{ pkgs, lib, config, ... }: let inherit (builtins.extraBuiltins) pass git; inherit (pkgs.lib) unlinesAttrs types; inherit (config) networking; inherit (config.services) knot; inherit (config) users; # Use the Git commit time of the ${domain}.nix file to set the serial number. # WARNING: the ${domain}.nix must be committed into Git for this to work. # WARNING: this does not take other .nix into account, though they may contribute to the zone's data. serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]); mermetIPv4 = "80.67.180.129"; domain = "sourcephile.fr"; in { security.acme.certs."${domain}" = { email = "root@${domain}"; extraDomains = { "*.${domain}" = null; }; group = users.groups.acme.name; allowKeysForGroup = true; keyType = "rsa4096"; dnsProvider = "rfc2136"; credentialsFile = pkgs.writeText "credentials" '' RFC2136_NAMESERVER=127.0.0.1:5353 LEGO_EXPERIMENTAL_CNAME_SUPPORT=1 ''; }; services.knot.zones."${domain}" = { conf = '' acl: - id: acl_acme_challenge_sourcephile_fr address: 127.0.0.1 action: update update-owner: name update-owner-match: equal update-owner-name: [_acme-challenge.${domain}] update-type: [TXT] zone: - domain: ${domain} file: ${domain}.zone serial-policy: increment semantic-checks: on notify: secondary_gandi acl: acl_gandi acl: acl_acme_challenge_sourcephile_fr dnssec-signing: on dnssec-policy: rsa ''; # TODO: increase the TTL once things have settled down data = '' $ORIGIN ${domain}. $TTL 500 ; SOA (Start Of Authority) @ SOA ns admin ( ${serial domain} ; Serial number 24h ; Refresh 15m ; Retry 1000h ; Expire (1000h) 1d ; Negative caching ) ; NS (Name Server) @ NS ns @ NS ns6.gandi.net. ; A (DNS -> IPv4) @ A ${mermetIPv4} mermet A ${mermetIPv4} autoconfig A ${mermetIPv4} doc A ${mermetIPv4} code A ${mermetIPv4} git A ${mermetIPv4} imap A ${mermetIPv4} mail A ${mermetIPv4} ns A ${mermetIPv4} pop A ${mermetIPv4} smtp A ${mermetIPv4} submission A ${mermetIPv4} www A ${mermetIPv4} ; SPF (Sender Policy Framework) @ 3600 IN SPF "v=spf1 mx ip4:${mermetIPv4} -all" @ 3600 IN TXT "v=spf1 mx ip4:${mermetIPv4} -all" ; MX (Mail eXchange) @ 180 MX 5 mail ; SRV (SeRVice) _git._tcp.git 18000 IN SRV 0 0 9418 git ; CAA (Certificate Authority Authorization) ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum @ CAA 128 issue "letsencrypt.org" ''; }; /* Useless since the zone is public services.unbound.extraConfig = '' stub-zone: name: "sourcephile.fr" stub-addr: 127.0.0.1@5353 ''; */ }