servers/mermet/nsd/sourcephile.nix

   1 { pkgs, lib, config, ... }:
   2 with builtins;
   3 let
   4   inherit (builtins.extraBuiltins) pass git;
   5   inherit (pkgs.lib) unlinesAttrs;
   6   inherit (config) networking;
   7   inherit (config.services) nsd rspamd;
   8   # Use the Git commit time of the ${zone}.nix file to set the serial number.
   9   # WARNING: the ${zone}.nix must be committed into Git for this to work.
  10   serial = zone: toString (git ./. [ "log" "-1" "--format=%ct" "--" (zone + ".nix") ]);
  11   /*
  12   serial = file: lib.removeSuffix "\n" (readFile
  13     (pkgs.runCommand "zone-serial"
  14       { buildInputs      = [ pkgs.git ];
  15         buildDepends     = [ (./. + file) ];
  16         preferLocalBuild = true;
  17         allowSubstitutes = false;
  18       } ''
  19       cd ${./.}
  20       ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
  21     ''));
  22   */
  23   # FIXME: make dedicated config options
  24   #ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
  25   ipv4 = "80.67.180.129";
  26   #ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
  27   sourcephileZone = domain: ''
  28     ; A (DNS -> IPv4)
  29     @ A ${ipv4}
  30     ${networking.hostName} A ${ipv4}
  31     autoconfig A ${ipv4}
  32     code       A ${ipv4}
  33     git        A ${ipv4}
  34     imap       A ${ipv4}
  35     mail       A ${ipv4}
  36     ns         A ${ipv4}
  37     pop        A ${ipv4}
  38     smtp       A ${ipv4}
  39     submission A ${ipv4}
  40     www        A ${ipv4}
  41
  42     ; SPF (Sender Policy Framework)
  43     @ 3600 IN SPF "v=spf1 mx ip4:${ipv4} -all"
  44     @ 3600 IN TXT "v=spf1 mx ip4:${ipv4} -all"
  45
  46     ; MX (Mail eXchange)
  47     @ 180 MX 5 mail
  48
  49     ; SRV (SeRVice)
  50     _git._tcp.git 18000 IN SRV 0 0 9418 git
  51
  52     ; TXT (TeXT)
  53     ''
  54     + lib.optionalString rspamd.dkim.enable
  55         (unlinesAttrs
  56           (selector: sel: sel.dns)
  57           rspamd.dkim.domains."${domain}".selectors)
  58     ;
  59 in
  60 {
  61   environment.systemPackages = [
  62     (pkgs.bind.override { enablePython = true; })
  63   ];
  64   services.nsd = {
  65     zones = {
  66       # NOTE: cannot use networking.domain as attr key: infinite recursion.
  67       "sourcephile.fr" = {
  68         # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
  69         # DOC: https://www.sidn.nl/en/dnssec/dnssec-signatures-in-bind-named
  70         provideXFR = [ "217.70.177.40 NOKEY" ];
  71         notify     = [ "217.70.177.40 NOKEY" ];
  72         dnssec = true;
  73         data = ''
  74           $ORIGIN ${networking.domainBase}.fr.
  75           $TTL 500
  76
  77           ; SOA (Start Of Authority)
  78           @ SOA ns admin (
  79             ${serial networking.domainBase} ; Serial number
  80             24h   ; Refresh
  81             15m   ; Retry
  82             1000h ; Expire (1000h)
  83             1d    ; Negative caching
  84           )
  85
  86           ; NS (Name Server)
  87           @ NS ns
  88           @ NS ns6.gandi.net.
  89         ''
  90         + sourcephileZone "${networking.domainBase}.fr";
  91       };
  92     };
  93   };
  94 }