servers/mermet/knot/autogeree.net.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins.extraBuiltins) pass git;
   4   inherit (pkgs.lib) unlinesAttrs types;
   5   inherit (config) networking;
   6   inherit (config.services) knot;
   7   inherit (config) users;
   8   # Use the Git commit time of the ${domain}.nix file to set the serial number.
   9   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  10   # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
  11   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  12   mermetIPv4 = "80.67.180.129";
  13   domain = "autogeree.net";
  14 in
  15 {
  16 systemd.services."acme-${domain}".after = [
  17   "unbound.service"
  18 ];
  19 security.acme.certs."${domain}" = {
  20   email = "root+letsencrypt@${domain}";
  21   extraDomains = {
  22     "*.${domain}" = null;
  23   };
  24   group = users.groups.acme.name;
  25   allowKeysForGroup = true;
  26   keyType = "rsa4096";
  27   dnsProvider = "rfc2136";
  28   credentialsFile = pkgs.writeText "credentials" ''
  29     RFC2136_NAMESERVER=127.0.0.1:5353
  30     LEGO_EXPERIMENTAL_CNAME_SUPPORT=1
  31   '';
  32 };
  33 services.knot.zones."${domain}" = {
  34   conf = ''
  35     acl:
  36       - id: acl_acme_challenge_autogeree_net
  37         address: 127.0.0.1
  38         action: update
  39         update-owner: name
  40         update-owner-match: equal
  41         update-owner-name: [_acme-challenge.${domain}]
  42         update-type: [TXT]
  43
  44     zone:
  45       - domain: ${domain}
  46         file: ${domain}.zone
  47         serial-policy: increment
  48         semantic-checks: on
  49         notify: secondary_gandi
  50         notify: secondary_muarf
  51         acl: acl_gandi
  52         acl: acl_muarf
  53         acl: acl_acme_challenge_autogeree_net
  54         dnssec-signing: off
  55         dnssec-policy: ed25519
  56   '';
  57   # TODO: increase the TTL once things have settled down
  58   data = ''
  59     $ORIGIN ${domain}.
  60     $TTL 500
  61
  62     ; SOA (Start Of Authority)
  63     @ SOA ns admin (
  64       ${serial domain} ; Serial number
  65       24h   ; Refresh
  66       15m   ; Retry
  67       1000h ; Expire (1000h)
  68       1d    ; Negative caching
  69     )
  70
  71     ; NS (Name Server)
  72     @ NS ns
  73     @ NS ns6.gandi.net.
  74     @ NS ns0.muarf.org.
  75
  76     ; A (DNS -> IPv4)
  77     @          A ${mermetIPv4}
  78     mermet     A ${mermetIPv4}
  79     autoconfig A ${mermetIPv4}
  80     code       A ${mermetIPv4}
  81     git        A ${mermetIPv4}
  82     imap       A ${mermetIPv4}
  83     mail       A ${mermetIPv4}
  84     ns         A ${mermetIPv4}
  85     pop        A ${mermetIPv4}
  86     smtp       A ${mermetIPv4}
  87     submission A ${mermetIPv4}
  88     www        A ${mermetIPv4}
  89     chomsky    A 91.216.110.36
  90     alpes      A 195.88.84.51
  91
  92     ; SPF (Sender Policy Framework)
  93     @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
  94     @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"
  95
  96     ; MX (Mail eXchange)
  97     @ 180 MX 5 mail
  98
  99     ; SRV (SeRVice)
 100     _git._tcp.git 18000 IN SRV 0 0 9418 git
 101
 102     ; CAA (Certificate Authority Authorization)
 103     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
 104     @ CAA 128 issue "letsencrypt.org"
 105   '';
 106 };
 107 /* Useless since the zone is public
 108 services.unbound.extraConfig = ''
 109   stub-zone:
 110     name: "autogeree.net"
 111     stub-addr: 127.0.0.1@5353
 112 '';
 113 */
 114 }