]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/nsd/sourcephile.nix
nsd: lower sourcephile.fr TTL
[sourcephile-nix.git] / servers / mermet / nsd / sourcephile.nix
1 { pkgs, lib, config, ... }:
2 with builtins;
3 let
4 inherit (builtins.extraBuiltins) pass git;
5 inherit (pkgs.lib) unlinesAttrs;
6 inherit (config) networking;
7 inherit (config.services) nsd rspamd;
8 # Use the Git commit time of the ${zone}.nix file to set the serial number.
9 # WARNING: the ${zone}.nix must be committed into Git for this to work.
10 serial = zone: toString (git ./. [ "log" "-1" "--format=%ct" "--" (zone + ".nix") ]);
11 /*
12 serial = file: lib.removeSuffix "\n" (readFile
13 (pkgs.runCommand "zone-serial"
14 { buildInputs = [ pkgs.git ];
15 buildDepends = [ (./. + file) ];
16 preferLocalBuild = true;
17 allowSubstitutes = false;
18 } ''
19 cd ${./.}
20 ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
21 ''));
22 */
23 # FIXME: make dedicated config options
24 #ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
25 ipv4 = "80.67.180.129";
26 #ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
27 sourcephileZone = domain: ''
28 ; A (DNS -> IPv4)
29 @ A ${ipv4}
30 ${networking.hostName} A ${ipv4}
31 autoconfig A ${ipv4}
32 code A ${ipv4}
33 git A ${ipv4}
34 imap A ${ipv4}
35 mail A ${ipv4}
36 ns A ${ipv4}
37 pop A ${ipv4}
38 smtp A ${ipv4}
39 submission A ${ipv4}
40 www A ${ipv4}
41
42 ; SPF (Sender Policy Framework)
43 @ 3600 IN SPF "v=spf1 mx ip4:${ipv4} -all"
44 @ 3600 IN TXT "v=spf1 mx ip4:${ipv4} -all"
45
46 ; MX (Mail eXchange)
47 @ 180 MX 5 mail
48
49 ; SRV (SeRVice)
50 _git._tcp.git 18000 IN SRV 0 0 9418 git
51
52 ; TXT (TeXT)
53 ''
54 + lib.optionalString rspamd.dkim.enable
55 (unlinesAttrs
56 (selector: sel: sel.dns)
57 rspamd.dkim.domains."${domain}".selectors)
58 ;
59 in
60 {
61 environment.systemPackages = [
62 (pkgs.bind.override { enablePython = true; })
63 ];
64 services.nsd = {
65 zones = {
66 # NOTE: cannot use networking.domain as attr key: infinite recursion.
67 "sourcephile.fr" = {
68 # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
69 # DOC: https://www.sidn.nl/en/dnssec/dnssec-signatures-in-bind-named
70 provideXFR = [ "217.70.177.40 NOKEY" ];
71 notify = [ "217.70.177.40 NOKEY" ];
72 dnssec = true;
73 data = ''
74 $ORIGIN ${networking.domainBase}.fr.
75 $TTL 500
76
77 ; SOA (Start Of Authority)
78 @ SOA ns admin (
79 ${serial networking.domainBase} ; Serial number
80 24h ; Refresh
81 15m ; Retry
82 1000h ; Expire (1000h)
83 1d ; Negative caching
84 )
85
86 ; NS (Name Server)
87 @ NS ns
88 @ NS ns6.gandi.net.
89 ''
90 + sourcephileZone "${networking.domainBase}.fr";
91 };
92 };
93 };
94 }