]>
Commit | Line | Data |
---|---|---|
1 | { lib, pkgs, config, myconfig, ... }: | |
2 | { | |
3 | options.myServices.dns.enable = lib.mkEnableOption "enable DNS resolver"; | |
4 | config = let | |
5 | cfg = config.services.bind; | |
6 | configFile = pkgs.writeText "named.conf" '' | |
7 | include "/etc/bind/rndc.key"; | |
8 | controls { | |
9 | inet 127.0.0.1 allow {localhost;} keys {"rndc-key";}; | |
10 | }; | |
11 | ||
12 | acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} }; | |
13 | acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} }; | |
14 | ||
15 | options { | |
16 | listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} }; | |
17 | listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} }; | |
18 | allow-query { cachenetworks; }; | |
19 | blackhole { badnetworks; }; | |
20 | forward first; | |
21 | forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} }; | |
22 | directory "/var/run/named"; | |
23 | pid-file "/var/run/named/named.pid"; | |
24 | ${cfg.extraOptions} | |
25 | }; | |
26 | ||
27 | ${cfg.extraConfig} | |
28 | ||
29 | ${ lib.concatMapStrings | |
30 | ({ name, file, master ? true, extra ? "", slaves ? [], masters ? [] }: | |
31 | '' | |
32 | zone "${name}" { | |
33 | type ${if master then "master" else "slave"}; | |
34 | file "${file}"; | |
35 | ${ if lib.lists.length slaves > 0 then | |
36 | '' | |
37 | allow-transfer { | |
38 | ${lib.concatMapStrings (ip: "${ip};\n") slaves} | |
39 | }; | |
40 | '' else ""} | |
41 | ${ if lib.lists.length masters > 0 then | |
42 | '' | |
43 | masters { | |
44 | ${lib.concatMapStrings (ip: "${ip};\n") masters} | |
45 | }; | |
46 | '' else ""} | |
47 | allow-query { any; }; | |
48 | ${extra} | |
49 | }; | |
50 | '') | |
51 | cfg.zones } | |
52 | ''; | |
53 | in lib.mkIf config.myServices.dns.enable { | |
54 | networking.firewall.allowedUDPPorts = [ 53 ]; | |
55 | networking.firewall.allowedTCPPorts = [ 53 ]; | |
56 | services.bind = { | |
57 | enable = true; | |
58 | cacheNetworks = ["any"]; | |
59 | configFile = configFile; | |
60 | extraOptions = '' | |
61 | allow-recursion { 127.0.0.1; }; | |
62 | allow-transfer { none; }; | |
63 | ||
64 | notify-source ${myconfig.env.servers.eldiron.ips.main.ip4}; | |
65 | notify-source-v6 ${lib.head myconfig.env.servers.eldiron.ips.main.ip6}; | |
66 | version none; | |
67 | hostname none; | |
68 | server-id none; | |
69 | ''; | |
70 | zones = with myconfig.env.dns; | |
71 | assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != "."; | |
72 | assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != "."; | |
73 | (map (conf: { | |
74 | name = conf.name; | |
75 | master = false; | |
76 | file = "/var/run/named/${conf.name}.zone"; | |
77 | masters = if lib.attrsets.hasAttr "masters" conf | |
78 | then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.masters) | |
79 | else []; | |
80 | }) slaveZones) | |
81 | ++ (map (conf: { | |
82 | name = conf.name; | |
83 | master = true; | |
84 | extra = if lib.attrsets.hasAttr "extra" conf then conf.extra else ""; | |
85 | slaves = if lib.attrsets.hasAttr "slaves" conf | |
86 | then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.slaves) | |
87 | else []; | |
88 | file = pkgs.writeText "${conf.name}.zone" '' | |
89 | $TTL 10800 | |
90 | @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl} | |
91 | ||
92 | ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))} | |
93 | ||
94 | ${conf.entries} | |
95 | ||
96 | ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then '' | |
97 | mx-1 IN A ${myconfig.env.servers.eldiron.ips.main.ip4} | |
98 | mx-2 IN A ${myconfig.env.servers.immaeEu.ips.main.ip4} | |
99 | ${builtins.concatStringsSep "\n" (map (i: "mx-1 IN AAAA ${i}") myconfig.env.servers.eldiron.ips.main.ip6)} | |
100 | ${builtins.concatStringsSep "\n" (map (i: "mx-2 IN AAAA ${i}") myconfig.env.servers.immaeEu.ips.main.ip6)} | |
101 | ${lib.concatStringsSep "\n\n" (map (e: | |
102 | let | |
103 | n = if e.domain == "" then "@" else "${e.domain} "; | |
104 | suffix = if e.domain == "" then "" else ".${e.domain}"; | |
105 | in | |
106 | '' | |
107 | ; ------------------ mail: ${n} --------------------------- | |
108 | ${n} IN MX 10 mx-1.${conf.name}. | |
109 | ${n} IN MX 20 mx-2.${conf.name}. | |
110 | ||
111 | ; https://tools.ietf.org/html/rfc6186 | |
112 | _submission._tcp${suffix} SRV 0 1 587 smtp.immae.eu. | |
113 | _submissions._tcp${suffix} SRV 0 1 465 smtp.immae.eu. | |
114 | _imap._tcp${suffix} SRV 0 1 143 imap.immae.eu. | |
115 | _imaps._tcp${suffix} SRV 0 1 993 imap.immae.eu. | |
116 | _pop3._tcp${suffix} SRV 10 1 110 pop3.immae.eu. | |
117 | _pop3s._tcp${suffix} SRV 10 1 995 pop3.immae.eu. | |
118 | _sieve._tcp${suffix} SRV 0 1 4190 imap.immae.eu. | |
119 | ||
120 | ; MTA-STS | |
121 | ; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/ | |
122 | ; https://support.google.com/a/answer/9261504 | |
123 | _mta-sts${suffix} IN TXT "v=STSv1;id=20190630054629Z" | |
124 | _smtp._tls${suffix} IN TXT "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu" | |
125 | mta-sts${suffix} IN A ${myconfig.env.servers.eldiron.ips.main.ip4} | |
126 | ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix} IN AAAA ${i}") myconfig.env.servers.eldiron.ips.main.ip6)} | |
127 | ||
128 | ; Mail sender authentications | |
129 | ${n} IN TXT "v=spf1 mx ~all" | |
130 | _dmarc${suffix} IN TXT "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster+rua@immae.eu; ruf=mailto:postmaster+ruf@immae.eu;" | |
131 | ${if e.send then '' | |
132 | immae_eu._domainkey${suffix} IN TXT ( "v=DKIM1; k=rsa; s=email; " | |
133 | "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF" | |
134 | "0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" ) | |
135 | eldiron._domainkey${suffix} IN TXT ${myconfig.env.mail.dkim.eldiron.public} | |
136 | '' else ""} | |
137 | '') conf.withEmail)} | |
138 | '' + (if conf.name == "immae.eu" then '' | |
139 | ; ----------------- Accept DMARC reports ------------------- | |
140 | ${lib.concatStringsSep "\n" ( | |
141 | lib.flatten ( | |
142 | map (z: map (e: "${e.domain}${if builtins.stringLength e.domain > 0 then "." else ""}${z.name}._report._dmarc IN TXT \"v=DMARC1;\"") (z.withEmail or [])) masterZones | |
143 | ) | |
144 | )} | |
145 | '' else "") else ""} | |
146 | ''; | |
147 | }) masterZones); | |
148 | }; | |
149 | }; | |
150 | } |