]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/knot/sourcephile.fr.nix
mermet: radicle: update
[sourcephile-nix.git] / hosts / mermet / knot / sourcephile.fr.nix
1 { pkgs, lib, config, inputs, hosts, info, ... }:
2 let
3 domain = "sourcephile.fr";
4 domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
5 inherit (config) networking;
6 inherit (config.services) knot;
7 inherit (config.users) users groups;
8 zoneData =
9 # TODO: increase the TTL once things have settled down
10 ''
11 $ORIGIN ${domain}.
12 $TTL 500
13
14 ; SOA (Start Of Authority)
15 @ SOA ns root (
16 ${toString inputs.self.lastModified} ; Serial number
17 24h ; Refresh
18 15m ; Retry
19 1000h ; Expire (1000h)
20 1d ; Negative caching
21 )
22
23 ; NS (Name Server)
24 @ NS ns
25 @ NS ${info.gandi.dns.secondary.ns.name}.
26 i NS ns
27 whoami4 NS ns.whoami4
28 ns.whoami4 A ${hosts.mermet._module.args.ipv4}
29
30 ; A (DNS -> IPv4)
31 @ A ${hosts.mermet._module.args.ipv4}
32 mermet A ${hosts.mermet._module.args.ipv4}
33 autoconfig A ${hosts.mermet._module.args.ipv4}
34 calibre A ${hosts.mermet._module.args.ipv4}
35 doc A ${hosts.mermet._module.args.ipv4}
36 git A ${hosts.mermet._module.args.ipv4}
37 imap A ${hosts.mermet._module.args.ipv4}
38 mail A ${hosts.mermet._module.args.ipv4}
39 mails A ${hosts.mermet._module.args.ipv4}
40 news A ${hosts.mermet._module.args.ipv4}
41 public-inbox A ${hosts.mermet._module.args.ipv4}
42 ns A ${hosts.mermet._module.args.ipv4}
43 pop A ${hosts.mermet._module.args.ipv4}
44 smtp A ${hosts.mermet._module.args.ipv4}
45 submission A ${hosts.mermet._module.args.ipv4}
46 www A ${hosts.mermet._module.args.ipv4}
47 lemoutona5pattes A ${hosts.mermet._module.args.ipv4}
48 croc A ${hosts.mermet._module.args.ipv4}
49 stun A ${hosts.mermet._module.args.ipv4}
50 turn A ${hosts.mermet._module.args.ipv4}
51 whoami A ${hosts.mermet._module.args.ipv4}
52 code A ${hosts.mermet._module.args.ipv4}
53 miniflux A ${hosts.mermet._module.args.ipv4}
54
55 ; CNAME (Canonical Name)
56 openconcerto CNAME losurdo
57 xmpp CNAME mermet
58 salons CNAME mermet
59 tmp CNAME mermet
60 proxy65 CNAME mermet
61 cryptpad CNAME losurdo
62 cryptpad-api CNAME losurdo
63 cryptpad-files CNAME losurdo
64 cryptpad-sandbox CNAME losurdo
65 mumble CNAME mermet
66 freeciv CNAME losurdo
67 nix-serve CNAME losurdo
68 nix-extracache CNAME losurdo
69 nix-localcache CNAME lan.losurdo
70 sftp CNAME losurdo
71 radicle-mermet CNAME mermet
72 radicle CNAME mermet
73 radicle-explorer CNAME radicle
74
75 ; DMARC (Domain-based Message Authentication, Reporting and Conformance)
76 _dmarc 3600 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:root+dmarc+aggregate@sourcephile.fr; ruf=mailto:root+dmarc+forensic@sourcephile.fr"
77
78 ; SPF (Sender Policy Framework)
79 @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
80
81 ; SRV (SeRVice)
82 _git._tcp.git 18000 IN SRV 0 0 9418 git
83 _stun._udp 18000 IN SRV 0 5 3478 stun
84 _xmpp-client._tcp 18000 IN SRV 0 5 5222 xmpp
85 _xmpp-server._tcp 18000 IN SRV 0 5 5269 xmpp
86 _xmpp-server._tcp.salons 18000 IN SRV 0 5 5269 xmpp
87 _xmpps-client._tcp 18000 IN SRV 0 5 5223 xmpp
88 _xmpps-server._tcp 18000 IN SRV 0 5 5270 xmpp
