machines/mermet/knot/sourcephile.fr.nix

   1 { pkgs, lib, config, machines, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (builtins) attrValues;
   6   inherit (config) networking;
   7   inherit (config.security) gnupg;
   8   inherit (config.services) knot;
   9   inherit (config.users) users;
  10 in
  11 {
  12 services.knot.zones."${domain}" = {
  13   conf = ''
  14     acl:
  15       - id: acl_localhost_acme_${domainID}
  16         address: 127.0.0.1
  17         action: update
  18         update-owner: name
  19         update-owner-match: equal
  20         update-owner-name: [_acme-challenge.${domain}]
  21         update-type: [TXT]
  22       - id: acl_tsig_acme_${domainID}
  23         address: ${machines.losurdo.extraArgs.ipv4}
  24         key: acme_${domainID}
  25         action: update
  26         update-owner: name
  27         update-owner-match: equal
  28         update-owner-name: [_acme-challenge.${domain}]
  29         update-type: [TXT]
  30
  31     zone:
  32       - domain: ${domain}
  33         file: ${domain}.zone
  34         serial-policy: increment
  35         semantic-checks: on
  36         notify: secondary_gandi
  37         acl: acl_gandi
  38         acl: acl_localhost_acme_${domainID}
  39         acl: acl_tsig_acme_${domainID}
  40         dnssec-signing: on
  41         dnssec-policy: rsa
  42       - domain: whoami4.${domain}
  43         module: mod-whoami
  44         file: "${pkgs.writeText "whoami4.zone" ''
  45           $TTL 1
  46           @ SOA ns root.${domain}. (
  47             0     ; SERIAL
  48             86400 ; REFRESH
  49             86400 ; RETRY
  50             86400 ; EXPIRE
  51             1 ; MINIMUM
  52           )
  53           $TTL 86400
  54           @ NS ns
  55           ns A ${machines.mermet.extraArgs.ipv4}
  56         ''}"
  57   '';
  58   # TODO: increase the TTL once things have settled down
  59   data = ''
  60     $ORIGIN ${domain}.
  61     $TTL 500
  62
  63     ; SOA (Start Of Authority)
  64     @ SOA ns root (
  65       0     ; Serial number (automatically adjusted by knot)
  66       24h   ; Refresh
  67       15m   ; Retry
  68       1000h ; Expire (1000h)
  69       1d    ; Negative caching
  70     )
  71
  72     ; NS (Name Server)
  73     @ NS ns
  74     @ NS ns6.gandi.net.
  75     whoami4 NS ns.whoami4
  76     ns.whoami4 A ${machines.mermet.extraArgs.ipv4}
  77
  78     ; A (DNS -> IPv4)
  79     @            A ${machines.mermet.extraArgs.ipv4}
  80     mermet       A ${machines.mermet.extraArgs.ipv4}
  81     losurdo      A ${machines.losurdo.extraArgs.ipv4}
  82     autoconfig   A ${machines.mermet.extraArgs.ipv4}
  83     doc          A ${machines.mermet.extraArgs.ipv4}
  84     code         A ${machines.mermet.extraArgs.ipv4}
  85     git          A ${machines.mermet.extraArgs.ipv4}
  86     imap         A ${machines.mermet.extraArgs.ipv4}
  87     mail         A ${machines.mermet.extraArgs.ipv4}
  88     mails        A ${machines.mermet.extraArgs.ipv4}
  89     news         A ${machines.mermet.extraArgs.ipv4}
  90     public-inbox A ${machines.mermet.extraArgs.ipv4}
  91     ns           A ${machines.mermet.extraArgs.ipv4}
  92     pop          A ${machines.mermet.extraArgs.ipv4}
  93     smtp         A ${machines.mermet.extraArgs.ipv4}
  94     submission   A ${machines.mermet.extraArgs.ipv4}
  95     www          A ${machines.mermet.extraArgs.ipv4}
  96     lemoutona5pattes A ${machines.mermet.extraArgs.ipv4}
  97     covid19      A ${machines.mermet.extraArgs.ipv4}
  98     openconcerto A ${machines.losurdo.extraArgs.ipv4}
  99     croc         A ${machines.mermet.extraArgs.ipv4}
 100     xmpp         A ${machines.losurdo.extraArgs.ipv4}
 101     tmp          A ${machines.losurdo.extraArgs.ipv4}
 102     stun         A ${machines.mermet.extraArgs.ipv4}
 103     turn         A ${machines.mermet.extraArgs.ipv4}
 104     proxy65      A ${machines.losurdo.extraArgs.ipv4}
 105
 106     ; SPF (Sender Policy Framework)
 107     @ 3600 IN SPF "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
 108     @ 3600 IN TXT "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
 109
 110     ; MX (Mail eXchange)
 111     @ 180 MX 5 mail
 112
 113     ; SRV (SeRVice)
 114     _git._tcp.git             18000 IN SRV 0 0 9418 git
 115     _stun._udp                18000 IN SRV 0 5 3478 stun
 116     _xmpp-client._tcp         18000 IN SRV 0 5 5222 xmpp
 117     _xmpp-server._tcp         18000 IN SRV 0 5 5269 xmpp
 118     _xmpp-server._tcp.salons  18000 IN SRV 0 5 5269 xmpp
 119
 120     ; CAA (Certificate Authority Authorization)
 121     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
 122     @ CAA 128 issue "letsencrypt.org"
 123   '';
 124 };
 125 users.groups.keys.members = [ users.knot.name ];
 126 services.knot = {
 127   keyFiles = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".path ];
 128 };
 129 security.gnupg.secrets."knot/tsig/${domain}/acme.conf" = {
 130   # Generated with: keymgr -t acme_${domainID}
 131   user = users.knot.name;
 132 };
 133 systemd.services.knot = {
 134   after = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
 135   wants = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
 136 };
 137 /* Useless since the zone is public
 138 services.unbound.extraConfig = ''
 139   stub-zone:
 140     name: "sourcephile.fr"
 141     stub-addr: 127.0.0.1@5353
 142 '';
 143 */
 144 }