servers/mermet/knot/sourcephile.fr.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins.extraBuiltins) pass git;
   4   inherit (pkgs.lib) unlinesAttrs types;
   5   inherit (config) networking;
   6   inherit (config.services) knot;
   7   inherit (config) users;
   8   # Use the Git commit time of the ${domain}.nix file to set the serial number.
   9   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  10   # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
  11   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  12   mermetIPv4 = "80.67.180.129";
  13   losurdoIPv4 = "80.67.180.251";
  14   domain = "sourcephile.fr";
  15 in
  16 {
  17 systemd.services."acme-${domain}".after = [
  18   "unbound.service"
  19 ];
  20 security.acme.certs."${domain}" = {
  21   email = "root@${domain}";
  22   extraDomains = {
  23     "*.${domain}" = null;
  24   };
  25   group = users.groups.acme.name;
  26   allowKeysForGroup = true;
  27   keyType = "rsa4096";
  28   dnsProvider = "rfc2136";
  29   credentialsFile = pkgs.writeText "credentials" ''
  30     RFC2136_NAMESERVER=127.0.0.1:5353
  31     LEGO_EXPERIMENTAL_CNAME_SUPPORT=1
  32   '';
  33 };
  34 services.knot.zones."${domain}" = {
  35   conf = ''
  36     acl:
  37       - id: acl_acme_challenge_sourcephile_fr
  38         address: 127.0.0.1
  39         action: update
  40         update-owner: name
  41         update-owner-match: equal
  42         update-owner-name: [_acme-challenge.${domain}]
  43         update-type: [TXT]
  44
  45     zone:
  46       - domain: ${domain}
  47         file: ${domain}.zone
  48         serial-policy: increment
  49         semantic-checks: on
  50         notify: secondary_gandi
  51         acl: acl_gandi
  52         acl: acl_acme_challenge_sourcephile_fr
  53         dnssec-signing: on
  54         dnssec-policy: rsa
  55       - domain: whoami4.${domain}
  56         module: mod-whoami
  57         file: "${pkgs.writeText "whoami4.zone" ''
  58           $TTL 1
  59           @ SOA ns root.${domain}. (
  60             ${serial domain} ; SERIAL
  61             86400 ; REFRESH
  62             86400 ; RETRY
  63             86400 ; EXPIRE
  64             1 ; MINIMUM
  65           )
  66           $TTL 86400
  67           @ NS ns
  68           ns A ${mermetIPv4}
  69         ''}"
  70   '';
  71   # TODO: increase the TTL once things have settled down
  72   data = ''
  73     $ORIGIN ${domain}.
  74     $TTL 500
  75
  76     ; SOA (Start Of Authority)
  77     @ SOA ns root (
  78       ${serial domain} ; Serial number
  79       24h   ; Refresh
  80       15m   ; Retry
  81       1000h ; Expire (1000h)
  82       1d    ; Negative caching
  83     )
  84
  85     ; NS (Name Server)
  86     @ NS ns
  87     @ NS ns6.gandi.net.
  88     whoami4 NS ns.whoami4
  89     ns.whoami4 A ${mermetIPv4}
  90
  91     ; A (DNS -> IPv4)
  92     @            A ${mermetIPv4}
  93     mermet       A ${mermetIPv4}
  94     losurdo      A ${losurdoIPv4}
  95     autoconfig   A ${mermetIPv4}
  96     doc          A ${mermetIPv4}
  97     code         A ${mermetIPv4}
  98     git          A ${mermetIPv4}
  99     imap         A ${mermetIPv4}
 100     mail         A ${mermetIPv4}
 101     news         A ${mermetIPv4}
 102     public-inbox A ${mermetIPv4}
 103     ns           A ${mermetIPv4}
 104     pop          A ${mermetIPv4}
 105     smtp         A ${mermetIPv4}
 106     submission   A ${mermetIPv4}
 107     www          A ${mermetIPv4}
 108     lemoutona5pattes A ${mermetIPv4}
 109     covid19      A ${mermetIPv4}
 110
 111     ; SPF (Sender Policy Framework)
 112     @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
 113     @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"
 114
 115     ; MX (Mail eXchange)
 116     @ 180 MX 5 mail
 117
 118     ; SRV (SeRVice)
 119     _git._tcp.git 18000 IN SRV 0 0 9418 git
 120
 121     ; CAA (Certificate Authority Authorization)
 122     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
 123     @ CAA 128 issue "letsencrypt.org"
 124   '';
 125 };
 126 /* Useless since the zone is public
 127 services.unbound.extraConfig = ''
 128   stub-zone:
 129     name: "sourcephile.fr"
 130     stub-addr: 127.0.0.1@5353
 131 '';
 132 */
 133 }