hosts/mermet/knot/autogeree.net.nix

   1 { pkgs, lib, config, inputs, hosts, info, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
   5   inherit (config) networking;
   6   inherit (config.services) knot;
   7   inherit (config.users) users groups;
   8   zoneData =
   9     # TODO: increase the TTL once things have settled down
  10     ''
  11       $ORIGIN ${domain}.
  12       $TTL 500
  13
  14       ; SOA (Start Of Authority)
  15       @ SOA ns root (
  16         ${toString inputs.self.lastModified} ; Serial number
  17         24h   ; Refresh
  18         15m   ; Retry
  19         1000h ; Expire (1000h)
  20         1d    ; Negative caching
  21       )
  22
  23       ; NS (Name Server)
  24       @ NS ns
  25       @ NS ${info.gandi.dns.secondary.ns.name}.
  26       ;@ NS ns0.muarf.org.
  27
  28       ; A (DNS -> IPv4)
  29       @          A ${hosts.mermet._module.args.ipv4}
  30       mermet     A ${hosts.mermet._module.args.ipv4}
  31       autoconfig A ${hosts.mermet._module.args.ipv4}
  32       code       A ${hosts.mermet._module.args.ipv4}
  33       git        A ${hosts.mermet._module.args.ipv4}
  34       imap       A ${hosts.mermet._module.args.ipv4}
  35       mail       A ${hosts.mermet._module.args.ipv4}
  36       ns         A ${hosts.mermet._module.args.ipv4}
  37       pleroma    A ${hosts.mermet._module.args.ipv4}
  38       pop        A ${hosts.mermet._module.args.ipv4}
  39       smtp       A ${hosts.mermet._module.args.ipv4}
  40       submission A ${hosts.mermet._module.args.ipv4}
  41       www        A ${hosts.mermet._module.args.ipv4}
  42       chomsky    A 91.216.110.36
  43       alpes      A 195.88.84.51
  44
  45       ; SPF (Sender Policy Framework)
  46       @ 3600 IN SPF "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
  47       @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
  48
  49       ; MX (Mail eXchange)
  50       @ 180 MX 5 mail
  51
  52       ; SRV (SeRVice)
  53       _git._tcp.git 18000 IN SRV 0 0 9418 git
  54
  55       ; CAA (Certificate Authority Authorization)
  56       ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
  57       @ CAA 128 issue "letsencrypt.org"
  58     '';
  59 in
  60 {
  61   services.knot.settingsFreeform = {
  62     acl."acl_localhost_acme_${domainID}" = {
  63       address = "127.0.0.1";
  64       action = "update";
  65       update-owner = "name";
  66       update-owner-match = "equal";
  67       update-owner-name = [ "_acme-challenge" ];
  68       update-type = [ "TXT" ];
  69     };
  70     acl."acl_tsig_acme_${domainID}" = {
  71       key = "acme_${domainID}";
  72       action = "update";
  73       update-owner = "name";
  74       update-owner-match = "equal";
  75       update-owner-name = [ "_acme-challenge" ];
  76       update-type = [ "TXT" ];
  77     };
  78     zone."${domain}" = {
  79       file = "${domain}.zone";
  80       serial-policy = "increment";
  81       semantic-checks = true;
  82       notify = [
  83         "secondary_gandi"
  84         #"secondary_muarf"
  85       ];
  86       acl = [
  87         "acl_gandi"
  88         #"acl_muarf"
  89         "acl_localhost_acme_${domainID}"
  90         "acl_tsig_acme_${domainID}"
  91       ];
  92       dnssec-signing = false;
  93       dnssec-policy = "ed25519";
  94     };
  95   };
  96   networking.nftables.ruleset = ''
  97     table inet filter {
  98       set output-net-knot-ipv4 { type ipv4_addr; elements = { ${info.gandi.dns.secondary.axfr.ipv4} }; }
  99       set output-net-knot-ipv6 { type ipv6_addr; elements = { ${info.gandi.dns.secondary.axfr.ipv6} }; }
 100     }
 101   '';
 102   services.knot = {
 103     keyFiles = [
 104       "/run/credentials/knot.service/${domain}.acme.conf"
 105     ];
 106   };
 107   systemd.services.knot = {
 108     serviceConfig = {
 109       ExecStartPre = [
 110         ''
 111           +${pkgs.coreutils}/bin/install -D -o ${users.knot.name} -g ${groups."knot".name} -m 700 \
 112            ${pkgs.writeText "${domain}.zone" zoneData} \
 113            /var/lib/knot/zones/${domain}.zone
 114         ''
 115       ];
 116       LoadCredentialEncrypted = [
 117         "${domain}.acme.conf:${./. + "/${domain}/acme.conf.cred"}"
 118       ];
 119     };
 120   };
 121   /* Useless since the zone is public
 122     services.unbound.settings = {
 123     stub-zone = {
 124     name = domain;
 125     stub-addr = "127.0.0.1@5353";
 126     };
 127     };
 128     '';
 129   */
 130 }