]>
Commit | Line | Data |
---|---|---|
ab8f306d | 1 | { lib, pkgs, config, ... }: |
bb5e0900 | 2 | { |
8415083e | 3 | options.myServices.dns.enable = lib.mkEnableOption "enable DNS resolver"; |
bb5e0900 | 4 | config = let |
11c2119f IB |
5 | # taken from unstable |
6 | cartesianProductOfSets = attrsOfLists: with lib; | |
7 | lib.foldl' (listOfAttrs: attrName: | |
8 | concatMap (attrs: | |
9 | map (listValue: attrs // { ${attrName} = listValue; }) attrsOfLists.${attrName} | |
10 | ) listOfAttrs | |
11 | ) [{}] (attrNames attrsOfLists); | |
bb5e0900 | 12 | cfg = config.services.bind; |
da30ae4f | 13 | keyIncludes = builtins.concatStringsSep "\n" (map (v: "include \"${config.secrets.fullPaths."bind/${v}.key"}\";") (builtins.attrNames config.myEnv.dns.keys)); |
11c2119f IB |
14 | cartProduct = lib.foldr |
15 | (s: servers: servers // { ${s.masters} = lib.unique ((servers.${s.masters} or []) ++ [s.keys]); }) | |
16 | {} | |
17 | (lib.unique (lib.concatMap (z: cartesianProductOfSets { masters = z.masters or []; keys = z.keys or []; }) config.myEnv.dns.slaveZones)); | |
8175055f IB |
18 | toKeyList = servers: keys: builtins.concatStringsSep "\n" (map (s: '' |
19 | server ${s} { | |
20 | keys { ${builtins.concatStringsSep ";" keys}; }; | |
21 | }; | |
22 | '') servers); | |
11c2119f | 23 | serverIncludes = builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: toKeyList (lib.flatten (builtins.attrValues config.myEnv.dns.ns."${n}"))) cartProduct); |
bb5e0900 IB |
24 | configFile = pkgs.writeText "named.conf" '' |
25 | include "/etc/bind/rndc.key"; | |
26 | controls { | |
27 | inet 127.0.0.1 allow {localhost;} keys {"rndc-key";}; | |
28 | }; | |
29 | ||
30 | acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} }; | |
31 | acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} }; | |
32 | ||
33 | options { | |
34 | listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} }; | |
35 | listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} }; | |
36 | allow-query { cachenetworks; }; | |
37 | blackhole { badnetworks; }; | |
38 | forward first; | |
39 | forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} }; | |
40 | directory "/var/run/named"; | |
41 | pid-file "/var/run/named/named.pid"; | |
42 | ${cfg.extraOptions} | |
43 | }; | |
44 | ||
8175055f IB |
45 | ${keyIncludes} |
46 | ${serverIncludes} | |
47 | ||
bb5e0900 IB |
48 | ${cfg.extraConfig} |
49 | ||
50 | ${ lib.concatMapStrings | |
e34b3079 | 51 | ({ name, file, master ? true, extraConfig ? "", slaves ? [], masters ? [] }: |
bb5e0900 IB |
52 | '' |
53 | zone "${name}" { | |
54 | type ${if master then "master" else "slave"}; | |
55 | file "${file}"; | |
56 | ${ if lib.lists.length slaves > 0 then | |
57 | '' | |
58 | allow-transfer { | |
59 | ${lib.concatMapStrings (ip: "${ip};\n") slaves} | |
60 | }; | |
61 | '' else ""} | |
62 | ${ if lib.lists.length masters > 0 then | |
63 | '' | |
64 | masters { | |
65 | ${lib.concatMapStrings (ip: "${ip};\n") masters} | |
66 | }; | |
67 | '' else ""} | |
68 | allow-query { any; }; | |
e34b3079 | 69 | ${extraConfig} |
bb5e0900 IB |
70 | }; |
71 | '') | |
e34b3079 | 72 | (builtins.attrValues cfg.zones) } |
bb5e0900 | 73 | ''; |
619e4f46 IB |
74 | mxes = lib.attrsets.filterAttrs |
75 | (n: v: v.mx.enable) | |
76 | config.myEnv.servers; | |
