{ pkgs, lib, config, inputs, hosts, info, ... }:
let
domain = "sourcephile.fr";
domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
inherit (config) networking;
inherit (config.services) knot;
inherit (config.users) users groups;
zoneData =
# TODO: increase the TTL once things have settled down
''
$ORIGIN ${domain}.
$TTL 500
; SOA (Start Of Authority)
@ SOA ns root (
${toString inputs.self.lastModified} ; Serial number
24h ; Refresh
15m ; Retry
1000h ; Expire (1000h)
1d ; Negative caching
)
; NS (Name Server)
@ NS ns
;@ NS ${info.gandi.dns.secondary.ns.name}.
i NS ns
whoami4 NS ns.whoami4
ns.whoami4 A ${hosts.mermet._module.args.ipv4}
; A (DNS -> IPv4)
@ A ${hosts.mermet._module.args.ipv4}
mermet A ${hosts.mermet._module.args.ipv4}
autoconfig A ${hosts.mermet._module.args.ipv4}
calibre A ${hosts.mermet._module.args.ipv4}
doc A ${hosts.mermet._module.args.ipv4}
git A ${hosts.mermet._module.args.ipv4}
imap A ${hosts.mermet._module.args.ipv4}
mail A ${hosts.mermet._module.args.ipv4}
mails A ${hosts.mermet._module.args.ipv4}
news A ${hosts.mermet._module.args.ipv4}
public-inbox A ${hosts.mermet._module.args.ipv4}
ns A ${hosts.mermet._module.args.ipv4}
pop A ${hosts.mermet._module.args.ipv4}
smtp A ${hosts.mermet._module.args.ipv4}
submission A ${hosts.mermet._module.args.ipv4}
www A ${hosts.mermet._module.args.ipv4}
croc A ${hosts.mermet._module.args.ipv4}
stun A ${hosts.mermet._module.args.ipv4}
turn A ${hosts.mermet._module.args.ipv4}
whoami A ${hosts.mermet._module.args.ipv4}
code A ${hosts.mermet._module.args.ipv4}
miniflux A ${hosts.mermet._module.args.ipv4}
; MX (Mail eXchange)
@ 500 MX 5 mail
; CNAME (Canonical Name)
openconcerto CNAME losurdo
xmpp CNAME mermet
salons CNAME mermet
tmp CNAME mermet
proxy65 CNAME mermet
cryptpad CNAME losurdo
cryptpad-api CNAME losurdo
cryptpad-files CNAME losurdo
cryptpad-sandbox CNAME losurdo
mumble CNAME mermet
freeciv CNAME losurdo
nix-serve CNAME losurdo
nix-extracache CNAME losurdo
nix-localcache CNAME lan.losurdo
sftp CNAME losurdo
radicle-mermet CNAME mermet
radicle CNAME mermet
radicle-explorer CNAME radicle
; DMARC (Domain-based Message Authentication, Reporting and Conformance)
_dmarc 3600 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:root+dmarc+aggregate@sourcephile.fr; ruf=mailto:root+dmarc+forensic@sourcephile.fr"
; SPF (Sender Policy Framework)
@ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all"
; SRV (SeRVice)
_git._tcp.git 18000 IN SRV 0 0 9418 git
_stun._udp 18000 IN SRV 0 5 3478 stun
_xmpp-client._tcp 18000 IN SRV 0 5 5222 xmpp
_xmpp-server._tcp 18000 IN SRV 0 5 5269 xmpp
_xmpp-server._tcp.salons 18000 IN SRV 0 5 5269 xmpp
_xmpps-client._tcp 18000 IN SRV 0 5 5223 xmpp
_xmpps-server._tcp 18000 IN SRV 0 5 5270 xmpp
_xmpps-server._tcp.salons 18000 IN SRV 0 5 5270 xmpp
; CAA (Certificate Authority Authorization)
; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
@ CAA 128 issue "letsencrypt.org; validationmethods=dns-01"
'';
# Incorrect:
# accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/78014180
in
{
services.knot.settingsFreeform = {
