]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/knot/autogeree.net.nix
acme: fix propagation timeout
[sourcephile-nix.git] / servers / mermet / knot / autogeree.net.nix
1 { pkgs, lib, config, servers, ... }:
2 let
3 domain = "autogeree.net";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 inherit (builtins) attrValues;
6 inherit (builtins.extraBuiltins) pass git;
7 inherit (config) networking;
8 inherit (config.services) knot;
9 inherit (config.users) users groups;
10 # Use the Git commit time of the ${domain}.nix file to set the serial number.
11 # WARNING: the ${domain}.nix must be committed into Git for this to work.
12 # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
13 serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
14 includes = {
15 "${domain}/acme.conf" = "/var/lib/knot/tsig/${domain}/acme.conf";
16 };
17 in
18 {
19 install.shellHook = ''
20 # Generated with: keymgr -t acme_${domain}
21 pass "servers/mermet/knot/${domain}/acme.conf" |
22 ssh "$target" install -D -m 0400 -o ${users."knot".name} -g root /dev/stdin \
23 ${includes."${domain}/acme.conf"}
24 '';
25 services.knot = {
26 keyFiles = attrValues includes;
27 };
28 services.knot.zones."${domain}" = {
29 conf = ''
30 acl:
31 - id: acl_localhost_acme_${domainID}
32 address: 127.0.0.1
33 action: update
34 update-owner: name
35 update-owner-match: equal
36 update-owner-name: [_acme-challenge.${domain}]
37 update-type: [TXT]
38 - id: acl_tsig_acme_${domainID}
39 address: ${servers.losurdo.ipv4}
40 key: acme_${domainID}
41 action: update
42 update-owner: name
43 update-owner-match: equal
44 update-owner-name: [_acme-challenge.${domain}]
45 update-type: [TXT]
46
47 zone:
48 - domain: ${domain}
49 file: ${domain}.zone
50 serial-policy: increment
51 semantic-checks: on
52 notify: secondary_gandi
53 notify: secondary_muarf
54 acl: acl_gandi
55 acl: acl_muarf
56 acl: acl_localhost_acme_${domainID}
57 acl: acl_tsig_acme_${domainID}
58 dnssec-signing: off
59 dnssec-policy: ed25519
60 '';
61 # TODO: increase the TTL once things have settled down
62 data = ''
63 $ORIGIN ${domain}.
64 $TTL 500
65
66 ; SOA (Start Of Authority)
67 @ SOA ns admin (
68 ${serial domain} ; Serial number
69 24h ; Refresh
70 15m ; Retry
71 1000h ; Expire (1000h)
72 1d ; Negative caching
73 )
74
75 ; NS (Name Server)
76 @ NS ns
77 @ NS ns6.gandi.net.
78 @ NS ns0.muarf.org.
79
80 ; A (DNS -> IPv4)
81 @ A ${servers.mermet.ipv4}
82 mermet A ${servers.mermet.ipv4}
83 autoconfig A ${servers.mermet.ipv4}
84 code A ${servers.mermet.ipv4}
85 git A ${servers.mermet.ipv4}
86 imap A ${servers.mermet.ipv4}
87 mail A ${servers.mermet.ipv4}
88 ns A ${servers.mermet.ipv4}
89 pop A ${servers.mermet.ipv4}
90 smtp A ${servers.mermet.ipv4}
91 submission A ${servers.mermet.ipv4}
92 www A ${servers.mermet.ipv4}
93 chomsky A 91.216.110.36
94 alpes A 195.88.84.51
95
96 ; SPF (Sender Policy Framework)
97 @ 3600 IN SPF "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
98 @ 3600 IN TXT "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
99
100 ; MX (Mail eXchange)
101 @ 180 MX 5 mail
102
103 ; SRV (SeRVice)
104 _git._tcp.git 18000 IN SRV 0 0 9418 git
105
106 ; CAA (Certificate Authority Authorization)
107 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
108 @ CAA 128 issue "letsencrypt.org"
109 '';
110 };
111 /* Useless since the zone is public
112 services.unbound.extraConfig = ''
113 stub-zone:
114 name: "autogeree.net"
115 stub-addr: 127.0.0.1@5353
116 '';
117 */
118 }