274 lines
No EOL
8.8 KiB
Nix
274 lines
No EOL
8.8 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
# Import nodes
|
|
nodes = import ./../../nodes.nix;
|
|
myName = config.hostName;
|
|
myNode = nodes."${myName}";
|
|
|
|
# And mapping
|
|
mapping = import ./../../mapping.nix;
|
|
|
|
dkim = import ./dkim.nix;
|
|
|
|
supportsIPv4 = nd: lib.hasAttr "ip4" nd;
|
|
supportsIPv6 = nd: lib.hasAttr "ip6" nd;
|
|
|
|
timestampDerivation = pkgs.runCommand "timestamp" {} ''
|
|
echo -n $(date +%s) > $out
|
|
'';
|
|
timestamp = builtins.readFile timestampDerivation;
|
|
|
|
# Domain key
|
|
domainkey = ''
|
|
v=DKIM1; k=rsa; p=${dkim.dkim_pub}'';
|
|
segments = ((lib.stringLength domainkey) / 255);
|
|
domainkeySplitted = map (x: lib.substring (x*255) 255 domainkey) (lib.range 0 segments);
|
|
|
|
#####
|
|
## Knot specific
|
|
#####
|
|
|
|
# Define remote based on current role
|
|
remotes = if myName == mapping.dns.master then
|
|
map (hostname: {
|
|
id = hostname;
|
|
address = "172.19.${toString nodes.${hostname}.zone}.${toString nodes.${hostname}.id}@53";
|
|
}) mapping.dns.secondary
|
|
else
|
|
[{
|
|
id = mapping.dns.master;
|
|
address = "172.19.${toString nodes.${mapping.dns.master}.zone}.${toString nodes.${mapping.dns.master}.id}@53";
|
|
}];
|
|
|
|
remotesNames = map (remote: remote.id) remotes;
|
|
|
|
# Remotes ACL
|
|
remotesACL = if myName == mapping.dns.master then
|
|
map (hostname: {
|
|
id = "acl_${hostname}";
|
|
address = "172.19.${toString nodes.${hostname}.zone}.${toString nodes.${hostname}.id}";
|
|
action = "transfer";
|
|
}) mapping.dns.secondary
|
|
else
|
|
[{
|
|
id = "acl_${mapping.dns.master}";
|
|
address = "172.19.${toString nodes.${mapping.dns.master}.zone}.${toString nodes.${mapping.dns.master}.id}";
|
|
action = "notify";
|
|
}];
|
|
|
|
remotesACLNames = map (remote: remote.id) remotesACL;
|
|
|
|
# Other ACL
|
|
letsencryptACL = if myName == mapping.dns.master then
|
|
[{
|
|
id = "acl_le_challenge";
|
|
address = [
|
|
"172.19.0.0/16"
|
|
"fc00::/96"
|
|
];
|
|
action = "update";
|
|
update-type = "TXT";
|
|
key = "letsencrypt";
|
|
}]
|
|
else [];
|
|
|
|
acls = remotesACL ++ letsencryptACL;
|
|
|
|
# Mod-query ACLs
|
|
modQueryACLs = [{
|
|
id = "local";
|
|
address = [
|
|
"172.19.0.0/16"
|
|
"fc00::/96"
|
|
];
|
|
}];
|
|
|
|
#####
|
|
## Zone specific
|
|
#####
|
|
|
|
# host to dn
|
|
hostToDomain = hostname: builtins.replaceStrings ["-"] ["."] hostname;
|
|
hostToLfDomain = hostname: builtins.replaceStrings [".lasuite.federez"] [".lf."] (hostToDomain hostname);
|
|
|
|
# Remove cidr notation
|
|
rmCidr = ip: builtins.head (builtins.split "/" ip);
|
|
|
|
# Gen NS
|
|
toNSRecord = host: "\tIN NS ${hostToDomain host}.net.";
|
|
nsRecords = map toNSRecord mapping.dns.secondary;
|
|
|
|
dnsSecondaryConfigs = lib.filterAttrs (peerName: _peerConfig: lib.elem peerName mapping.dns.secondary) nodes;
|
|
|
|
# Gen A NS
|
|
nsARecords = lib.flatten (lib.mapAttrsToList (hostname: node:
|
|
lib.optional (supportsIPv4 node) "${hostToDomain hostname}.net. IN A ${rmCidr node.ip4}"
|
|
) dnsSecondaryConfigs);
|
|
|
|
# Gen AAAA NS
|
|
nsAAAARecords = lib.flatten (lib.mapAttrsToList (hostname: node:
|
|
lib.optional (supportsIPv6 node) "${hostToDomain hostname}.net. IN AAAA ${rmCidr node.ip6}"
|
|
) dnsSecondaryConfigs);
|
|
|
|
# Gen A records for lf zone
|
|
lfARecords = lib.flatten (lib.mapAttrsToList (hostname: node:
|
|
"${hostToLfDomain hostname} IN A 172.19.${toString node.zone}.${toString node.id}"
|
|
) nodes);
|
|
|
|
# Gen AAAA records for lf zone
|
|
lfAAAARecords = lib.flatten (lib.mapAttrsToList (hostname: node:
|
|
"${hostToLfDomain hostname} IN AAAA fc00::${toString node.zone}:${toString node.id}"
|
|
) nodes);
|
|
|
|
# Gen first NS for SOA
|
|
firstNS = builtins.head mapping.dns.secondary;
|
|
firstNSDn = "${hostToDomain firstNS}.net.";
|
|
|
|
# Zone conf
|
|
zoneLasuiteFederezNetFilePath = "/var/lib/knot/zones/zone-lasuite-federez-net";
|
|
zone-lasuite-federez-net = pkgs.writeText "zone-lasuite-federez-net" ''
|
|
$ORIGIN lasuite.federez.net.
