servers/mermet/knot/sourcephile.fr.nix

   1 { pkgs, lib, config, ... }:
   2 with builtins;
   3 let
   4   inherit (builtins.extraBuiltins) pass git;
   5   inherit (pkgs.lib) unlinesAttrs types;
   6   inherit (config) networking;
   7   inherit (config.services) knot;
   8   # Use the Git commit time of the ${domain}.nix file to set the serial number.
   9   # WARNING: the ${domain}.nix must be committed into Git for this to work.
  10   # WARNING: this does not take other .nix into account, though they may contribute to the zone's data.
  11   serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]);
  12   mermetIPv4 = "80.67.180.129";
  13   domain = "sourcephile.fr";
  14   # TODO: increase the TTL once things have settled down
  15 in
  16 {
  17 services.knot.zones."${domain}" = {
  18   conf = ''
  19     zone:
  20       - domain: ${domain}
  21         file: ${domain}.zone
  22         serial-policy: increment
  23         semantic-checks: on
  24         notify: secondary_gandi
  25         acl: acl_gandi
  26         acl: acl_localhost
  27         dnssec-signing: on
  28         dnssec-policy: rsa
  29   '';
  30   data = ''
  31     $ORIGIN ${domain}.
  32     $TTL 500
  33
  34     ; SOA (Start Of Authority)
  35     @ SOA ns admin (
  36       ${serial domain} ; Serial number
  37       24h   ; Refresh
  38       15m   ; Retry
  39       1000h ; Expire (1000h)
  40       1d    ; Negative caching
  41     )
  42
  43     ; NS (Name Server)
  44     @ NS ns
  45     @ NS ns6.gandi.net.
  46
  47     ; A (DNS -> IPv4)
  48     @ A ${mermetIPv4}
  49     mermet     A ${mermetIPv4}
  50     autoconfig A ${mermetIPv4}
  51     code       A ${mermetIPv4}
  52     git        A ${mermetIPv4}
  53     imap       A ${mermetIPv4}
  54     mail       A ${mermetIPv4}
  55     ns         A ${mermetIPv4}
  56     pop        A ${mermetIPv4}
  57     smtp       A ${mermetIPv4}
  58     submission A ${mermetIPv4}
  59     www        A ${mermetIPv4}
  60
  61     ; SPF (Sender Policy Framework)
  62     @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all"
  63     @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all"
  64
  65     ; MX (Mail eXchange)
  66     @ 180 MX 5 mail
  67
  68     ; SRV (SeRVice)
  69     _git._tcp.git 18000 IN SRV 0 0 9418 git
  70   '';
  71 };
  72 }