[perso/Immae/Config/Nix.git] / modules / private / dns.nix

{ lib, pkgs, config, ... }:
{
  options.myServices.dns.enable = lib.mkEnableOption "enable DNS resolver";
  config = let
    # taken from unstable
    cartesianProductOfSets = attrsOfLists: with lib;
      lib.foldl' (listOfAttrs: attrName:
        concatMap (attrs:
          map (listValue: attrs // { ${attrName} = listValue; }) attrsOfLists.${attrName}
        ) listOfAttrs
      ) [{}] (attrNames attrsOfLists);
    cfg = config.services.bind;
    keyIncludes = builtins.concatStringsSep "\n" (map (v: "include \"${config.secrets.fullPaths."bind/${v}.key"}\";") (builtins.attrNames config.myEnv.dns.keys));
    cartProduct = lib.foldr
      (s: servers: servers // { ${s.masters} = lib.unique ((servers.${s.masters} or []) ++ [s.keys]); })
      {}
      (lib.unique (lib.concatMap (z: cartesianProductOfSets { masters = z.masters or []; keys = z.keys or []; }) config.myEnv.dns.slaveZones));
    toKeyList = servers: keys: builtins.concatStringsSep "\n" (map (s: ''
      server ${s} {
        keys { ${builtins.concatStringsSep ";" keys}; };
      };
    '') servers);
    serverIncludes = builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: toKeyList (lib.flatten (builtins.attrValues config.myEnv.dns.ns."${n}"))) cartProduct);
    configFile = pkgs.writeText "named.conf" ''
      include "/etc/bind/rndc.key";
      controls {
        inet 127.0.0.1 allow {localhost;} keys {"rndc-key";};
      };

      acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} };
      acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} };

      options {
        listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} };
        listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} };
        allow-query { cachenetworks; };
        blackhole { badnetworks; };
        forward first;
        forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} };
        directory "/var/run/named";
        pid-file "/var/run/named/named.pid";
        ${cfg.extraOptions}
      };

      ${keyIncludes}
      ${serverIncludes}

      ${cfg.extraConfig}

      ${ lib.concatMapStrings
          ({ name, file, master ? true, extraConfig ? "", slaves ? [], masters ? [] }:
            ''
              zone "${name}" {
                type ${if master then "master" else "slave"};
                file "${file}";
                ${ if lib.lists.length slaves > 0 then
                  ''
                    allow-transfer {
                      ${lib.concatMapStrings (ip: "${ip};\n") slaves}
                    };
                  '' else ""}
                ${ if lib.lists.length masters > 0 then
                  ''
                    masters {
                      ${lib.concatMapStrings (ip: "${ip};\n") masters}
                    };
                  '' else ""}
                allow-query { any; };
                ${extraConfig}
              };
            '')
          (builtins.attrValues cfg.zones) }
    '';
    mxes = lib.attrsets.filterAttrs
      (n: v: v.mx.enable)
      config.myEnv.servers;
    ip4mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList
      (n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN A     ${i}") v.ips.main.ip4))
      mxes);
    ip6mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList
      (n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN AAAA  ${i}") v.ips.main.ip6))
      mxes);
    mxmxes = n: conf: builtins.concatStringsSep "\n" (lib.mapAttrsToList
      (_: v: "${n} IN MX ${v.mx.priority} ${v.mx.subdomain}.${conf.name}.")
      mxes);
  in lib.mkIf config.myServices.dns.enable {
    myServices.chatonsProperties.hostings.dns-secondaire = {
      file.datetime = "2022-08-22T02:00:00";
      hosting = {
        name = "DNS secondaire";
        description = "DNS secondaire";
        website = "ns1.immae.eu";
        status.level = "OK";
        status.description = "OK";
        registration.load = "OPEN";
        install.type = "PACKAGE";
      };
      software = {
        name = "bind9";
        website = pkgs.bind.meta.homepage;
        license.url = pkgs.bind.meta.license.url;
        license.name = pkgs.bind.meta.license.fullName;
        version = pkgs.bind.version;
        source.url = "https://www.isc.org/download/";
      };
    };
    networking.firewall.allowedUDPPorts = [ 53 ];
    networking.firewall.allowedTCPPorts = [ 53 ];
    users.users.named.extraGroups = [ "keys" ];
    secrets.keys = lib.mapAttrs' (k: v:
      lib.nameValuePair "bind/${k}.key" {
        permissions = "0400";
        user = "named";
        text = ''
          key "${k}"
            {
              algorithm ${v.algorithm};
              secret "${v.secret}";
            };
        '';
      }
    ) config.myEnv.dns.keys;
    services.bind = {
      enable = true;
      cacheNetworks = ["any"];
      configFile = configFile;
      extraOptions = ''
        allow-recursion { 127.0.0.1; };
        allow-transfer  { none; };