|
|
$TTL 60
|
|
@ IN SOA ${firstNSDn} monitoring.lasuite.federez.net. (
|
|
${timestamp} ; serial
|
|
60 ; refresh
|
|
60 ; retry
|
|
60 ; expire
|
|
60 ) ; minimum TTL
|
|
|
|
IN TXT "v=spf1 a:lasuite.federez.net ~all"
|
|
|
|
${builtins.concatStringsSep "\n" nsRecords}
|
|
|
|
${builtins.concatStringsSep "\n" nsARecords}
|
|
${builtins.concatStringsSep "\n" nsAAAARecords}
|
|
|
|
_dmarc IN TXT "v=DMARC1; p=quarantine; ruf=mailto:postmaster@lasuite.federez.net"
|
|
_mta-sts IN TXT "v=STSv1; id=1"
|
|
_smtp._tls IN TXT "v=TLSRPTv1;rua=mailto:postmaster@lasuite.federez.net"
|
|
default._domainkey IN TXT "${lib.concatStringsSep "\" \"" domainkeySplitted}"
|
|
'';
|
|
|
|
zoneLfFilePath = "/var/lib/knot/zones/zone-lf";
|
|
zone-lf = pkgs.writeText "zone-lf" ''
|
|
$ORIGIN lf.
|
|
$TTL 60
|
|
@ IN SOA dns.lf. monitoring.lasuite.federez.net. (
|
|
${timestamp} ; serial
|
|
60 ; refresh
|
|
60 ; retry
|
|
60 ; expire
|
|
60 ) ; minimum TTL
|
|
|
|
${builtins.concatStringsSep "\n" lfARecords}
|
|
${builtins.concatStringsSep "\n" lfAAAARecords}
|
|
'';
|
|
in
|
|
{
|
|
age.secrets = {
|
|
"tsig" = {
|
|
file = ./../../secrets/dns/tsig.age;
|
|
owner = "knot";
|
|
group = "knot";
|
|
};
|
|
};
|
|
|
|
# Ensure the directory exists and is writable
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/knot/zones 0755 knot knot -"
|
|
"f /var/lib/knot/zones/zone-lasuite-federez-net 0644 knot knot -"
|
|
];
|
|
|
|
# Force complete restart on zone changes
|
|
systemd.services.knot = {
|
|
restartTriggers = [ zone-lasuite-federez-net zone-lf ];
|
|
reloadIfChanged = lib.mkForce false;
|
|
};
|
|
services.knot = {
|
|
enable = true;
|
|
package = pkgs.knot-dns;
|
|
|
|
# To regenerate the secret use:
|
|
# nix-shell -p knot-dns
|
|
# keymgr tsig generate -t letsencrypt hmac-sha512
|
|
keyFiles = [
|
|
config.age.secrets.tsig.path
|
|
];
|
|
|
|
settings = {
|
|
server = {
|
|
listen =
|
|
[
|
|
"172.19.${toString myNode.zone}.${toString myNode.id}@53"
|
|
"fc00::${toString myNode.zone}:${toString myNode.id}@53"
|
|
]
|
|
++ lib.optional (supportsIPv4 myNode) "${rmCidr myNode.ip4}@53"
|
|
++ lib.optional (supportsIPv6 myNode) "${rmCidr myNode.ip6}@53";
|
|
};
|
|
|
|
remote = remotes;
|
|
|
|
acl = acls;
|
|
mod-queryacl = modQueryACLs;
|
|
|
|
zone = if myName == mapping.dns.master then [
|
|
{
|
|
domain = "lasuite.federez.net";
|
|
file = zoneLasuiteFederezNetFilePath;
|
|
dnssec-signing = "on";
|
|
dnssec-policy = "default";
|
|
zonefile-load = "difference";
|
|
notify = remotesNames;
|
|
acl = remotesACLNames ++ [
|
|
"acl_le_challenge"
|
|
];
|
|
}
|
|
{
|
|
domain = "lf";
|
|
file = zoneLfFilePath;
|
|
notify = remotesNames;
|
|
acl = remotesACLNames;
|
|
module = "mod-queryacl/local";
|
|
}
|
|
] else [
|
|
{
|
|
domain = "lasuite.federez.net";
|
|
master = builtins.head remotesNames;
|
|
acl = remotesACLNames;
|
|
}
|
|
{
|
|
domain = "lf";
|
|
master = builtins.head remotesNames;
|
|
acl = remotesACLNames;
|
|
module = "mod-queryacl/local";
|
|
}
|
|
];
|
|
|
|
log = [
|
|
{
|
|
target = "syslog";
|
|
any = "debug";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
# Write the generated zone file to the writable path
|
|
systemd.services.writeLasuiteFederezNetZoneFile = {
|
|
before = [ "knot.service" ];
|
|
description = "Write initial zone file for lasuite.federez.net";
|
|
serviceConfig = {
|
|
ExecStart = "${pkgs.coreutils}/bin/cp '${zone-lasuite-federez-net}' ${zoneLasuiteFederezNetFilePath}";
|
|
};
|
|
wantedBy = [ "multi-user.target" ];
|
|
};
|
|
systemd.services.writeLfZoneFile = {
|
|
before = [ "knot.service" ];
|
|
description = "Write initial zone file for lasuite.federez";
|
|
serviceConfig = {
|
|
ExecStart = "${pkgs.coreutils}/bin/cp '${zone-lf}' ${zoneLfFilePath}";
|
|
};
|
|
wantedBy = [ "multi-user.target" ];
|
|
};
|
|
} |