{ pkgs, lib, config, machines, ... }: let domain = "sourcephile.fr"; domainID = lib.replaceStrings ["."] ["_"] domain; inherit (builtins) attrValues; inherit (builtins.extraBuiltins) git; inherit (config) networking; inherit (config.security) pass; inherit (config.services) knot; inherit (config.users) users groups; # Use the Git commit time of the ${domain}.nix file to set the serial number. # WARNING: the ${domain}.nix must be committed into Git for this to work. # WARNING: this does not take other .nix into account, though they may contribute to the zone's data. serial = domain: toString (git ./. [ "log" "-1" "--format=%ct" "--" (domain + ".nix") ]); in { services.knot.zones."${domain}" = { conf = '' acl: - id: acl_localhost_acme_${domainID} address: 127.0.0.1 action: update update-owner: name update-owner-match: equal update-owner-name: [_acme-challenge.${domain}] update-type: [TXT] - id: acl_tsig_acme_${domainID} address: ${machines.losurdo.extraArgs.ipv4} key: acme_${domainID} action: update update-owner: name update-owner-match: equal update-owner-name: [_acme-challenge.${domain}] update-type: [TXT] zone: - domain: ${domain} file: ${domain}.zone serial-policy: increment semantic-checks: on notify: secondary_gandi acl: acl_gandi acl: acl_localhost_acme_${domainID} acl: acl_tsig_acme_${domainID} dnssec-signing: on dnssec-policy: rsa - domain: whoami4.${domain} module: mod-whoami file: "${pkgs.writeText "whoami4.zone" '' $TTL 1 @ SOA ns root.${domain}. ( ${serial domain} ; SERIAL 86400 ; REFRESH 86400 ; RETRY 86400 ; EXPIRE 1 ; MINIMUM ) $TTL 86400 @ NS ns ns A ${machines.mermet.extraArgs.ipv4} ''}" ''; # TODO: increase the TTL once things have settled down data = '' $ORIGIN ${domain}. $TTL 500 ; SOA (Start Of Authority) @ SOA ns root ( ${serial domain} ; Serial number 24h ; Refresh 15m ; Retry 1000h ; Expire (1000h) 1d ; Negative caching ) ; NS (Name Server) @ NS ns @ NS ns6.gandi.net. whoami4 NS ns.whoami4 ns.whoami4 A ${machines.mermet.extraArgs.ipv4} ; A (DNS -> IPv4) @ A ${machines.mermet.extraArgs.ipv4} mermet A ${machines.mermet.extraArgs.ipv4} losurdo A ${machines.losurdo.extraArgs.ipv4} autoconfig A ${machines.mermet.extraArgs.ipv4} doc A ${machines.mermet.extraArgs.ipv4} code A ${machines.mermet.extraArgs.ipv4} git A ${machines.mermet.extraArgs.ipv4} imap A ${machines.mermet.extraArgs.ipv4} mail A ${machines.mermet.extraArgs.ipv4} mails A ${machines.mermet.extraArgs.ipv4} news A ${machines.mermet.extraArgs.ipv4} public-inbox A ${machines.mermet.extraArgs.ipv4} ns A ${machines.mermet.extraArgs.ipv4} pop A ${machines.mermet.extraArgs.ipv4} smtp A ${machines.mermet.extraArgs.ipv4} submission A ${machines.mermet.extraArgs.ipv4} www A ${machines.mermet.extraArgs.ipv4} lemoutona5pattes A ${machines.mermet.extraArgs.ipv4} covid19 A ${machines.mermet.extraArgs.ipv4} openconcerto A ${machines.losurdo.extraArgs.ipv4} ; SPF (Sender Policy Framework) @ 3600 IN SPF "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all" @ 3600 IN TXT "v=spf1 mx ip4:${machines.mermet.extraArgs.ipv4} -all" ; MX (Mail eXchange) @ 180 MX 5 mail ; SRV (SeRVice) _git._tcp.git 18000 IN SRV 0 0 9418 git ; CAA (Certificate Authority Authorization) ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum @ CAA 128 issue "letsencrypt.org" ''; }; services.knot = { keyFiles = [ pass.secrets."knot/tsig/${domain}/acme.conf".path ]; }; security.pass.secrets."knot/tsig/${domain}/acme.conf" = { # Generated with: keymgr -t acme_${domainID} user = users.knot.name; }; systemd.services.knot = { after = [ pass.secrets."knot/tsig/${domain}/acme.conf".service ]; wants = [ pass.secrets."knot/tsig/${domain}/acme.conf".service ]; }; /* Useless since the zone is public services.unbound.extraConfig = '' stub-zone: name: "sourcephile.fr" stub-addr: 127.0.0.1@5353 ''; */ }