hosts/mermet/knot/sourcephile.fr.nix

   1 { pkgs, lib, config, inputs, hosts, info, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
   5   inherit (config) networking;
   6   inherit (config.services) knot;
   7   inherit (config.users) users groups;
   8   zoneData =
   9     # TODO: increase the TTL once things have settled down
  10     ''
  11       $ORIGIN ${domain}.
  12       $TTL 500
  13
  14       ; SOA (Start Of Authority)
  15       @ SOA ns root (
  16         ${toString inputs.self.lastModified} ; Serial number
  17         24h   ; Refresh
  18         15m   ; Retry
  19         1000h ; Expire (1000h)
  20         1d    ; Negative caching
  21       )
  22
  23       ; NS (Name Server)
  24       @ NS ns
  25       @ NS ${info.gandi.dns.secondary.ns.name}.
  26       i NS ns
  27       whoami4 NS ns.whoami4
  28       ns.whoami4 A ${hosts.mermet._module.args.ipv4}
  29
  30       ; A (DNS -> IPv4)
  31       @            A ${hosts.mermet._module.args.ipv4}
  32       mermet       A ${hosts.mermet._module.args.ipv4}
  33       autoconfig   A ${hosts.mermet._module.args.ipv4}
  34       calibre      A ${hosts.mermet._module.args.ipv4}
  35       doc          A ${hosts.mermet._module.args.ipv4}
  36       git          A ${hosts.mermet._module.args.ipv4}
  37       imap         A ${hosts.mermet._module.args.ipv4}
  38       mail         A ${hosts.mermet._module.args.ipv4}
  39       mails        A ${hosts.mermet._module.args.ipv4}
  40       news         A ${hosts.mermet._module.args.ipv4}
  41       public-inbox A ${hosts.mermet._module.args.ipv4}
  42       ns           A ${hosts.mermet._module.args.ipv4}
  43       pop          A ${hosts.mermet._module.args.ipv4}
  44       smtp         A ${hosts.mermet._module.args.ipv4}
  45       submission   A ${hosts.mermet._module.args.ipv4}
  46       www          A ${hosts.mermet._module.args.ipv4}
  47       lemoutona5pattes A ${hosts.mermet._module.args.ipv4}
  48       croc         A ${hosts.mermet._module.args.ipv4}
  49       stun         A ${hosts.mermet._module.args.ipv4}
  50       turn         A ${hosts.mermet._module.args.ipv4}
  51       whoami       A ${hosts.mermet._module.args.ipv4}
  52       code          A ${hosts.mermet._module.args.ipv4}
  53       miniflux      A ${hosts.mermet._module.args.ipv4}
  54
  55       ; CNAME (Canonical Name)
  56       openconcerto     CNAME losurdo
  57       xmpp             CNAME mermet
  58       salons           CNAME mermet
  59       tmp              CNAME mermet
  60       proxy65          CNAME mermet
  61       cryptpad         CNAME losurdo
  62       cryptpad-api     CNAME losurdo
  63       cryptpad-files   CNAME losurdo
  64       cryptpad-sandbox CNAME losurdo
  65       mumble           CNAME mermet
  66       freeciv          CNAME losurdo
  67       nix-serve        CNAME losurdo
  68       nix-extracache   CNAME losurdo
  69       nix-localcache   CNAME lan.losurdo
  70       sftp             CNAME losurdo
  71
  72       ; DMARC (Domain-based Message Authentication, Reporting and Conformance)
  73       _dmarc 3600 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:root+dmarc+aggregate@sourcephile.fr; ruf=mailto:root+dmarc+forensic@sourcephile.fr"
  74
  75       ; SPF (Sender Policy Framework)
  76       @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
  77
  78       ; SRV (SeRVice)
  79       _git._tcp.git             18000 IN SRV 0 0 9418 git
  80       _stun._udp                18000 IN SRV 0 5 3478 stun
  81       _xmpp-client._tcp         18000 IN SRV 0 5 5222 xmpp
  82       _xmpp-server._tcp         18000 IN SRV 0 5 5269 xmpp
  83       _xmpp-server._tcp.salons  18000 IN SRV 0 5 5269 xmpp
  84       _xmpps-client._tcp        18000 IN SRV 0 5 5223 xmpp
  85       _xmpps-server._tcp        18000 IN SRV 0 5 5270 xmpp
