servers/mermet/nsd/sourcephile.fr.nix

   1 { pkgs, lib, config, ... }:
   2 with builtins;
   3 let
   4   inherit (builtins.extraBuiltins) pass git;
   5   inherit (pkgs.lib) unlinesAttrs types;
   6   inherit (config) networking;
   7   inherit (config.services) nsd rspamd;
   8   # Use the Git commit time of the ${domain}.nix file to set the serial number.
   9   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  10   # WARNING: when dnssec=true, dnssec-signzone is used with -N date
  11   # which will override the serial number in the SOA,
  12   # used by slave nameservers decide whether they should update or not from the master nameserver.
  13   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  14   mermetIPv4 = "80.67.180.129";
  15   domain = "sourcephile.fr";
  16 in
  17 {
  18 services.nsd.zones."${domain}" = {
  19   # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html
  20   # DOC: https://www.sidn.nl/en/dnssec/dnssec-signatures-in-bind-named
  21   provideXFR = [ "217.70.177.40 NOKEY" ];
  22   # Not allowed by 217.70.177.40
  23   #notify     = [ "217.70.177.40 NOKEY" ];
  24   dnssec = true;
  25   # TODO: increase the TTL once things have settled down
  26   data = ''
  27     $ORIGIN ${domain}.
  28     $TTL 500
  29
  30     ; SOA (Start Of Authority)
  31     @ SOA ns admin (
  32       ${serial domain} ; Serial number
  33       24h   ; Refresh
  34       15m   ; Retry
  35       1000h ; Expire (1000h)
  36       1d    ; Negative caching
  37     )
  38
  39     ; NS (Name Server)
  40     @ NS ns
  41     @ NS ns6.gandi.net.
  42
  43     ; A (DNS -> IPv4)
  44     @ A ${mermetIPv4}
  45     mermet     A ${mermetIPv4}
  46     autoconfig A ${mermetIPv4}
  47     code       A ${mermetIPv4}
  48     git        A ${mermetIPv4}
  49     imap       A ${mermetIPv4}
  50     mail       A ${mermetIPv4}
  51     ns         A ${mermetIPv4}
  52     pop        A ${mermetIPv4}
  53     smtp       A ${mermetIPv4}
  54     submission A ${mermetIPv4}
  55     www        A ${mermetIPv4}
  56
  57     ; SPF (Sender Policy Framework)
  58     @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
  59     @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"
  60
  61     ; MX (Mail eXchange)
  62     @ 180 MX 5 mail
  63
  64     ; SRV (SeRVice)
  65     _git._tcp.git 18000 IN SRV 0 0 9418 git
  66   '';
  67 };
  68 }