]> Git — Sourcephile - sourcephile-nix.git/blob - install/logical/friot/nsd/commonsoft.nix
rspamd: brittle install
[sourcephile-nix.git] / install / logical / friot / nsd / commonsoft.nix
1 {pkgs, lib, config, ...}:
2 let inherit (builtins) toString toPath readFile;
3 inherit (builtins.extraBuiltins) pass;
4 inherit (pkgs.lib) unlinesAttrs;
5 inherit (config) networking;
6 inherit (config.services) nsd dkim;
7 serial = zone: toString (builtins.extraBuiltins.git ./. [ "log" "-1" "--format=%ct" "--" (zone + ".nix") ]);
8 /*
9 serial = file: lib.removeSuffix "\n" (readFile
10 (pkgs.runCommand "zone-serial"
11 { buildInputs = [ pkgs.git ];
12 buildDepends = [ (toPath ./. + file) ];
13 preferLocalBuild = true;
14 allowSubstitutes = false;
15 } ''
16 cd ${toPath ./.}
17 ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
18 ''));
19 */
20 ipv4 = networking.zones.net.ipv4;
21 commonsoftZone = tld: ''
22 ; A (DNS -> IPv4)
23 @ A ${ipv4}
24 autoconfig A ${ipv4}
25 git A ${ipv4}
26 imap A ${ipv4}
27 mail A ${ipv4}
28 ns A ${ipv4}
29 pop A ${ipv4}
30 redmine A ${ipv4}
31 smtp A ${ipv4}
32 submission A ${ipv4}
33 www A ${ipv4}
34
35 ; SPF (Sender Policy Framework)
36 @ 3600 IN SPF "v=spf1 mx ip4:${ipv4} -all"
37 @ 3600 IN TXT "v=spf1 mx ip4:${ipv4} -all"
38
39 ; MX (Mail eXchange)
40 @ 180 MX 5 ${ipv4}
41
42 ; SRV (SeRVice)
43 _git._tcp.git 18000 IN SRV 0 0 9418 git
44
45 ; TXT (TeXT)
46 ''
47 + unlinesAttrs
48 (selector: sel: sel.dns)
49 dkim.domains."${networking.domainBase}.${tld}".selectors;
50 in
51 {
52 config = {
53 services.dkim.domains =
54 let domain = rec {
55 selector = "2019010101";
56 selectors = {
57 "2019010101" = {
58 key = pass "${networking.domainBase}/dkim/2019010101/key" + "\n";
59 dns = ''
60 2019010101._domainkey IN TXT ( "v=DKIM1; k=rsa; "
61 "p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7EKzverbG+5JF+yFjH3MrxLyauiHyLqBbV/8LEMunoKXF8sqhBpQtAQXruLqsyUkxR/4CAyPMyzmcdrU43boMj9yFqLrg/kEz2RIvai9jXBqRoWRW1y7F0LbZmdtOTncuDSP8Zzo02XUzsOC4f/C3tEQHS5rchzfhU5FY1CeO6eBMV79qKBOvGMKahQTrrtU6olAAJxOhn6wRuwSf"
62 "+m3on1OqiuXYYIgNHKdRhJ8gDwIm/3LEpYMD0gTgJiyclCLoLGHGtKZy1Wf9xV9/7V6fHE4JW5SDivwslVTL+KPXOlIpo5NDHpMxPYOcIg2K4Rj/j7jhavo+fG43q1LhwaPkEMQMbplgnjeMY8300odRiklTkMMpH0m35ZNeHQJSRpEtV8y5xUNxVaGzfqX5iStwV/mQ1KnZSe8ORTNq+eTTFnDk6zdUXjagcf0wO6QsSTeAz/G8CqOBbwmrU+q"
63 "F8WbGAeRnhz51mH6fTTfsQ1nwjAiF4ou+eQGTkTMN23KkCKpuozJnxqx4DCEr6J1bL83fhXw7CgcfgKgTOk/HFJpeiGhqodw18r4DWBA6G57z9utm7Mr/9SoVnMq6iK9iEcbCllLR8Sz4viatLSRzhodbk7hfvXS3jmCFjILAjFmA7aMTemDMBDQhpAGF9F8sjFUbEJIZjKrWWtSTdO8DilDqN8CAwEAAQ=="
64 ) ;
65 '';
66 };
67 };
68 }; in
69 {
70 "${networking.domainBase}.org" = domain;
71 "${networking.domainBase}.net" = domain;
72 "${networking.domainBase}.coop" = domain;
73 };
74 services.nsd = {
75 zones = {
76 # NOTE: cannot use networking.domain as attr key: infinite recursion
77 "commonsoft.org" = {
78 data = ''
79 $ORIGIN ${networking.domainBase}.org.
80 $TTL 86400
81
82 ; SOA (Start Of Authority)
83 @ SOA ns admin (
84 ${serial networking.domainBase} ; Serial number
85 1d ; Refresh
86 15m ; Retry
87 2592000 ; Expire
88 1d ; TTL (Time To Live) minimum
89 )
90
91 ; NS (Name Server)
92 @ NS ns
93 ;@ NS ns6.gandi.net.
94 ''
95 + commonsoftZone "org";
96 };
97 "commonsoft.coop" = {
98 data = ''
99 $ORIGIN ${networking.domainBase}.coop.
100 $TTL 86400
101
102 ; SOA (Start Of Authority)
103 @ SOA ns admin (
104 ${serial networking.domainBase} ; Serial number
105 1d ; Refresh
106 15m ; Retry
107 2592000 ; Expire
108 1d ; TTL (Time To Live) minimum
109 )
110
111 ; NS (Name Server)
112 @ NS ns
113 ;@ NS ns6.gandi.net.
114 '' + commonsoftZone "coop";
115 };
116 "commonsoft.net" = {
117 data = ''
118 $ORIGIN ${networking.domainBase}.net.
119 $TTL 86400
120
121 ; SOA (Start Of Authority)
122 @ SOA ns admin (
123 ${serial networking.domainBase} ; Serial number
124 1d ; Refresh
125 15m ; Retry
126 2592000 ; Expire
127 1d ; TTL (Time To Live) minimum
128 )
129
130 ; NS (Name Server)
131 @ NS ns
132 ;@ NS ns6.gandi.net.
133 '' + commonsoftZone "net";
134 };
135 };
136 };
137 };
138 }