{ pkgs, lib, config, ... }: with builtins; let inherit (builtins.extraBuiltins) pass git; inherit (pkgs.lib) unlinesAttrs types; inherit (config) networking; inherit (config.services) nsd rspamd; # Use the Git commit time of the ${domain}.nix file to set the serial number. # WARNING: the ${domain}.nix must be committed into Git for this to work. serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]); /* serial = file: lib.removeSuffix "\n" (readFile (pkgs.runCommand "zone-serial" { buildInputs = [ pkgs.git ]; buildDepends = [ (./. + file) ]; preferLocalBuild = true; allowSubstitutes = false; } '' cd ${./.} ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out '')); */ # FIXME: make dedicated config options #ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address; mermetIPv4 = "80.67.180.129"; domain = "sourcephile.fr"; #ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address; sourcephileZone = domain: '' ; A (DNS -> IPv4) @ A ${mermetIPv4} mermet A ${mermetIPv4} autoconfig A ${mermetIPv4} code A ${mermetIPv4} git A ${mermetIPv4} imap A ${mermetIPv4} mail A ${mermetIPv4} ns A ${mermetIPv4} pop A ${mermetIPv4} smtp A ${mermetIPv4} submission A ${mermetIPv4} www A ${mermetIPv4} ; SPF (Sender Policy Framework) @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all" @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all" ; MX (Mail eXchange) @ 180 MX 5 mail ; SRV (SeRVice) _git._tcp.git 18000 IN SRV 0 0 9418 git ''; in { environment.systemPackages = [ (pkgs.bind.override { enablePython = true; }) ]; services.nsd.zones."${domain}" = { # DOC: https://docs.gandi.net/en/domain_names/advanced_users/secondary_nameserver.html # DOC: https://www.sidn.nl/en/dnssec/dnssec-signatures-in-bind-named provideXFR = [ "217.70.177.40 NOKEY" ]; # Not allowed by 217.70.177.40 #notify = [ "217.70.177.40 NOKEY" ]; dnssec = true; # TODO: increase the TTL once things have settled down data = '' $ORIGIN ${domain}. $TTL 500 ; SOA (Start Of Authority) @ SOA ns admin ( ${serial domain} ; Serial number 24h ; Refresh 15m ; Retry 1000h ; Expire (1000h) 1d ; Negative caching ) ; NS (Name Server) @ NS ns @ NS ns6.gandi.net. '' + sourcephileZone "${domain}"; }; }