89 _xmpps-server._tcp.salons 18000 IN SRV 0 5 5270 xmpp
90
91 ; CAA (Certificate Authority Authorization)
92 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
93 @ CAA 128 issue "letsencrypt.org; validationmethods=dns-01"
94 '';
95 # Incorrect:
96 # accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/78014180
97 in
98 {
99 services.knot.settingsFreeform = {
100 remote.ns_iodine.address = "127.0.0.1@1053";
101 acl."acl_localhost_acme_${domainID}" = {
102 address = "127.0.0.1";
103 action = "update";
104 update-owner = "name";
105 update-owner-match = "equal";
106 update-owner-name = [ "_acme-challenge" ];
107 update-type = [ "TXT" ];
108 };
109 acl."acl_tsig_acme_${domainID}" = {
110 key = "acme_${domainID}";
111 action = "update";
112 update-owner = "name";
113 update-owner-match = "equal";
114 update-owner-name = [ "_acme-challenge" ];
115 update-type = [ "TXT" ];
116 };
117 acl."acl_tsig_losurdo_${domainID}" = {
118 key = "losurdo_${domainID}";
119 action = "update";
120 update-owner = "name";
121 update-owner-match = "equal";
122 update-owner-name = [ "losurdo" "lan.losurdo" ];
123 update-type = [ "A" "AAAA" ];
124 };
125 mod-dnsproxy.proxy_iodine = {
126 remote = "ns_iodine";
127 fallback = "off";
128 };
129 zone."${domain}" = {
130 file = "${domain}.zone";
131 serial-policy = "increment";
132 semantic-checks = true;
133 notify = [
134 "secondary_gandi"
135 ];
136 acl = [
137 "acl_gandi"
138 "acl_localhost_acme_${domainID}"
139 "acl_tsig_acme_${domainID}"
140 "acl_tsig_losurdo_${domainID}"
141 ];
142 dnssec-signing = true;
143 dnssec-policy = "rsa";
144 };
145 #zone."i.${domain}" = {
146 # module = "mod-dnsproxy/proxy_iodine";
147 #};
148 zone."whoami4.${domain}" = {
149 module = "mod-whoami";
150 file = pkgs.writeText "whoami4.zone" ''
151 $TTL 1
152 @ SOA ns root.${domain}. (
153 0 ; SERIAL
154 86400 ; REFRESH
155 86400 ; RETRY
156 86400 ; EXPIRE
157 1 ; MINIMUM
158 )
159 $TTL 86400
160 @ NS ns
161 ns A ${hosts.mermet._module.args.ipv4}
162 '';
163 };
164 };
165 services.knot = {
166 keyFiles = [
167 "/run/credentials/knot.service/${domain}.acme.conf"
168 # Generated with: keymgr -t losurdo_${domainID}
169 "/run/credentials/knot.service/losurdo.conf"
170 ];
171 };
172 systemd.services.knot = {
173 serviceConfig = {
174 ExecStartPre = [
175 ''
176 +${pkgs.coreutils}/bin/install -D -o ${users.knot.name} -g ${groups."knot".name} -m 700 \
177 ${pkgs.writeText "${domain}.zone" zoneData} \
178 /var/lib/knot/zones/${domain}.zone
179 ''
180 ];
181 LoadCredentialEncrypted = [
182 "${domain}.acme.conf:${./. + "/${domain}/acme.conf.cred"}"
183 "losurdo.conf:${./. + "/${domain}/losurdo.conf.cred"}"
184 ];
185 };
186 };
187 networking.nftables.ruleset = ''
188 table inet filter {
189 set output-net-knot-ipv4 { type ipv4_addr; elements = { ${info.gandi.dns.secondary.axfr.ipv4} }; }
190 set output-net-knot-ipv6 { type ipv6_addr; elements = { ${info.gandi.dns.secondary.axfr.ipv6} }; }
191 }
192 '';
193 /* Useless since the zone is public
194 services.unbound.settings = {
195 stub-zone = {
196 name = domain;
197 stub-addr = "127.0.0.1@5353";
198 };
199 };
200 '';
201 */
202 }