        notify-source    ${lib.head config.myEnv.servers.eldiron.ips.main.ip4};
        notify-source-v6 ${lib.head config.myEnv.servers.eldiron.ips.main.ip6};
        version   none;
        hostname  none;
        server-id none;
        '';
      zones = with config.myEnv.dns;
        assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != ".";
        assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != ".";
        (map (conf: {
          name = conf.name;
          master = false;
          file = "/var/run/named/${conf.name}.zone";
          masters = if lib.attrsets.hasAttr "masters" conf
            then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.masters)
            else [];
          slaves = [];
        }) slaveZones)
        ++ (map (conf: {
          name = conf.name;
          master = true;
          extraConfig = if lib.attrsets.hasAttr "extra" conf then conf.extra else "";
          masters = [];
          slaves = if lib.attrsets.hasAttr "slaves" conf
            then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.slaves)
            else [];
          file = pkgs.writeText "${conf.name}.zone" ''
              $TTL 10800
              @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl}

              ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))}
              ${lib.optionalString (conf.withCAA != null) ''
                ${conf.name}. IN CAA 0 issue "${conf.withCAA}"
              ''}

              ${conf.entries}

              ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then ''
              ${ip4mxes}
              ${ip6mxes}
              ${lib.concatStringsSep "\n\n" (map (e:
              let
                n = if e.domain == "" then "@" else "${e.domain}  ";
                suffix = if e.domain == "" then "" else ".${e.domain}";
              in
              ''
              ; ------------------ mail: ${n} ---------------------------
              ${mxmxes n conf}

              ; https://tools.ietf.org/html/rfc6186
              _submission._tcp${suffix}  SRV  0 1  587 smtp.immae.eu.
              _submissions._tcp${suffix} SRV  0 1  465 smtp.immae.eu.
              _imap._tcp${suffix}        SRV  0 1  143 imap.immae.eu.
              _imaps._tcp${suffix}       SRV  0 1  993 imap.immae.eu.
              _pop3._tcp${suffix}        SRV 10 1  110 pop3.immae.eu.
              _pop3s._tcp${suffix}       SRV 10 1  995 pop3.immae.eu.
              _sieve._tcp${suffix}       SRV  0 1 4190 imap.immae.eu.

              ; MTA-STS
              ; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/
              ; https://support.google.com/a/answer/9261504
              _mta-sts${suffix}   IN TXT  "v=STSv1;id=20200109150200Z"
              _smtp._tls${suffix} IN TXT  "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu"
              ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix}    IN A    ${i}") config.myEnv.servers.eldiron.ips.main.ip4)}
              ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix}    IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)}

