{ pkgs, lib, config, inputs, hostName, hosts, ... }: let domain = "sourcephile.fr"; domainID = lib.replaceStrings [ "." ] [ "_" ] domain; inherit (config) networking; inherit (config.services) knot; in { services.knot.zones."${domain}" = { conf = '' remote: - id: ns_iodine address: 127.0.0.1@1053 acl: - id: acl_localhost_acme_${domainID} address: 127.0.0.1 action: update update-owner: name update-owner-match: equal update-owner-name: [_acme-challenge] update-type: [TXT] - id: acl_tsig_acme_${domainID} key: acme_${domainID} action: update update-owner: name update-owner-match: equal update-owner-name: [_acme-challenge] update-type: [TXT] - id: acl_tsig_losurdo_${domainID} key: losurdo_${domainID} action: update update-owner: name update-owner-match: equal update-owner-name: [losurdo, lan.losurdo] update-type: [A, AAAA] mod-dnsproxy: - id: proxy_iodine remote: ns_iodine fallback: off zone: - domain: ${domain} file: ${domain}.zone serial-policy: increment semantic-checks: on notify: secondary_gandi acl: acl_gandi acl: acl_localhost_acme_${domainID} acl: acl_tsig_acme_${domainID} acl: acl_tsig_losurdo_${domainID} dnssec-signing: on dnssec-policy: rsa - domain: i.${domain} module: mod-dnsproxy/proxy_iodine - domain: whoami4.${domain} module: mod-whoami file: "${pkgs.writeText "whoami4.zone" '' $TTL 1 @ SOA ns root.${domain}. ( 0 ; SERIAL 86400 ; REFRESH 86400 ; RETRY 86400 ; EXPIRE 1 ; MINIMUM ) $TTL 86400 @ NS ns ns A ${hosts.mermet._module.args.ipv4} ''}" ''; # TODO: increase the TTL once things have settled down data = '' $ORIGIN ${domain}. $TTL 500 ; SOA (Start Of Authority) @ SOA ns root ( ${toString inputs.self.lastModified} ; Serial number 24h ; Refresh 15m ; Retry 1000h ; Expire (1000h) 1d ; Negative caching ) ; NS (Name Server) @ NS ns @ NS ns6.gandi.net. i NS ns whoami4 NS ns.whoami4 ns.whoami4 A ${hosts.mermet._module.args.ipv4} ; A (DNS -> IPv4) @ A ${hosts.mermet._module.args.ipv4} mermet A ${hosts.mermet._module.args.ipv4} autoconfig A ${hosts.mermet._module.args.ipv4} doc A ${hosts.mermet._module.args.ipv4} git A ${hosts.mermet._module.args.ipv4} imap A ${hosts.mermet._module.args.ipv4} mail A ${hosts.mermet._module.args.ipv4} mails A ${hosts.mermet._module.args.ipv4} news A ${hosts.mermet._module.args.ipv4} public-inbox A ${hosts.mermet._module.args.ipv4} ns A ${hosts.mermet._module.args.ipv4} pop A ${hosts.mermet._module.args.ipv4} smtp A ${hosts.mermet._module.args.ipv4} submission A ${hosts.mermet._module.args.ipv4} www A ${hosts.mermet._module.args.ipv4} lemoutona5pattes A ${hosts.mermet._module.args.ipv4} croc A ${hosts.mermet._module.args.ipv4} stun A ${hosts.mermet._module.args.ipv4} turn A ${hosts.mermet._module.args.ipv4} whoami A ${hosts.mermet._module.args.ipv4} code A ${hosts.mermet._module.args.ipv4} miniflux A ${hosts.mermet._module.args.ipv4} ; CNAME (Canonical Name) openconcerto CNAME losurdo xmpp CNAME mermet tmp CNAME mermet proxy65 CNAME mermet cryptpad CNAME losurdo cryptpad-api CNAME losurdo cryptpad-files CNAME losurdo cryptpad-sandbox CNAME losurdo mumble CNAME mermet freeciv CNAME losurdo nix-serve CNAME losurdo nix-extracache CNAME losurdo nix-localcache CNAME lan.losurdo sftp CNAME losurdo ; DMARC (Domain-based Message Authentication, Reporting and Conformance) _dmarc 3600 IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:root+dmarc+aggregate@sourcephile.fr; ruf=mailto:root+dmarc+forensic@sourcephile.fr" ; SPF (Sender Policy Framework) @ 3600 IN TXT "v=spf1 mx ip4:${hosts.mermet._module.args.ipv4} -all" ; SRV (SeRVice) _git._tcp.git 18000 IN SRV 0 0 9418 git _stun._udp 18000 IN SRV 0 5 3478 stun _xmpp-client._tcp 18000 IN SRV 0 5 5222 xmpp _xmpp-server._tcp 18000 IN SRV 0 5 5269 xmpp _xmpp-server._tcp.salons 18000 IN SRV 0 5 5269 xmpp ; CAA (Certificate Authority Authorization) ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum @ CAA 128 issue "letsencrypt.org" ''; }; services.knot = { keyFiles = [ "/run/credentials/knot.service/${domain}.acme.conf" # Generated with: keymgr -t losurdo_${domainID} "/run/credentials/knot.service/losurdo.conf" ]; }; systemd.services.knot = { serviceConfig = { LoadCredentialEncrypted = [ "${domain}.acme.conf:${./. + "/${domain}/acme.conf.cred"}" "losurdo.conf:${./. + "/${domain}/losurdo.conf.cred"}" ]; }; }; networking.nftables.ruleset = '' table inet filter { # Gandi DNS set output-net-knot-ipv4 { type ipv4_addr elements = { 217.70.177.42 } } set output-net-knot-ipv6 { type ipv6_addr elements = { 2001:4b98:d:1::4b } } } ''; /* Useless since the zone is public services.unbound.settings = { stub-zone = { name = domain; stub-addr = "127.0.0.1@5353"; }; }; ''; */ }