1 { lib, config, inputs, hostName, hosts, ... }:
3 domain = "autogeree.net";
4 domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
5 inherit (config) networking;
6 inherit (config.services) knot;
9 services.knot.zones.${domain} = {
12 - id: acl_localhost_acme_${domainID}
16 update-owner-match: equal
17 update-owner-name: [_acme-challenge]
19 - id: acl_tsig_acme_${domainID}
23 update-owner-match: equal
24 update-owner-name: [_acme-challenge]
30 serial-policy: increment
32 notify: secondary_gandi
33 #notify: secondary_muarf
36 acl: acl_localhost_acme_${domainID}
37 acl: acl_tsig_acme_${domainID}
39 dnssec-policy: ed25519
41 # TODO: increase the TTL once things have settled down
46 ; SOA (Start Of Authority)
48 ${toString inputs.self.lastModified} ; Serial number
51 1000h ; Expire (1000h)
61 @ A ${hosts.mermet._module.args.ipv4}
62 mermet A ${hosts.mermet._module.args.ipv4}
63 autoconfig A ${hosts.mermet._module.args.ipv4}
64 code A ${hosts.mermet._module.args.ipv4}
65 git A ${hosts.mermet._module.args.ipv4}
66 imap A ${hosts.mermet._module.args.ipv4}
67 mail A ${hosts.mermet._module.args.ipv4}
68 ns A ${hosts.mermet._module.args.ipv4}
69 pop A ${hosts.mermet._module.args.ipv4}
70 smtp A ${hosts.mermet._module.args.ipv4}
71 submission A ${hosts.mermet._module.args.ipv4}
72 www A ${hosts.mermet._module.args.ipv4}
73 chomsky A 91.216.110.36
76 ; SPF (Sender Policy Framework)
77 @ 3600 IN SPF "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
78 @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
84 _git._tcp.git 18000 IN SRV 0 0 9418 git
86 ; CAA (Certificate Authority Authorization)
87 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
88 @ CAA 128 issue "letsencrypt.org"
91 networking.nftables.ruleset = ''
94 set output-net-knot-ipv4 { type ipv4_addr; elements = { 217.70.177.40 }; }
95 set output-net-knot-ipv6 { type ipv6_addr; elements = { 2001:4b98:d:1::40 }; }
100 "/run/credentials/knot.service/${domain}.acme.conf"
103 systemd.services.knot.serviceConfig = {
104 LoadCredentialEncrypted = [
105 "${domain}.acme.conf:${inputs.self}/hosts/${hostName}/knot/${domain}/acme.conf.cred"
108 /* Useless since the zone is public
109 services.unbound.settings = {
112 stub-addr = "127.0.0.1@5353";