]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/knot/autogeree.net.nix
fail2ban: reduce findtime to reduce RAM footprint and startup time
[sourcephile-nix.git] / servers / mermet / knot / autogeree.net.nix
1 { pkgs, lib, config, servers, ... }:
2 let
3 domain = "autogeree.net";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 inherit (builtins) attrValues;
6 inherit (builtins.extraBuiltins) git;
7 inherit (config) networking;
8 inherit (config.services) knot;
9 inherit (config.security) pass;
10 inherit (config.users) users groups;
11 # Use the Git commit time of the ${domain}.nix file to set the serial number.
12 # WARNING: the ${domain}.nix must be committed into Git for this to work.
13 # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
14 serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
15 in
16 {
17 services.knot.zones."${domain}" = {
18 conf = ''
19 acl:
20 - id: acl_localhost_acme_${domainID}
21 address: 127.0.0.1
22 action: update
23 update-owner: name
24 update-owner-match: equal
25 update-owner-name: [_acme-challenge.${domain}]
26 update-type: [TXT]
27 - id: acl_tsig_acme_${domainID}
28 address: ${servers.losurdo.ipv4}
29 key: acme_${domainID}
30 action: update
31 update-owner: name
32 update-owner-match: equal
33 update-owner-name: [_acme-challenge.${domain}]
34 update-type: [TXT]
35
36 zone:
37 - domain: ${domain}
38 file: ${domain}.zone
39 serial-policy: increment
40 semantic-checks: on
41 notify: secondary_gandi
42 notify: secondary_muarf
43 acl: acl_gandi
44 acl: acl_muarf
45 acl: acl_localhost_acme_${domainID}
46 acl: acl_tsig_acme_${domainID}
47 dnssec-signing: off
48 dnssec-policy: ed25519
49 '';
50 # TODO: increase the TTL once things have settled down
51 data = ''
52 $ORIGIN ${domain}.
53 $TTL 500
54
55 ; SOA (Start Of Authority)
56 @ SOA ns admin (
57 ${serial domain} ; Serial number
58 24h ; Refresh
59 15m ; Retry
60 1000h ; Expire (1000h)
61 1d ; Negative caching
62 )
63
64 ; NS (Name Server)
65 @ NS ns
66 @ NS ns6.gandi.net.
67 @ NS ns0.muarf.org.
68
69 ; A (DNS -> IPv4)
70 @ A ${servers.mermet.ipv4}
71 mermet A ${servers.mermet.ipv4}
72 autoconfig A ${servers.mermet.ipv4}
73 code A ${servers.mermet.ipv4}
74 git A ${servers.mermet.ipv4}
75 imap A ${servers.mermet.ipv4}
76 mail A ${servers.mermet.ipv4}
77 ns A ${servers.mermet.ipv4}
78 pop A ${servers.mermet.ipv4}
79 smtp A ${servers.mermet.ipv4}
80 submission A ${servers.mermet.ipv4}
81 www A ${servers.mermet.ipv4}
82 chomsky A 91.216.110.36
83 alpes A 195.88.84.51
84
85 ; SPF (Sender Policy Framework)
86 @ 3600 IN SPF "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
87 @ 3600 IN TXT "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
88
89 ; MX (Mail eXchange)
90 @ 180 MX 5 mail
91
92 ; SRV (SeRVice)
93 _git._tcp.git 18000 IN SRV 0 0 9418 git
94
95 ; CAA (Certificate Authority Authorization)
96 ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
97 @ CAA 128 issue "letsencrypt.org"
98 '';
99 };
100 services.knot = {
101 keyFiles = [ pass.secrets."knot/tsig/${domain}/acme.conf".path ];
102 };
103 security.pass.secrets."knot/tsig/${domain}/acme.conf" = {
104 # Generated with: keymgr -t acme_${domainID}
105 user = users.knot.name;
106 };
107 systemd.services.knot = {
108 after = [ pass.secrets."knot/tsig/${domain}/acme.conf".service ];
109 wants = [ pass.secrets."knot/tsig/${domain}/acme.conf".service ];
110 };
111 /* Useless since the zone is public
112 services.unbound.extraConfig = ''
113 stub-zone:
114 name: "autogeree.net"
115 stub-addr: 127.0.0.1@5353
116 '';
117 */
118 }