servers/mermet/knot/autogeree.net.nix

   1 { pkgs, lib, config, servers, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (builtins) attrValues;
   6   inherit (builtins.extraBuiltins) pass git;
   7   inherit (config) networking;
   8   inherit (config.services) knot;
   9   inherit (config.users) users groups;
  10   # Use the Git commit time of the ${domain}.nix file to set the serial number.
  11   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  12   # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
  13   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  14   includes = {
  15     "${domain}/acme.conf" = "/var/lib/knot/tsig/${domain}/acme.conf";
  16   };
  17 in
  18 {
  19 security.install.shellHook = ''
  20   # Generated with: keymgr -t acme_${domain}
  21   pass "servers/mermet/knot/${domain}/acme.conf" |
  22   ssh "$target" install -D -m 0400 -o ${users."knot".name} -g root /dev/stdin \
  23     ${includes."${domain}/acme.conf"}
  24 '';
  25 services.knot = {
  26   keyFiles = attrValues includes;
  27 };
  28 services.knot.zones."${domain}" = {
  29   conf = ''
  30     acl:
  31       - id: acl_localhost_acme_${domainID}
  32         address: 127.0.0.1
  33         action: update
  34         update-owner: name
  35         update-owner-match: equal
  36         update-owner-name: [_acme-challenge.${domain}]
  37         update-type: [TXT]
  38       - id: acl_tsig_acme_${domainID}
  39         address: ${servers.losurdo.ipv4}
  40         key: acme_${domainID}
  41         action: update
  42         update-owner: name
  43         update-owner-match: equal
  44         update-owner-name: [_acme-challenge.${domain}]
  45         update-type: [TXT]
  46
  47     zone:
  48       - domain: ${domain}
  49         file: ${domain}.zone
  50         serial-policy: increment
  51         semantic-checks: on
  52         notify: secondary_gandi
  53         notify: secondary_muarf
  54         acl: acl_gandi
  55         acl: acl_muarf
  56         acl: acl_localhost_acme_${domainID}
  57         acl: acl_tsig_acme_${domainID}
  58         dnssec-signing: off
  59         dnssec-policy: ed25519
  60   '';
  61   # TODO: increase the TTL once things have settled down
  62   data = ''
  63     $ORIGIN ${domain}.
  64     $TTL 500
  65
  66     ; SOA (Start Of Authority)
  67     @ SOA ns admin (
  68       ${serial domain} ; Serial number
  69       24h   ; Refresh
  70       15m   ; Retry
  71       1000h ; Expire (1000h)
  72       1d    ; Negative caching
  73     )
  74
  75     ; NS (Name Server)
  76     @ NS ns
  77     @ NS ns6.gandi.net.
  78     @ NS ns0.muarf.org.
  79
  80     ; A (DNS -> IPv4)
  81     @          A ${servers.mermet.ipv4}
  82     mermet     A ${servers.mermet.ipv4}
  83     autoconfig A ${servers.mermet.ipv4}
  84     code       A ${servers.mermet.ipv4}
  85     git        A ${servers.mermet.ipv4}
  86     imap       A ${servers.mermet.ipv4}
  87     mail       A ${servers.mermet.ipv4}
  88     ns         A ${servers.mermet.ipv4}
  89     pop        A ${servers.mermet.ipv4}
  90     smtp       A ${servers.mermet.ipv4}
  91     submission A ${servers.mermet.ipv4}
  92     www        A ${servers.mermet.ipv4}
  93     chomsky    A 91.216.110.36
  94     alpes      A 195.88.84.51
  95
  96     ; SPF (Sender Policy Framework)
  97     @ 3600 IN SPF "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
  98     @ 3600 IN TXT "v=spf1 mx ip4:${servers.mermet.ipv4} -all"
  99
 100     ; MX (Mail eXchange)
 101     @ 180 MX 5 mail
 102
 103     ; SRV (SeRVice)
 104     _git._tcp.git 18000 IN SRV 0 0 9418 git
 105
 106     ; CAA (Certificate Authority Authorization)
 107     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
 108     @ CAA 128 issue "letsencrypt.org"
 109   '';
 110 };
 111 /* Useless since the zone is public
 112 services.unbound.extraConfig = ''
 113   stub-zone:
 114     name: "autogeree.net"
 115     stub-addr: 127.0.0.1@5353
 116 '';
 117 */
 118 }