              ; Mail sender authentications
              ${n}                   IN TXT  "v=spf1 mx ~all"
              _dmarc${suffix}              IN TXT  "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster+rua@immae.eu; ruf=mailto:postmaster+ruf@immae.eu;"
              ${if e.send then ''
              immae_eu._domainkey${suffix} IN TXT  ( "v=DKIM1; k=rsa; s=email; "
                        "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF"
                        "0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" )
              eldiron._domainkey${suffix}  IN TXT  ${config.myEnv.mail.dkim.eldiron.public}
              '' else ""}
              '') conf.withEmail)}
              '' + (if conf.name == "immae.eu" then ''
              ; ----------------- Accept DMARC reports -------------------
              ${lib.concatStringsSep "\n" (
                lib.flatten (
                  map (z: map (e: "${e.domain}${if builtins.stringLength e.domain > 0 then "." else ""}${z.name}._report._dmarc IN TXT \"v=DMARC1;\"") (z.withEmail or [])) masterZones
                )
              )}
              '' else "") else ""}
            '';
          }) masterZones);
    };
  };
}
Commit	Line	Data
ab8f306d	1	{ lib, pkgs, config, ... }:
bb5e0900	2	{
8415083e	3	options.myServices.dns.enable = lib.mkEnableOption "enable DNS resolver";
bb5e0900	4	config = let
11c2119f IB	5	# taken from unstable
	6	cartesianProductOfSets = attrsOfLists: with lib;
	7	lib.foldl' (listOfAttrs: attrName:
	8	concatMap (attrs:
	9	map (listValue: attrs // { ${attrName} = listValue; }) attrsOfLists.${attrName}
	10	) listOfAttrs
	11	) [{}] (attrNames attrsOfLists);
bb5e0900	12	cfg = config.services.bind;
da30ae4f	13	keyIncludes = builtins.concatStringsSep "\n" (map (v: "include \"${config.secrets.fullPaths."bind/${v}.key"}\";") (builtins.attrNames config.myEnv.dns.keys));
11c2119f IB	14	cartProduct = lib.foldr
	15	(s: servers: servers // { ${s.masters} = lib.unique ((servers.${s.masters} or []) ++ [s.keys]); })
	16	{}
	17	(lib.unique (lib.concatMap (z: cartesianProductOfSets { masters = z.masters or []; keys = z.keys or []; }) config.myEnv.dns.slaveZones));
8175055f IB	18	toKeyList = servers: keys: builtins.concatStringsSep "\n" (map (s: ''
	19	server ${s} {
	20	keys { ${builtins.concatStringsSep ";" keys}; };
	21	};
	22	'') servers);
11c2119f	23	serverIncludes = builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: toKeyList (lib.flatten (builtins.attrValues config.myEnv.dns.ns."${n}"))) cartProduct);
bb5e0900 IB	24	configFile = pkgs.writeText "named.conf" ''
	25	include "/etc/bind/rndc.key";
	26	controls {
	27	inet 127.0.0.1 allow {localhost;} keys {"rndc-key";};
	28	};
	29
	30	acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} };
	31	acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} };
	32
	33	options {
	34	listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} };
	35	listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} };
	36	allow-query { cachenetworks; };
	37	blackhole { badnetworks; };
	38	forward first;
	39	forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} };
	40	directory "/var/run/named";
	41	pid-file "/var/run/named/named.pid";
	42	${cfg.extraOptions}
	43	};
	44
8175055f IB	45	${keyIncludes}
	46	${serverIncludes}
	47
bb5e0900 IB	48	${cfg.extraConfig}
	49
	50	${ lib.concatMapStrings
e34b3079	51	({ name, file, master ? true, extraConfig ? "", slaves ? [], masters ? [] }:
bb5e0900 IB	52	''
	53	zone "${name}" {
	54	type ${if master then "master" else "slave"};
	55	file "${file}";
	56	${ if lib.lists.length slaves > 0 then
	57	''
	58	allow-transfer {
	59	${lib.concatMapStrings (ip: "${ip};\n") slaves}
	60	};
	61	'' else ""}
	62	${ if lib.lists.length masters > 0 then
	63	''
	64	masters {
	65	${lib.concatMapStrings (ip: "${ip};\n") masters}
	66	};
	67	'' else ""}
	68	allow-query { any; };
e34b3079	69	${extraConfig}
bb5e0900 IB	70	};
bb5e0900 IB	71	'')
e34b3079	72	(builtins.attrValues cfg.zones) }
bb5e0900	73	'';
619e4f46 IB	74	mxes = lib.attrsets.filterAttrs
	75	(n: v: v.mx.enable)
	76	config.myEnv.servers;
	77	ip4mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList
05becbbb	78	(n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN A ${i}") v.ips.main.ip4))
619e4f46 IB	79	mxes);
	80	ip6mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList
	81	(n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN AAAA ${i}") v.ips.main.ip6))
	82	mxes);
	83	mxmxes = n: conf: builtins.concatStringsSep "\n" (lib.mapAttrsToList
	84	(_: v: "${n} IN MX ${v.mx.priority} ${v.mx.subdomain}.${conf.name}.")
	85	mxes);
8415083e	86	in lib.mkIf config.myServices.dns.enable {
120bcf4d IB	87	myServices.chatonsProperties.hostings.dns-secondaire = {
	88	file.datetime = "2022-08-22T02:00:00";
	89	hosting = {
	90	name = "DNS secondaire";
	91	description = "DNS secondaire";
	92	website = "ns1.immae.eu";
	93	status.level = "OK";
	94	status.description = "OK";
	95	registration.load = "OPEN";
	96	install.type = "PACKAGE";
	97	};
