machines/mermet/knot/autogeree.net.nix

   1 { pkgs, lib, config, machines, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (builtins) attrValues;
   6   inherit (config) networking;
   7   inherit (config.security) gnupg;
   8   inherit (config.services) knot;
   9   inherit (config.users) users;
  10 in
  11 {
  12 services.knot.zones."${domain}" = {
  13   conf = ''
  14     acl:
  15       - id: acl_localhost_acme_${domainID}
  16         address: 127.0.0.1
  17         action: update
  18         update-owner: name
  19         update-owner-match: equal
  20         update-owner-name: [_acme-challenge.${domain}]
  21         update-type: [TXT]
  22       - id: acl_tsig_acme_${domainID}
  23         address: ${machines.losurdo.extraArgs.ipv4}
  24         key: acme_${domainID}
  25         action: update
  26         update-owner: name
  27         update-owner-match: equal
  28         update-owner-name: [_acme-challenge.${domain}]
  29         update-type: [TXT]
  30
  31     zone:
  32       - domain: ${domain}
  33         file: ${domain}.zone
  34         serial-policy: increment
  35         semantic-checks: on
  36         notify: secondary_gandi
  37         notify: secondary_muarf
  38         acl: acl_gandi
  39         acl: acl_muarf
  40         acl: acl_localhost_acme_${domainID}
  41         acl: acl_tsig_acme_${domainID}
  42         dnssec-signing: off
  43         dnssec-policy: ed25519
  44   '';
  45   # TODO: increase the TTL once things have settled down
  46   data = ''
  47     $ORIGIN ${domain}.
  48     $TTL 500
  49
  50     ; SOA (Start Of Authority)
  51     @ SOA ns root (
  52       0     ; Serial number (automatically adjusted by knot)
  53       24h   ; Refresh
  54       15m   ; Retry
  55       1000h ; Expire (1000h)
  56       1d    ; Negative caching
  57     )
  58
  59     ; NS (Name Server)
  60     @ NS ns
  61     @ NS ns6.gandi.net.
  62     @ NS ns0.muarf.org.
  63
  64     ; A (DNS -> IPv4)
  65     @          A ${machines.mermet.extraArgs.ipv4}
  66     mermet     A ${machines.mermet.extraArgs.ipv4}
  67     autoconfig A ${machines.mermet.extraArgs.ipv4}
  68     code       A ${machines.mermet.extraArgs.ipv4}
  69     git        A ${machines.mermet.extraArgs.ipv4}
  70     imap       A ${machines.mermet.extraArgs.ipv4}
  71     mail       A ${machines.mermet.extraArgs.ipv4}
  72     ns         A ${machines.mermet.extraArgs.ipv4}
  73     pop        A ${machines.mermet.extraArgs.ipv4}
  74     smtp       A ${machines.mermet.extraArgs.ipv4}
  75     submission A ${machines.mermet.extraArgs.ipv4}
  76     www        A ${machines.mermet.extraArgs.ipv4}
  77     chomsky    A 91.216.110.36
  78     alpes      A 195.88.84.51
  79
  80     ; SPF (Sender Policy Framework)
  81     @ 3600 IN SPF "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
  82     @ 3600 IN TXT "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all"
  83
  84     ; MX (Mail eXchange)
  85     @ 180 MX 5 mail
  86
  87     ; SRV (SeRVice)
  88     _git._tcp.git 18000 IN SRV 0 0 9418 git
  89
  90     ; CAA (Certificate Authority Authorization)
  91     ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
  92     @ CAA 128 issue "letsencrypt.org"
  93   '';
  94 };
  95 users.groups.keys.members = [ users.knot.name ];
  96 services.knot = {
  97   keyFiles = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".path ];
  98 };
  99 security.gnupg.secrets."knot/tsig/${domain}/acme.conf" = {
 100   # Generated with: keymgr -t acme_${domainID}
 101   user = users.knot.name;
 102 };
 103 systemd.services.knot = {
 104   after = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
 105   wants = [ gnupg.secrets."knot/tsig/${domain}/acme.conf".service ];
 106 };
 107 /* Useless since the zone is public
 108 services.unbound.extraConfig = ''
 109   stub-zone:
 110     name: "autogeree.net"
 111     stub-addr: 127.0.0.1@5353
 112 '';
 113 */
 114 }