]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/knot/sourcephile.fr.nix
knot+nginx: add lemoutona5pattes.sourcephile.fr for helping Cadine
[sourcephile-nix.git] / servers / mermet / knot / sourcephile.fr.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (builtins.extraBuiltins) pass git;
4 inherit (pkgs.lib) unlinesAttrs types;
5 inherit (config) networking;
6 inherit (config.services) knot;
7 inherit (config) users;
8 # Use the Git commit time of the ${domain}.nix file to set the serial number.
9 # WARNING: the ${domain}.nix must be committed into Git for this to work.
10 # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
11 serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
12 mermetIPv4 = "80.67.180.129";
13 losurdoIPv4 = "80.67.180.251";
14 domain = "sourcephile.fr";
15 in
16 {
17 systemd.services."acme-${domain}".after = [
18 "unbound.service"
19 ];
20 security.acme.certs."${domain}" = {
21 email = "root@${domain}";
22 extraDomains = {
23 "*.${domain}" = null;
24 };
25 group = users.groups.acme.name;
26 allowKeysForGroup = true;
27 keyType = "rsa4096";
28 dnsProvider = "rfc2136";
29 credentialsFile = pkgs.writeText "credentials" ''
30 RFC2136_NAMESERVER=127.0.0.1:5353
31 LEGO_EXPERIMENTAL_CNAME_SUPPORT=1
32 '';
33 };
34 services.knot.zones."${domain}" = {
35 conf = ''
36 acl:
37 - id: acl_acme_challenge_sourcephile_fr
38 address: 127.0.0.1
39 action: update
40 update-owner: name
41 update-owner-match: equal
42 update-owner-name: [_acme-challenge.${domain}]
43 update-type: [TXT]
44
45 zone:
46 - domain: ${domain}
47 file: ${domain}.zone
48 serial-policy: increment
49 semantic-checks: on
50 notify: secondary_gandi
51 acl: acl_gandi
52 acl: acl_acme_challenge_sourcephile_fr
53 dnssec-signing: on
54 dnssec-policy: rsa
55 '';
56 # TODO: increase the TTL once things have settled down
57 data = ''
58 $ORIGIN ${domain}.
59 $TTL 500
60
61 ; SOA (Start Of Authority)
62 @ SOA ns admin (
63 ${serial domain} ; Serial number
64 24h ; Refresh
65 15m ; Retry
66 1000h ; Expire (1000h)
67 1d ; Negative caching
68 )
69
70 ; NS (Name Server)
71 @ NS ns
72 @ NS ns6.gandi.net.
73
74 ; A (DNS -> IPv4)
75 @ A ${mermetIPv4}
76 mermet A ${mermetIPv4}
77 losurdo A ${losurdoIPv4}
78 autoconfig A ${mermetIPv4}
79 doc A ${mermetIPv4}
80 code A ${mermetIPv4}
81 git A ${mermetIPv4}
82 imap A ${mermetIPv4}
83 mail A ${mermetIPv4}
84 ns A ${mermetIPv4}
85 pop A ${mermetIPv4}
86 smtp A ${mermetIPv4}
87 submission A ${mermetIPv4}
88 www A ${mermetIPv4}
89 lemoutona5pattes A ${mermetIPv4}
90 covid19 A ${mermetIPv4}
91
92 ; SPF (Sender Policy Framework)
93 @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
94 @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"
95
96 ; MX (Mail eXchange)
97 @ 180 MX 5 mail
98
99 ; SRV (SeRVice)
100 _git._tcp.git 18000 IN SRV 0 0 9418 git
101
102 ; CAA (Certificate Authority Authorization)
103 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
104 @ CAA 128 issue "letsencrypt.org"
105 '';
106 };
107 /* Useless since the zone is public
108 services.unbound.extraConfig = ''
109 stub-zone:
110 name: "sourcephile.fr"
111 stub-addr: 127.0.0.1@5353
112 '';
113 */
114 }