servers/mermet/knot/sourcephile.fr.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins.extraBuiltins) pass git;
   4   inherit (pkgs.lib) unlinesAttrs types;
   5   inherit (config) networking;
   6   inherit (config.services) knot;
   7   inherit (config) users;
   8   # Use the Git commit time of the ${domain}.nix file to set the serial number.
   9   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  10   # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
  11   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  12   mermetIPv4 = "80.67.180.129";
  13   domain = "sourcephile.fr";
  14 in
  15 {
  16 security.acme.certs."${domain}" = {
  17   email = "root@${domain}";
  18   extraDomains = {
  19     "*.${domain}" = null;
  20   };
  21   group = users.groups.acme.name;
  22   allowKeysForGroup = true;
  23   keyType = "rsa4096";
  24   dnsProvider = "rfc2136";
  25   credentialsFile = pkgs.writeText "credentials" ''
  26     RFC2136_NAMESERVER=127.0.0.1:5353
  27     LEGO_EXPERIMENTAL_CNAME_SUPPORT=1
  28   '';
  29 };
  30 services.knot.zones."${domain}" = {
  31   conf = ''
  32     acl:
  33       - id: acl_acme_challenge_sourcephile_fr
  34         address: 127.0.0.1
  35         action: update
  36         update-owner: name
  37         update-owner-match: equal
  38         update-owner-name: [_acme-challenge.${domain}]
  39         update-type: [TXT]
  40
  41     zone:
  42       - domain: ${domain}
  43         file: ${domain}.zone
  44         serial-policy: increment
  45         semantic-checks: on
  46         notify: secondary_gandi
  47         acl: acl_gandi
  48         acl: acl_acme_challenge_sourcephile_fr
  49         dnssec-signing: on
  50         dnssec-policy: rsa
  51   '';
  52   # TODO: increase the TTL once things have settled down
  53   data = ''
  54     $ORIGIN ${domain}.
  55     $TTL 500
  56
  57     ; SOA (Start Of Authority)
  58     @ SOA ns admin (
  59       ${serial domain} ; Serial number
  60       24h   ; Refresh
  61       15m   ; Retry
  62       1000h ; Expire (1000h)
  63       1d    ; Negative caching
  64     )
  65
  66     ; NS (Name Server)
  67     @ NS ns
  68     @ NS ns6.gandi.net.
  69
  70     ; A (DNS -> IPv4)
  71     @          A ${mermetIPv4}
  72     mermet     A ${mermetIPv4}
  73     autoconfig A ${mermetIPv4}
  74     code       A ${mermetIPv4}
  75     git        A ${mermetIPv4}
  76     imap       A ${mermetIPv4}
  77     mail       A ${mermetIPv4}
  78     ns         A ${mermetIPv4}
  79     pop        A ${mermetIPv4}
  80     smtp       A ${mermetIPv4}
  81     submission A ${mermetIPv4}
  82     www        A ${mermetIPv4}
  83
  84     ; SPF (Sender Policy Framework)
  85     @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
  86     @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"
  87
  88     ; MX (Mail eXchange)
  89     @ 180 MX 5 mail
  90
  91     ; SRV (SeRVice)
  92     _git._tcp.git 18000 IN SRV 0 0 9418 git
  93
  94     ; CAA (Certificate Authority Authorization)
  95     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
  96     @ CAA 128 issue "letsencrypt.org"
  97   '';
  98 };
  99 }