{ pkgs, lib, config, inputs, hosts, info, ... }: let domain = "autogeree.net"; domainID = lib.replaceStrings [ "." ] [ "_" ] domain; inherit (config) networking; inherit (config.services) knot; inherit (config.users) users groups; zoneData = # TODO: increase the TTL once things have settled down '' $ORIGIN ${domain}. $TTL 500 ; SOA (Start Of Authority) @ SOA ns root ( ${toString inputs.self.lastModified} ; Serial number 24h ; Refresh 15m ; Retry 1000h ; Expire (1000h) 1d ; Negative caching ) ; NS (Name Server) @ NS ns @ NS ${info.gandi.dns.secondary.ns.name}. ;@ NS ns0.muarf.org. ; A (DNS -> IPv4) @ A ${hosts.mermet._module.args.ipv4} mermet A ${hosts.mermet._module.args.ipv4} autoconfig A ${hosts.mermet._module.args.ipv4} code A ${hosts.mermet._module.args.ipv4} git A ${hosts.mermet._module.args.ipv4} imap A ${hosts.mermet._module.args.ipv4} mail A ${hosts.mermet._module.args.ipv4} ns A ${hosts.mermet._module.args.ipv4} pleroma A ${hosts.mermet._module.args.ipv4} pop A ${hosts.mermet._module.args.ipv4} smtp A ${hosts.mermet._module.args.ipv4} submission A ${hosts.mermet._module.args.ipv4} www A ${hosts.mermet._module.args.ipv4} chomsky A 91.216.110.36 alpes A 195.88.84.51 ; SPF (Sender Policy Framework) @ 3600 IN SPF "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all" @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all" ; MX (Mail eXchange) @ 180 MX 5 mail ; SRV (SeRVice) _git._tcp.git 18000 IN SRV 0 0 9418 git ; CAA (Certificate Authority Authorization) ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum @ CAA 128 issue "letsencrypt.org" ''; in { services.knot.settingsFreeform = { acl."acl_localhost_acme_${domainID}" = { address = "127.0.0.1"; action = "update"; update-owner = "name"; update-owner-match = "equal"; update-owner-name = [ "_acme-challenge" ]; update-type = [ "TXT" ]; }; acl."acl_tsig_acme_${domainID}" = { key = "acme_${domainID}"; action = "update"; update-owner = "name"; update-owner-match = "equal"; update-owner-name = [ "_acme-challenge" ]; update-type = [ "TXT" ]; }; zone."${domain}" = { file = "${domain}.zone"; serial-policy = "increment"; semantic-checks = true; notify = [ "secondary_gandi" #"secondary_muarf" ]; acl = [ "acl_gandi" #"acl_muarf" "acl_localhost_acme_${domainID}" "acl_tsig_acme_${domainID}" ]; dnssec-signing = false; dnssec-policy = "ed25519"; }; }; networking.nftables.ruleset = '' table inet filter { set output-net-knot-ipv4 { type ipv4_addr; elements = { ${info.gandi.dns.secondary.axfr.ipv4} }; } set output-net-knot-ipv6 { type ipv6_addr; elements = { ${info.gandi.dns.secondary.axfr.ipv6} }; } } ''; services.knot = { keyFiles = [ "/run/credentials/knot.service/${domain}.acme.conf" ]; }; systemd.services.knot = { serviceConfig = { ExecStartPre = [ '' +${pkgs.coreutils}/bin/install -D -o ${users.knot.name} -g ${groups."knot".name} -m 700 \ ${pkgs.writeText "${domain}.zone" zoneData} \ /var/lib/knot/zones/${domain}.zone '' ]; LoadCredentialEncrypted = [ "${domain}.acme.conf:${./. + "/${domain}/acme.conf.cred"}" ]; }; }; /* Useless since the zone is public services.unbound.settings = { stub-zone = { name = domain; stub-addr = "127.0.0.1@5353"; }; }; ''; */ }