servers/mermet/knot/sourcephile.fr.nix

   1 { pkgs, lib, config, servers, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (builtins) attrValues;
   6   inherit (builtins.extraBuiltins) git;
   7   inherit (config) networking;
   8   inherit (config.security) pass;
   9   inherit (config.services) knot;
  10   inherit (config.users) users groups;
  11   # Use the Git commit time of the ${domain}.nix file to set the serial number.
  12   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  13   # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
  14   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  15 in
  16 {
  17 services.knot.zones."${domain}" = {
  18   conf = ''
  19     acl:
  20       - id: acl_localhost_acme_${domainID}
  21         address: 127.0.0.1
  22         action: update
  23         update-owner: name
  24         update-owner-match: equal
  25         update-owner-name: [_acme-challenge.${domain}]
  26         update-type: [TXT]
  27       - id: acl_tsig_acme_${domainID}
  28         address: ${servers.losurdo.ipv4}
  29         key: acme_${domainID}
  30         action: update
  31         update-owner: name
  32         update-owner-match: equal
  33         update-owner-name: [_acme-challenge.${domain}]
  34         update-type: [TXT]
  35
  36     zone:
  37       - domain: ${domain}
  38         file: ${domain}.zone
  39         serial-policy: increment
  40         semantic-checks: on
  41         notify: secondary_gandi
  42         acl: acl_gandi
  43         acl: acl_localhost_acme_${domainID}
  44         acl: acl_tsig_acme_${domainID}
  45         dnssec-signing: on
  46         dnssec-policy: rsa
  47       - domain: whoami4.${domain}
  48         module: mod-whoami
  49         file: "${pkgs.writeText "whoami4.zone" ''
  50           $TTL 1
  51           @ SOA ns root.${domain}. (
  52             ${serial domain} ; SERIAL
  53             86400 ; REFRESH
  54             86400 ; RETRY
  55             86400 ; EXPIRE
  56             1 ; MINIMUM
  57           )
  58           $TTL 86400
  59           @ NS ns
  60           ns A ${servers.mermet.ipv4}
  61         ''}"
  62   '';
  63   # TODO: increase the TTL once things have settled down
  64   data = ''
  65     $ORIGIN ${domain}.
  66     $TTL 500
  67
  68     ; SOA (Start Of Authority)
  69     @ SOA ns root (
  70       ${serial domain} ; Serial number
  71       24h   ; Refresh
  72       15m   ; Retry
  73       1000h ; Expire (1000h)
  74       1d    ; Negative caching
  75     )
  76
  77     ; NS (Name Server)
  78     @ NS ns
  79     @ NS ns6.gandi.net.
  80     whoami4 NS ns.whoami4
  81     ns.whoami4 A ${servers.mermet.ipv4}
  82
  83     ; A (DNS -> IPv4)
  84     @            A ${servers.mermet.ipv4}
  85     mermet       A ${servers.mermet.ipv4}
  86     losurdo      A ${servers.losurdo.ipv4}
  87     autoconfig   A ${servers.mermet.ipv4}
  88     doc          A ${servers.mermet.ipv4}
  89     code         A ${servers.mermet.ipv4}
  90     git          A ${servers.mermet.ipv4}
  91     imap         A ${servers.mermet.ipv4}
  92     mail         A ${servers.mermet.ipv4}
  93     mails        A ${servers.mermet.ipv4}
  94     news         A ${servers.mermet.ipv4}
  95     public-inbox A ${servers.mermet.ipv4}
  96     ns           A ${servers.mermet.ipv4}
  97     pop          A ${servers.mermet.ipv4}
  98     smtp         A ${servers.mermet.ipv4}
  99     submission   A ${servers.mermet.ipv4}
 100     www          A ${servers.mermet.ipv4}
 101     lemoutona5pattes A ${servers.mermet.ipv4}
 102     covid19      A ${servers.mermet.ipv4}
 103     openconcerto A ${servers.losurdo.ipv4}
 104
 105     ; SPF (Sender Policy Framework)
 106     @ 3600 IN SPF "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
 107     @ 3600 IN TXT "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
 108
 109     ; MX (Mail eXchange)
 110     @ 180 MX 5 mail
 111
 112     ; SRV (SeRVice)
 113     _git._tcp.git 18000 IN SRV 0 0 9418 git
 114
 115     ; CAA (Certificate Authority Authorization)
 116     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
 117     @ CAA 128 issue "letsencrypt.org"
 118   '';
 119 };
 120 services.knot = {
 121   keyFiles = [ pass.secrets."knot/tsig/${domain}/acme.conf".path ];
 122 };
 123 security.pass.secrets."knot/tsig/${domain}/acme.conf" = {
 124   # Generated with: keymgr -t acme_${domainID}
 125   user = users.knot.name;
 126 };
 127 systemd.services.knot = {
 128   after = [ pass.secrets."knot/tsig/${domain}/acme.conf".service ];
 129   wants = [ pass.secrets."knot/tsig/${domain}/acme.conf".service ];
 130 };
 131 /* Useless since the zone is public
 132 services.unbound.extraConfig = ''
 133   stub-zone:
 134     name: "sourcephile.fr"
 135     stub-addr: 127.0.0.1@5353
 136 '';
 137 */
 138 }