77 | ip4mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList | |
05becbbb | 78 | (n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN A ${i}") v.ips.main.ip4)) |
619e4f46 IB |
79 | mxes); |
80 | ip6mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList | |
81 | (n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN AAAA ${i}") v.ips.main.ip6)) | |
82 | mxes); | |
83 | mxmxes = n: conf: builtins.concatStringsSep "\n" (lib.mapAttrsToList | |
84 | (_: v: "${n} IN MX ${v.mx.priority} ${v.mx.subdomain}.${conf.name}.") | |
85 | mxes); | |
8415083e | 86 | in lib.mkIf config.myServices.dns.enable { |
120bcf4d IB |
87 | myServices.chatonsProperties.hostings.dns-secondaire = { |
88 | file.datetime = "2022-08-22T02:00:00"; | |
89 | hosting = { | |
90 | name = "DNS secondaire"; | |
91 | description = "DNS secondaire"; | |
92 | website = "ns1.immae.eu"; | |
93 | status.level = "OK"; | |
94 | status.description = "OK"; | |
95 | registration.load = "OPEN"; | |
96 | install.type = "PACKAGE"; | |
97 | }; | |
98 | software = { | |
99 | name = "bind9"; | |
100 | website = pkgs.bind.meta.homepage; | |
101 | license.url = pkgs.bind.meta.license.url; | |
102 | license.name = pkgs.bind.meta.license.fullName; | |
103 | version = pkgs.bind.version; | |
104 | source.url = "https://www.isc.org/download/"; | |
105 | }; | |
106 | }; | |
bb5e0900 IB |
107 | networking.firewall.allowedUDPPorts = [ 53 ]; |
108 | networking.firewall.allowedTCPPorts = [ 53 ]; | |
8175055f | 109 | users.users.named.extraGroups = [ "keys" ]; |
4c4652aa IB |
110 | secrets.keys = lib.mapAttrs' (k: v: |
111 | lib.nameValuePair "bind/${k}.key" { | |
8175055f IB |
112 | permissions = "0400"; |
113 | user = "named"; | |
114 | text = '' | |
115 | key "${k}" | |
116 | { | |
117 | algorithm ${v.algorithm}; | |
118 | secret "${v.secret}"; | |
119 | }; | |
120 | ''; | |
121 | } | |
122 | ) config.myEnv.dns.keys; | |
bb5e0900 IB |
123 | services.bind = { |
124 | enable = true; | |
125 | cacheNetworks = ["any"]; | |
126 | configFile = configFile; | |
127 | extraOptions = '' | |
128 | allow-recursion { 127.0.0.1; }; | |
129 | allow-transfer { none; }; | |
130 | ||
05becbbb | 131 | notify-source ${lib.head config.myEnv.servers.eldiron.ips.main.ip4}; |
ab8f306d | 132 | notify-source-v6 ${lib.head config.myEnv.servers.eldiron.ips.main.ip6}; |
bb5e0900 IB |
133 | version none; |
134 | hostname none; | |
135 | server-id none; | |
136 | ''; | |
ab8f306d | 137 | zones = with config.myEnv.dns; |
0f466f6d IB |
138 | assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != "."; |
139 | assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != "."; | |
bb5e0900 IB |
140 | (map (conf: { |
141 | name = conf.name; | |
142 | master = false; | |
143 | file = "/var/run/named/${conf.name}.zone"; | |
144 | masters = if lib.attrsets.hasAttr "masters" conf | |
145 | then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.masters) | |
146 | else []; | |
e34b3079 | 147 | slaves = []; |
bb5e0900 IB |
148 | }) slaveZones) |
149 | ++ (map (conf: { | |
150 | name = conf.name; | |
151 | master = true; | |
e34b3079 IB |
152 | extraConfig = if lib.attrsets.hasAttr "extra" conf then conf.extra else ""; |
153 | masters = []; | |
bb5e0900 IB |
154 | slaves = if lib.attrsets.hasAttr "slaves" conf |
