servers/mermet/knot/sourcephile.fr.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins.extraBuiltins) pass git;
   4   inherit (pkgs.lib) unlinesAttrs types;
   5   inherit (config) networking;
   6   inherit (config.services) knot;
   7   inherit (config) users;
   8   # Use the Git commit time of the ${domain}.nix file to set the serial number.
   9   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  10   # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
  11   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  12   mermetIPv4 = "80.67.180.129";
  13   domain = "sourcephile.fr";
  14 in
  15 {
  16 environment.systemPackages = [
  17   pkgs.lego
  18 ];
  19 users = {
  20   groups = {
  21     acme = {
  22       members = [ users.users.nginx.name ];
  23     };
  24   };
  25 };
  26 security.acme.certs."${domain}" = {
  27   email = "root@${domain}";
  28   extraDomains = {
  29     "*.${domain}" = null;
  30   };
  31   group = users.groups.acme.name;
  32   allowKeysForGroup = true;
  33   keyType = "rsa4096";
  34   dnsProvider = "rfc2136";
  35   credentialsFile = pkgs.writeText "credentials" ''
  36     RFC2136_NAMESERVER=127.0.0.1:5353
  37     LEGO_EXPERIMENTAL_CNAME_SUPPORT=1
  38   '';
  39 };
  40 services.knot.zones."${domain}" = {
  41   conf = ''
  42     zone:
  43       - domain: ${domain}
  44         file: ${domain}.zone
  45         serial-policy: increment
  46         semantic-checks: on
  47         notify: secondary_gandi
  48         acl: acl_gandi
  49         acl: acl_lego
  50         acl: acl_localhost
  51         dnssec-signing: on
  52         dnssec-policy: rsa
  53   '';
  54   # TODO: increase the TTL once things have settled down
  55   data = ''
  56     $ORIGIN ${domain}.
  57     $TTL 500
  58
  59     ; SOA (Start Of Authority)
  60     @ SOA ns admin (
  61       ${serial domain} ; Serial number
  62       24h   ; Refresh
  63       15m   ; Retry
  64       1000h ; Expire (1000h)
  65       1d    ; Negative caching
  66     )
  67
  68     ; NS (Name Server)
  69     @ NS ns
  70     @ NS ns6.gandi.net.
  71
  72     ; A (DNS -> IPv4)
  73     @ A ${mermetIPv4}
  74     mermet     A ${mermetIPv4}
  75     autoconfig A ${mermetIPv4}
  76     code       A ${mermetIPv4}
  77     git        A ${mermetIPv4}
  78     imap       A ${mermetIPv4}
  79     mail       A ${mermetIPv4}
  80     ns         A ${mermetIPv4}
  81     pop        A ${mermetIPv4}
  82     smtp       A ${mermetIPv4}
  83     submission A ${mermetIPv4}
  84     www        A ${mermetIPv4}
  85
  86     ; SPF (Sender Policy Framework)
  87     @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
  88     @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"
  89
  90     ; MX (Mail eXchange)
  91     @ 180 MX 5 mail
  92
  93     ; SRV (SeRVice)
  94     _git._tcp.git 18000 IN SRV 0 0 9418 git
  95   '';
  96 };
  97 }