]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/knot/sourcephile.fr.nix
acme: fix propagation timeout
[sourcephile-nix.git] / servers / mermet / knot / sourcephile.fr.nix
1 { pkgs, lib, config, servers, ... }:
2 let
3 domain = "sourcephile.fr";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 inherit (builtins) attrValues;
6 inherit (builtins.extraBuiltins) pass git;
7 inherit (config) networking;
8 inherit (config.services) knot;
9 inherit (config.users) users groups;
10 # Use the Git commit time of the ${domain}.nix file to set the serial number.
11 # WARNING: the ${domain}.nix must be committed into Git for this to work.
12 # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
13 serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
14 includes = {
15 "${domain}/acme.conf" = "/var/lib/knot/tsig/${domain}/acme.conf";
16 };
17 in
18 {
19 install.shellHook = ''
20 # Generated with: keymgr -t acme_${domainID}
21 pass "servers/mermet/knot/${domain}/acme.conf" |
22 ssh "$target" install -D -m 0400 -o ${users."knot".name} -g root /dev/stdin \
23 ${includes."${domain}/acme.conf"}
24 '';
25 services.knot = {
26 keyFiles = attrValues includes;
27 };
28 services.knot.zones."${domain}" = {
29 conf = ''
30 acl:
31 - id: acl_localhost_acme_${domainID}
32 address: 127.0.0.1
33 action: update
34 update-owner: name
35 update-owner-match: equal
36 update-owner-name: [_acme-challenge.${domain}]
37 update-type: [TXT]
38 - id: acl_tsig_acme_${domainID}
39 address: ${servers.losurdo.ipv4}
40 key: acme_${domainID}
41 action: update
42 update-owner: name
43 update-owner-match: equal
44 update-owner-name: [_acme-challenge.${domain}]
45 update-type: [TXT]
46
47 zone:
48 - domain: ${domain}
49 file: ${domain}.zone
50 serial-policy: increment
51 semantic-checks: on
52 notify: secondary_gandi
53 acl: acl_gandi
54 acl: acl_localhost_acme_${domainID}
55 acl: acl_tsig_acme_${domainID}
56 dnssec-signing: on
57 dnssec-policy: rsa
58 - domain: whoami4.${domain}
59 module: mod-whoami
60 file: "${pkgs.writeText "whoami4.zone" ''
61 $TTL 1
62 @ SOA ns root.${domain}. (
63 ${serial domain} ; SERIAL
64 86400 ; REFRESH
65 86400 ; RETRY
66 86400 ; EXPIRE
67 1 ; MINIMUM
68 )
69 $TTL 86400
70 @ NS ns
71 ns A ${servers.mermet.ipv4}
72 ''}"
73 '';
74 # TODO: increase the TTL once things have settled down
75 data = ''
76 $ORIGIN ${domain}.
77 $TTL 500
78
79 ; SOA (Start Of Authority)
80 @ SOA ns root (
81 ${serial domain} ; Serial number
82 24h ; Refresh
83 15m ; Retry
84 1000h ; Expire (1000h)
85 1d ; Negative caching
86 )
87
88 ; NS (Name Server)
89 @ NS ns
90 @ NS ns6.gandi.net.
91 whoami4 NS ns.whoami4
92 ns.whoami4 A ${servers.mermet.ipv4}
93
94 ; A (DNS -> IPv4)
95 @ A ${servers.mermet.ipv4}
96 mermet A ${servers.mermet.ipv4}
97 losurdo A ${servers.losurdo.ipv4}
98 autoconfig A ${servers.mermet.ipv4}
99 doc A ${servers.mermet.ipv4}
100 code A ${servers.mermet.ipv4}
101 git A ${servers.mermet.ipv4}
102 imap A ${servers.mermet.ipv4}
103 mail A ${servers.mermet.ipv4}
104 mails A ${servers.mermet.ipv4}
105 news A ${servers.mermet.ipv4}
106 public-inbox A ${servers.mermet.ipv4}
107 ns A ${servers.mermet.ipv4}
108 pop A ${servers.mermet.ipv4}
109 smtp A ${servers.mermet.ipv4}
110 submission A ${servers.mermet.ipv4}
111 www A ${servers.mermet.ipv4}
112 lemoutona5pattes A ${servers.mermet.ipv4}
113 covid19 A ${servers.mermet.ipv4}
114 openconcerto A ${servers.losurdo.ipv4}
115
116 ; SPF (Sender Policy Framework)
117 @ 3600 IN SPF "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
118 @ 3600 IN TXT "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
119
120 ; MX (Mail eXchange)
121 @ 180 MX 5 mail
122
123 ; SRV (SeRVice)
124 _git._tcp.git 18000 IN SRV 0 0 9418 git
125
126 ; CAA (Certificate Authority Authorization)
127 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
128 @ CAA 128 issue "letsencrypt.org"
129 '';
130 };
131 /* Useless since the zone is public
132 services.unbound.extraConfig = ''
133 stub-zone:
134 name: "sourcephile.fr"
135 stub-addr: 127.0.0.1@5353
136 '';
137 */
138 }