machines/mermet/knot/autogeree.net.nix

   1 { pkgs, lib, config, machines, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (builtins) attrValues;
   6   inherit (builtins.extraBuiltins) git;
   7   inherit (config) networking;
   8   inherit (config.services) knot;
   9   inherit (config.security) gnupg;
  10   inherit (config.users) users groups;
  11   # Use the Git commit time of the ${domain}.nix file to set the serial number.
  12   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  13   # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
  14   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  15 in
  16 {
  17 services.knot.zones."${domain}" = {
  18   conf = ''
  19     acl:
  20       - id: acl_localhost_acme_${domainID}
  21         address: 127.0.0.1
  22         action: update
  23         update-owner: name
  24         update-owner-match: equal
  25         update-owner-name: [_acme-challenge.${domain}]
  26         update-type: [TXT]
  27       - id: acl_tsig_acme_${domainID}
  28         address: ${machines.losurdo.extraArgs.ipv4}
  29         key: acme_${domainID}
  30         action: update
  31         update-owner: name
  32         update-owner-match: equal
  33         update-owner-name: [_acme-challenge.${domain}]
  34         update-type: [TXT]
  35
  36     zone:
  37       - domain: ${domain}
  38         file: ${domain}.zone
  39         serial-policy: increment
  40         semantic-checks: on
  41         notify: secondary_gandi
  42         notify: secondary_muarf
  43         acl: acl_gandi
  44         acl: acl_muarf
  45         acl: acl_localhost_acme_${domainID}
  46         acl: acl_tsig_acme_${domainID}
  47         dnssec-signing: off
  48         dnssec-policy: ed25519
  49   '';
  50   # TODO: increase the TTL once things have settled down
  51   data = ''
  52     $ORIGIN ${domain}.
  53     $TTL 500
  54
  55     ; SOA (Start Of Authority)
  56     @ SOA ns admin (
  57       ${serial domain} ; Serial number
  58       24h   ; Refresh
  59       15m   ; Retry
  60       1000h ; Expire (1000h)
  61       1d    ; Negative caching
  62     )
  63
  64     ; NS (Name Server)
  65     @ NS ns
  66     @ NS ns6.gandi.net.
  67     @ NS ns0.muarf.org.
  68
  69     ; A (DNS -> IPv4)
  70     @          A ${machines.mermet.extraArgs.ipv4}
  71     mermet     A ${machines.mermet.extraArgs.ipv4}
  72     autoconfig A ${machines.mermet.extraArgs.ipv4}
  73     code       A ${machines.mermet.extraArgs.ipv4}
  74     git        A ${machines.mermet.extraArgs.ipv4}
  75     imap       A ${machines.mermet.extraArgs.ipv4}
  76     mail       A ${machines.mermet.extraArgs.ipv4}
  77     ns         A ${machines.mermet.extraArgs.ipv4}
  78     pop        A ${machines.mermet.extraArgs.ipv4}
  79     smtp       A ${machines.mermet.extraArgs.ipv4}
  80     submission A ${machines.mermet.extraArgs.ipv4}
  81     www        A ${machines.mermet.extraArgs.ipv4}
  82     chomsky    A 91.216.110.36
  83     alpes      A 195.88.84.51
  84
  85     ; SPF (Sender Policy Framework)
  86     @ 3600 IN SPF "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
  87     @ 3600 IN TXT "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
  88
  89     ; MX (Mail eXchange)
  90     @ 180 MX 5 mail
  91
  92     ; SRV (SeRVice)
  93     _git._tcp.git 18000 IN SRV 0 0 9418 git
  94
  95     ; CAA (Certificate Authority Authorization)
  96     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
  97     @ CAA 128 issue "letsencrypt.org"
  98   '';
  99 };
 100 users.users.knot.extraGroups = [ groups.keys.name ];
 101 services.knot = {
 102   keyFiles = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".path ];
 103 };
 104 security.gnupg.secrets."knot/tsig/${domain}/acme.conf" = {
 105   # Generated with: keymgr -t acme_${domainID}
 106   user = users.knot.name;
 107 };
 108 systemd.services.knot = {
 109   after = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
 110   wants = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
 111 };
 112 /* Useless since the zone is public
 113 services.unbound.extraConfig = ''
 114   stub-zone:
 115     name: "autogeree.net"
 116     stub-addr: 127.0.0.1@5353
 117 '';
 118 */
 119 }