]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/knot/sourcephile.fr.nix
acme: generate Let's Encrypt wildcard X.509 certificate
[sourcephile-nix.git] / servers / mermet / knot / sourcephile.fr.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (builtins.extraBuiltins) pass git;
4 inherit (pkgs.lib) unlinesAttrs types;
5 inherit (config) networking;
6 inherit (config.services) knot;
7 inherit (config) users;
8 # Use the Git commit time of the ${domain}.nix file to set the serial number.
9 # WARNING: the ${domain}.nix must be committed into Git for this to work.
10 # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
11 serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
12 mermetIPv4 = "80.67.180.129";
13 domain = "sourcephile.fr";
14 in
15 {
16 environment.systemPackages = [
17 pkgs.lego
18 ];
19 users = {
20 groups = {
21 acme = {
22 members = [ users.users.nginx.name ];
23 };
24 };
25 };
26 security.acme.certs."${domain}" = {
27 email = "root@${domain}";
28 extraDomains = {
29 "*.${domain}" = null;
30 };
31 group = users.groups.acme.name;
32 allowKeysForGroup = true;
33 keyType = "rsa4096";
34 dnsProvider = "rfc2136";
35 credentialsFile = pkgs.writeText "credentials" ''
36 RFC2136_NAMESERVER=127.0.0.1:5353
37 LEGO_EXPERIMENTAL_CNAME_SUPPORT=1
38 '';
39 };
40 services.knot.zones."${domain}" = {
41 conf = ''
42 zone:
43 - domain: ${domain}
44 file: ${domain}.zone
45 serial-policy: increment
46 semantic-checks: on
47 notify: secondary_gandi
48 acl: acl_gandi
49 acl: acl_lego
50 acl: acl_localhost
51 dnssec-signing: on
52 dnssec-policy: rsa
53 '';
54 # TODO: increase the TTL once things have settled down
55 data = ''
56 $ORIGIN ${domain}.
57 $TTL 500
58
59 ; SOA (Start Of Authority)
60 @ SOA ns admin (
61 ${serial domain} ; Serial number
62 24h ; Refresh
63 15m ; Retry
64 1000h ; Expire (1000h)
65 1d ; Negative caching
66 )
67
68 ; NS (Name Server)
69 @ NS ns
70 @ NS ns6.gandi.net.
71
72 ; A (DNS -> IPv4)
73 @ A ${mermetIPv4}
74 mermet A ${mermetIPv4}
75 autoconfig A ${mermetIPv4}
76 code A ${mermetIPv4}
77 git A ${mermetIPv4}
78 imap A ${mermetIPv4}
79 mail A ${mermetIPv4}
80 ns A ${mermetIPv4}
81 pop A ${mermetIPv4}
82 smtp A ${mermetIPv4}
83 submission A ${mermetIPv4}
84 www A ${mermetIPv4}
85
86 ; SPF (Sender Policy Framework)
87 @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
88 @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"
89
90 ; MX (Mail eXchange)
91 @ 180 MX 5 mail
92
93 ; SRV (SeRVice)
94 _git._tcp.git 18000 IN SRV 0 0 9418 git
95 '';
96 };
97 }