfig = ''
105 stub-zone:
106 name: "sourcephile.fr"
107 stub-addr: 127.0.0.1@5353
108 '';
109 */
110 }