  86       _xmpps-server._tcp.salons 18000 IN SRV 0 5 5270 xmpp
  87
  88       ; CAA (Certificate Authority Authorization)
  89       ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
  90       @ CAA 128 issue "letsencrypt.org; validationmethods=dns-01"
  91     '';
  92   # Incorrect:
  93   # accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/78014180
  94 in
  95 {
  96   services.knot.settingsFreeform = {
  97     remote.ns_iodine.address = "127.0.0.1@1053";
  98     acl."acl_localhost_acme_${domainID}" = {
  99       address = "127.0.0.1";
 100       action = "update";
 101       update-owner = "name";
 102       update-owner-match = "equal";
 103       update-owner-name = [ "_acme-challenge" ];
 104       update-type = [ "TXT" ];
 105     };
 106     acl."acl_tsig_acme_${domainID}" = {
 107       key = "acme_${domainID}";
 108       action = "update";
 109       update-owner = "name";
 110       update-owner-match = "equal";
 111       update-owner-name = [ "_acme-challenge" ];
 112       update-type = [ "TXT" ];
 113     };
 114     acl."acl_tsig_losurdo_${domainID}" = {
 115       key = "losurdo_${domainID}";
 116       action = "update";
 117       update-owner = "name";
 118       update-owner-match = "equal";
 119       update-owner-name = [ "losurdo" "lan.losurdo" ];
 120       update-type = [ "A" "AAAA" ];
 121     };
 122     mod-dnsproxy.proxy_iodine = {
 123       remote = "ns_iodine";
 124       fallback = "off";
 125     };
 126     zone."${domain}" = {
 127       file = "${domain}.zone";
 128       serial-policy = "increment";
 129       semantic-checks = true;
 130       notify = [
 131         "secondary_gandi"
 132       ];
 133       acl = [
 134         "acl_gandi"
 135         "acl_localhost_acme_${domainID}"
 136         "acl_tsig_acme_${domainID}"
 137         "acl_tsig_losurdo_${domainID}"
 138       ];
 139       dnssec-signing = true;
 140       dnssec-policy = "rsa";
 141     };
 142     #zone."i.${domain}" = {
 143     #  module = "mod-dnsproxy/proxy_iodine";
 144     #};
 145     zone."whoami4.${domain}" = {
 146       module = "mod-whoami";
 147       file = pkgs.writeText "whoami4.zone" ''
 148         $TTL 1
 149         @ SOA ns root.${domain}. (
 150           0     ; SERIAL
 151           86400 ; REFRESH
 152           86400 ; RETRY
 153           86400 ; EXPIRE
 154           1 ; MINIMUM
 155         )
 156         $TTL 86400
 157         @ NS ns
 158         ns A ${hosts.mermet._module.args.ipv4}
 159       '';
 160     };
 161   };
 162   services.knot = {
 163     keyFiles = [
 164       "/run/credentials/knot.service/${domain}.acme.conf"
 165       # Generated with: keymgr -t losurdo_${domainID}
 166       "/run/credentials/knot.service/losurdo.conf"
 167     ];
 168   };
 169   systemd.services.knot = {
 170     serviceConfig = {
 171       ExecStartPre = [
 172         ''
 173           +${pkgs.coreutils}/bin/install -D -o ${users.knot.name} -g ${groups."knot".name} -m 700 \
 174            ${pkgs.writeText "${domain}.zone" zoneData} \
 175            /var/lib/knot/zones/${domain}.zone
 176         ''
 177       ];
 178       LoadCredentialEncrypted = [
 179         "${domain}.acme.conf:${./. + "/${domain}/acme.conf.cred"}"
 180         "losurdo.conf:${./. + "/${domain}/losurdo.conf.cred"}"
 181       ];
 182     };
 183   };
 184   networking.nftables.ruleset = ''
 185     table inet filter {
 186       set output-net-knot-ipv4 { type ipv4_addr; elements = { ${info.gandi.dns.secondary.axfr.ipv4} }; }
 187       set output-net-knot-ipv6 { type ipv6_addr; elements = { ${info.gandi.dns.secondary.axfr.ipv6} }; }
 188     }
 189   '';
 190   /* Useless since the zone is public
 191     services.unbound.settings = {
 192     stub-zone = {
 193     name = domain;
 194     stub-addr = "127.0.0.1@5353";
 195     };
 196     };
 197     '';
 198   */
 199 }