	98	software = {
	99	name = "bind9";
	100	website = pkgs.bind.meta.homepage;
	101	license.url = pkgs.bind.meta.license.url;
	102	license.name = pkgs.bind.meta.license.fullName;
	103	version = pkgs.bind.version;
	104	source.url = "https://www.isc.org/download/";
	105	};
	106	};
bb5e0900 IB	107	networking.firewall.allowedUDPPorts = [ 53 ];
bb5e0900 IB	108	networking.firewall.allowedTCPPorts = [ 53 ];
8175055f	109	users.users.named.extraGroups = [ "keys" ];
4c4652aa IB	110	secrets.keys = lib.mapAttrs' (k: v:
4c4652aa IB	111	lib.nameValuePair "bind/${k}.key" {
8175055f IB	112	permissions = "0400";
	113	user = "named";
	114	text = ''
	115	key "${k}"
	116	{
	117	algorithm ${v.algorithm};
	118	secret "${v.secret}";
	119	};
	120	'';
	121	}
	122	) config.myEnv.dns.keys;
bb5e0900 IB	123	services.bind = {
	124	enable = true;
	125	cacheNetworks = ["any"];
	126	configFile = configFile;
	127	extraOptions = ''
	128	allow-recursion { 127.0.0.1; };
	129	allow-transfer { none; };
	130
05becbbb	131	notify-source ${lib.head config.myEnv.servers.eldiron.ips.main.ip4};
ab8f306d	132	notify-source-v6 ${lib.head config.myEnv.servers.eldiron.ips.main.ip6};
bb5e0900 IB	133	version none;
	134	hostname none;
	135	server-id none;
	136	'';
ab8f306d	137	zones = with config.myEnv.dns;
0f466f6d IB	138	assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != ".";
0f466f6d IB	139	assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != ".";
bb5e0900 IB	140	(map (conf: {
	141	name = conf.name;
	142	master = false;
	143	file = "/var/run/named/${conf.name}.zone";
	144	masters = if lib.attrsets.hasAttr "masters" conf
	145	then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.masters)
	146	else [];
e34b3079	147	slaves = [];
bb5e0900 IB	148	}) slaveZones)
	149	++ (map (conf: {
	150	name = conf.name;
	151	master = true;
e34b3079 IB	152	extraConfig = if lib.attrsets.hasAttr "extra" conf then conf.extra else "";
e34b3079 IB	153	masters = [];
bb5e0900 IB	154	slaves = if lib.attrsets.hasAttr "slaves" conf
	155	then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.slaves)
	156	else [];
	157	file = pkgs.writeText "${conf.name}.zone" ''
	158	$TTL 10800
0f466f6d	159	@ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl}
bb5e0900 IB	160
bb5e0900 IB	161	${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))}
68ff82c6 IB	162	${lib.optionalString (conf.withCAA != null) ''
	163	${conf.name}. IN CAA 0 issue "${conf.withCAA}"
	164	''}
bb5e0900 IB	165
	166	${conf.entries}
	167
	168	${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then ''
619e4f46 IB	169	${ip4mxes}
619e4f46 IB	170	${ip6mxes}
bb5e0900 IB	171	${lib.concatStringsSep "\n\n" (map (e:
	172	let
	173	n = if e.domain == "" then "@" else "${e.domain} ";
	174	suffix = if e.domain == "" then "" else ".${e.domain}";
	175	in
	176	''
	177	; ------------------ mail: ${n} ---------------------------
619e4f46	178	${mxmxes n conf}
bb5e0900	179
05f8c21a	180	; https://tools.ietf.org/html/rfc6186
9699d2b1 IB	181	_submission._tcp${suffix} SRV 0 1 587 smtp.immae.eu.
	182	_submissions._tcp${suffix} SRV 0 1 465 smtp.immae.eu.
	183	_imap._tcp${suffix} SRV 0 1 143 imap.immae.eu.
	184	_imaps._tcp${suffix} SRV 0 1 993 imap.immae.eu.
	185	_pop3._tcp${suffix} SRV 10 1 110 pop3.immae.eu.
	186	_pop3s._tcp${suffix} SRV 10 1 995 pop3.immae.eu.
	187	_sieve._tcp${suffix} SRV 0 1 4190 imap.immae.eu.
05f8c21a	188
afcc5de0 IB	189	; MTA-STS
	190	; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/
	191	; https://support.google.com/a/answer/9261504
619e4f46	192	_mta-sts${suffix} IN TXT "v=STSv1;id=20200109150200Z"
afcc5de0	193	_smtp._tls${suffix} IN TXT "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu"
05becbbb	194	${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix} IN A ${i}") config.myEnv.servers.eldiron.ips.main.ip4)}
ab8f306d	195	${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix} IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)}
afcc5de0	196
bb5e0900 IB	197	; Mail sender authentications
bb5e0900 IB	198	${n} IN TXT "v=spf1 mx ~all"
3b45d5f2	199	_dmarc${suffix} IN TXT "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster+rua@immae.eu; ruf=mailto:postmaster+ruf@immae.eu;"
bb5e0900 IB	200	${if e.send then ''
	201	immae_eu._domainkey${suffix} IN TXT ( "v=DKIM1; k=rsa; s=email; "
	202	"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF"
	203	"0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" )
ab8f306d	204	eldiron._domainkey${suffix} IN TXT ${config.myEnv.mail.dkim.eldiron.public}
bb5e0900 IB	205	'' else ""}
bb5e0900 IB	206	'') conf.withEmail)}
384ec543 IB	207	'' + (if conf.name == "immae.eu" then ''
	208	; ----------------- Accept DMARC reports -------------------
	209	${lib.concatStringsSep "\n" (
	210	lib.flatten (
	211	map (z: map (e: "${e.domain}${if builtins.stringLength e.domain > 0 then "." else ""}${z.name}._report._dmarc IN TXT \"v=DMARC1;\"") (z.withEmail or [])) masterZones
	212	)
	213	)}
	214	'' else "") else ""}
bb5e0900 IB	215	'';
	216	}) masterZones);
	217	};
	218	};
	219	}