mermet: nebula: sourcephile.fr: adapt to new conventions

[sourcephile-nix.git] / hosts / mermet / knot / sourcephile.fr.nix

diff --git a/hosts/mermet/knot/sourcephile.fr.nix b/hosts/mermet/knot/sourcephile.fr.nix
index 664a2f644ba2d6642ad61ab784923e8db30c0d19..6b788a1fc201457028fdb209ec270c28641972a2 100644 (file)
--- a/hosts/mermet/knot/sourcephile.fr.nix
+++ b/hosts/mermet/knot/sourcephile.fr.nix
@@ -1,4 +1,12 @@
-{ pkgs, lib, config, inputs, hosts, info, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  inputs,
+  hosts,
+  info,
+  ...
+}:
 let
   domain = "sourcephile.fr";
   domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
@@ -22,7 +30,7 @@ let
 
       ; NS (Name Server)
       @ NS ns
-      ;@ NS ${info.gandi.dns.secondary.ns.name}.
+      ${lib.concatMapStringsSep "\n" ({ name, ... }: "@ NS ${name}.") info.lebureau.dns.secondary.ns}
       i NS ns
       whoami4 NS ns.whoami4
       ns.whoami4 A ${hosts.mermet._module.args.ipv4}
@@ -48,8 +56,8 @@ let
       stun         A ${hosts.mermet._module.args.ipv4}
       turn         A ${hosts.mermet._module.args.ipv4}
       whoami       A ${hosts.mermet._module.args.ipv4}
-      code          A ${hosts.mermet._module.args.ipv4}
-      miniflux      A ${hosts.mermet._module.args.ipv4}
+      code         A ${hosts.mermet._module.args.ipv4}
+      miniflux     A ${hosts.mermet._module.args.ipv4}
 
       ; MX (Mail eXchange)
       @ 500 MX 5 mail
@@ -65,10 +73,11 @@ let
       cryptpad-files   CNAME losurdo
       cryptpad-sandbox CNAME losurdo
       mumble           CNAME mermet
-      freeciv          CNAME losurdo
       nix-serve        CNAME losurdo
       nix-extracache   CNAME losurdo
       nix-localcache   CNAME lan.losurdo
+      ; See https://keys.openpgp.org/about/usage#wkd-as-a-service
+      openpgpkey       CNAME wkd.keys.openpgp.org.
       sftp             CNAME losurdo
       radicle-mermet   CNAME mermet
       radicle          CNAME mermet
@@ -94,9 +103,9 @@ let
       ; DOC: https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum
       @ CAA 128 issue "letsencrypt.org; validationmethods=dns-01"
     '';
-  # Incorrect:
-  # accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/78014180
 in
+# Incorrect:
+# accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/78014180
 {
   services.knot.settingsFreeform = {
     remote.ns_iodine.address = "127.0.0.1@1053";
@@ -121,24 +130,41 @@ in
       action = "update";
       update-owner = "name";
       update-owner-match = "equal";
-      update-owner-name = [ "losurdo" "lan.losurdo" ];
-      update-type = [ "A" "AAAA" ];
+      update-owner-name = [
+        "losurdo"
+        "lan.losurdo"
+      ];
+      update-type = [
+        "A"
+        "AAAA"
+      ];
     };
     acl."acl_lebureau_${domainID}" = {
-      address =
-        info.lebureau.dns.secondary.transfer.ipv4 ++
-        info.lebureau.dns.secondary.transfer.ipv6;
       action = "transfer";
+      address = [
+        info.lebureau.dns.secondary.transfer.ns1.ipv4
+        info.lebureau.dns.secondary.transfer.ns1.ipv6
+        info.lebureau.dns.secondary.transfer.ns2.ipv4
+        info.lebureau.dns.secondary.transfer.ns2.ipv6
+      ];
       key = "lebureau_${domainID}";
     };
     mod-dnsproxy.proxy_iodine = {
       remote = "ns_iodine";
       fallback = "off";
     };
-    remote."secondary_lebureau_${domainID}" = {
-      address = map (x: "${x}@53")
-        (info.lebureau.dns.secondary.transfer.ipv4 ++
-          info.lebureau.dns.secondary.transfer.ipv6);
+    remote."secondary1_lebureau_${domainID}" = {
+      address = [
+        "${info.lebureau.dns.secondary.transfer.ns1.ipv4}@53"
+        "${info.lebureau.dns.secondary.transfer.ns1.ipv6}@53"
+      ];
+      key = "lebureau_${domainID}";
+    };
+    remote."secondary2_lebureau_${domainID}" = {
+      address = [
+        "${info.lebureau.dns.secondary.transfer.ns2.ipv4}@53"
+        "${info.lebureau.dns.secondary.transfer.ns2.ipv6}@53"
+      ];
       key = "lebureau_${domainID}";
     };
     zone."${domain}" = {
@@ -146,7 +172,8 @@ in
       serial-policy = "increment";
       semantic-checks = true;
       notify = [
-        "secondary_lebureau_${domainID}"
+        "secondary1_lebureau_${domainID}"
+        "secondary2_lebureau_${domainID}"
       ];
       acl = [
         "acl_localhost_acme_${domainID}"
@@ -204,11 +231,18 @@ in
   };
   networking.nftables.ruleset = ''
     table inet filter {
-      set output-net-knot-ipv4 { type ipv4_addr; elements = { ${lib.concatStringsSep ", " info.lebureau.dns.secondary.transfer.ipv4} }; }
-      set output-net-knot-ipv6 { type ipv6_addr; elements = { ${lib.concatStringsSep ", " info.lebureau.dns.secondary.transfer.ipv6} }; }
+      set output-net-knot-ipv4 { type ipv4_addr; elements = {
+        ${info.lebureau.dns.secondary.transfer.ns1.ipv4},
+        ${info.lebureau.dns.secondary.transfer.ns2.ipv4}
+      }; }
+      set output-net-knot-ipv6 { type ipv6_addr; elements = {
+        ${info.lebureau.dns.secondary.transfer.ns1.ipv6},
+        ${info.lebureau.dns.secondary.transfer.ns2.ipv6}
+      }; }
     }
   '';
-  /* Useless since the zone is public
+  /*
+    Useless since the zone is public
     services.unbound.settings = {
     stub-zone = {
     name = domain;