155 | then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.slaves) | |
156 | else []; | |
157 | file = pkgs.writeText "${conf.name}.zone" '' | |
158 | $TTL 10800 | |
0f466f6d | 159 | @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl} |
bb5e0900 IB |
160 | |
161 | ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))} | |
68ff82c6 IB |
162 | ${lib.optionalString (conf.withCAA != null) '' |
163 | ${conf.name}. IN CAA 0 issue "${conf.withCAA}" | |
164 | ''} | |
bb5e0900 IB |
165 | |
166 | ${conf.entries} | |
167 | ||
168 | ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then '' | |
619e4f46 IB |
169 | ${ip4mxes} |
170 | ${ip6mxes} | |
bb5e0900 IB |
171 | ${lib.concatStringsSep "\n\n" (map (e: |
172 | let | |
173 | n = if e.domain == "" then "@" else "${e.domain} "; | |
174 | suffix = if e.domain == "" then "" else ".${e.domain}"; | |
175 | in | |
176 | '' | |
177 | ; ------------------ mail: ${n} --------------------------- | |
619e4f46 | 178 | ${mxmxes n conf} |
bb5e0900 | 179 | |
05f8c21a | 180 | ; https://tools.ietf.org/html/rfc6186 |
9699d2b1 IB |
181 | _submission._tcp${suffix} SRV 0 1 587 smtp.immae.eu. |
182 | _submissions._tcp${suffix} SRV 0 1 465 smtp.immae.eu. | |
183 | _imap._tcp${suffix} SRV 0 1 143 imap.immae.eu. | |
184 | _imaps._tcp${suffix} SRV 0 1 993 imap.immae.eu. | |
185 | _pop3._tcp${suffix} SRV 10 1 110 pop3.immae.eu. | |
186 | _pop3s._tcp${suffix} SRV 10 1 995 pop3.immae.eu. | |
187 | _sieve._tcp${suffix} SRV 0 1 4190 imap.immae.eu. | |
05f8c21a | 188 | |
afcc5de0 IB |
189 | ; MTA-STS |
190 | ; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/ | |
191 | ; https://support.google.com/a/answer/9261504 | |
619e4f46 | 192 | _mta-sts${suffix} IN TXT "v=STSv1;id=20200109150200Z" |
afcc5de0 | 193 | _smtp._tls${suffix} IN TXT "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu" |
05becbbb | 194 | ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix} IN A ${i}") config.myEnv.servers.eldiron.ips.main.ip4)} |
ab8f306d | 195 | ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix} IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)} |
afcc5de0 | 196 | |
bb5e0900 IB |
197 | ; Mail sender authentications |
198 | ${n} IN TXT "v=spf1 mx ~all" | |
3b45d5f2 | 199 | _dmarc${suffix} IN TXT "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster+rua@immae.eu; ruf=mailto:postmaster+ruf@immae.eu;" |
bb5e0900 IB |
200 | ${if e.send then '' |
201 | immae_eu._domainkey${suffix} IN TXT ( "v=DKIM1; k=rsa; s=email; " | |
202 | "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF" | |
203 | "0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" ) | |
ab8f306d | 204 | eldiron._domainkey${suffix} IN TXT ${config.myEnv.mail.dkim.eldiron.public} |
bb5e0900 IB |
205 | '' else ""} |
206 | '') conf.withEmail)} | |
384ec543 IB |
207 | '' + (if conf.name == "immae.eu" then '' |
208 | ; ----------------- Accept DMARC reports ------------------- | |
209 | ${lib.concatStringsSep "\n" ( | |
210 | lib.flatten ( | |
211 | map (z: map (e: "${e.domain}${if builtins.stringLength e.domain > 0 then "." else ""}${z.name}._report._dmarc IN TXT \"v=DMARC1;\"") (z.withEmail or [])) masterZones | |
212 | ) | |
213 | )} | |
214 | '' else "") else ""} | |
bb5e0900 IB |
215 | ''; |
216 | }) masterZones); | |
217 | }; | |
218 | }; | |
219 | } |