remote.ns_iodine.address = "127.0.0.1@1053";
acl."acl_localhost_acme_${domainID}" = {
address = "127.0.0.1";
action = "update";
update-owner = "name";
update-owner-match = "equal";
update-owner-name = [ "_acme-challenge" ];
update-type = [ "TXT" ];
};
acl."acl_tsig_acme_${domainID}" = {
key = "acme_${domainID}";
action = "update";
update-owner = "name";
update-owner-match = "equal";
update-owner-name = [ "_acme-challenge" ];
update-type = [ "TXT" ];
};
acl."acl_tsig_losurdo_${domainID}" = {
key = "losurdo_${domainID}";
action = "update";
update-owner = "name";
update-owner-match = "equal";
update-owner-name = [ "losurdo" "lan.losurdo" ];
update-type = [ "A" "AAAA" ];
};
acl."acl_lebureau_${domainID}" = {
address =
info.lebureau.dns.secondary.transfer.ipv4 ++
info.lebureau.dns.secondary.transfer.ipv6;
action = "transfer";
key = "lebureau_${domainID}";
};
mod-dnsproxy.proxy_iodine = {
remote = "ns_iodine";
fallback = "off";
};
remote."secondary_lebureau_${domainID}" = {
address = map (x: "${x}@53")
(info.lebureau.dns.secondary.transfer.ipv4 ++
info.lebureau.dns.secondary.transfer.ipv6);
key = "lebureau_${domainID}";
};
zone."${domain}" = {
file = "${domain}.zone";
serial-policy = "increment";
semantic-checks = true;
notify = [
"secondary_lebureau_${domainID}"
];
acl = [
"acl_localhost_acme_${domainID}"
"acl_tsig_acme_${domainID}"
"acl_tsig_losurdo_${domainID}"
"acl_lebureau_${domainID}"
];
dnssec-signing = true;
dnssec-policy = "ed25519";
};
#zone."i.${domain}" = {
# module = "mod-dnsproxy/proxy_iodine";
#};
zone."whoami4.${domain}" = {
module = "mod-whoami";
file = pkgs.writeText "whoami4.zone" ''
$TTL 1
@ SOA ns root.${domain}. (
0 ; SERIAL
86400 ; REFRESH
86400 ; RETRY
86400 ; EXPIRE
1 ; MINIMUM
)
$TTL 86400
@ NS ns
ns A ${hosts.mermet._module.args.ipv4}
'';
};
};
services.knot = {
keyFiles = [
"/run/credentials/knot.service/${domain}.acme.conf"
# Generated with: keymgr -t losurdo_${domainID}
"/run/credentials/knot.service/losurdo.conf"
# Generated with: keymgr -t lebureau_${domainID}
"/run/credentials/knot.service/${domain}.lebureau.conf"
];
};
systemd.services.knot = {
serviceConfig = {
ExecStartPre = [
''
+${pkgs.coreutils}/bin/install -D -o ${users.knot.name} -g ${groups."knot".name} -m 700 \
${pkgs.writeText "${domain}.zone" zoneData} \
/var/lib/knot/zones/${domain}.zone
''
];
LoadCredentialEncrypted = [
"${domain}.acme.conf:${builtins.path { path = ./. + "/${domain}/acme.conf.cred"; }}"
"${domain}.lebureau.conf:${builtins.path { path = ./. + "/${domain}/lebureau.conf.cred"; }}"
"losurdo.conf:${builtins.path { path = ./. + "/${domain}/losurdo.conf.cred"; }}"
];
};
};
networking.nftables.ruleset = ''
table inet filter {
set output-net-knot-ipv4 { type ipv4_addr; elements = { ${lib.concatStringsSep ", " info.lebureau.dns.secondary.transfer.ipv4} }; }
set output-net-knot-ipv6 { type ipv6_addr; elements = { ${lib.concatStringsSep ", " info.lebureau.dns.secondary.transfer.ipv6} }; }
}
'';
/* Useless since the zone is public
services.unbound.settings = {
stub-zone = {
name = domain;
stub-addr = "127.0.0.1@5353";
};
};
'';
*/
}