]> git.immae.eu Git - perso/Immae/Config/Nix.git/blob - modules/private/dns.nix
Add git config for submodules
[perso/Immae/Config/Nix.git] / modules / private / dns.nix
1 { lib, pkgs, config, ... }:
2 {
3 options.myServices.dns.enable = lib.mkEnableOption "enable DNS resolver";
4 config = let
5 cfg = config.services.bind;
6 configFile = pkgs.writeText "named.conf" ''
7 include "/etc/bind/rndc.key";
8 controls {
9 inet 127.0.0.1 allow {localhost;} keys {"rndc-key";};
10 };
11
12 acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} };
13 acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} };
14
15 options {
16 listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} };
17 listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} };
18 allow-query { cachenetworks; };
19 blackhole { badnetworks; };
20 forward first;
21 forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} };
22 directory "/var/run/named";
23 pid-file "/var/run/named/named.pid";
24 ${cfg.extraOptions}
25 };
26
27 ${cfg.extraConfig}
28
29 ${ lib.concatMapStrings
30 ({ name, file, master ? true, extra ? "", slaves ? [], masters ? [] }:
31 ''
32 zone "${name}" {
33 type ${if master then "master" else "slave"};
34 file "${file}";
35 ${ if lib.lists.length slaves > 0 then
36 ''
37 allow-transfer {
38 ${lib.concatMapStrings (ip: "${ip};\n") slaves}
39 };
40 '' else ""}
41 ${ if lib.lists.length masters > 0 then
42 ''
43 masters {
44 ${lib.concatMapStrings (ip: "${ip};\n") masters}
45 };
46 '' else ""}
47 allow-query { any; };
48 ${extra}
49 };
50 '')
51 cfg.zones }
52 '';
53 mxes = lib.attrsets.filterAttrs
54 (n: v: v.mx.enable)
55 config.myEnv.servers;
56 ip4mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList
57 (n: v: "${v.mx.subdomain} IN A ${v.ips.main.ip4}")
58 mxes);
59 ip6mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList
60 (n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN AAAA ${i}") v.ips.main.ip6))
61 mxes);
62 mxmxes = n: conf: builtins.concatStringsSep "\n" (lib.mapAttrsToList
63 (_: v: "${n} IN MX ${v.mx.priority} ${v.mx.subdomain}.${conf.name}.")
64 mxes);
65 in lib.mkIf config.myServices.dns.enable {
66 networking.firewall.allowedUDPPorts = [ 53 ];
67 networking.firewall.allowedTCPPorts = [ 53 ];
68 services.bind = {
69 enable = true;
70 cacheNetworks = ["any"];
71 configFile = configFile;
72 extraOptions = ''
73 allow-recursion { 127.0.0.1; };
74 allow-transfer { none; };
75
76 notify-source ${config.myEnv.servers.eldiron.ips.main.ip4};
77 notify-source-v6 ${lib.head config.myEnv.servers.eldiron.ips.main.ip6};
78 version none;
79 hostname none;
80 server-id none;
81 '';
82 zones = with config.myEnv.dns;
83 assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != ".";
84 assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != ".";
85 (map (conf: {
86 name = conf.name;
87 master = false;
88 file = "/var/run/named/${conf.name}.zone";
89 masters = if lib.attrsets.hasAttr "masters" conf
90 then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.masters)
91 else [];
92 }) slaveZones)
93 ++ (map (conf: {
94 name = conf.name;
95 master = true;
96 extra = if lib.attrsets.hasAttr "extra" conf then conf.extra else "";
97 slaves = if lib.attrsets.hasAttr "slaves" conf
98 then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.slaves)
99 else [];
100 file = pkgs.writeText "${conf.name}.zone" ''
101 $TTL 10800
102 @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl}
103
104 ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))}
105
106 ${conf.entries}
107
108 ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then ''
109 ${ip4mxes}
110 ${ip6mxes}
111 ${lib.concatStringsSep "\n\n" (map (e:
112 let
113 n = if e.domain == "" then "@" else "${e.domain} ";
114 suffix = if e.domain == "" then "" else ".${e.domain}";
115 in
116 ''
117 ; ------------------ mail: ${n} ---------------------------
118 ${mxmxes n conf}
119
120 ; https://tools.ietf.org/html/rfc6186
121 _submission._tcp${suffix} SRV 0 1 587 smtp.immae.eu.
122 _submissions._tcp${suffix} SRV 0 1 465 smtp.immae.eu.
123 _imap._tcp${suffix} SRV 0 1 143 imap.immae.eu.
124 _imaps._tcp${suffix} SRV 0 1 993 imap.immae.eu.
125 _pop3._tcp${suffix} SRV 10 1 110 pop3.immae.eu.
126 _pop3s._tcp${suffix} SRV 10 1 995 pop3.immae.eu.
127 _sieve._tcp${suffix} SRV 0 1 4190 imap.immae.eu.
128
129 ; MTA-STS
130 ; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/
131 ; https://support.google.com/a/answer/9261504
132 _mta-sts${suffix} IN TXT "v=STSv1;id=20200109150200Z"
133 _smtp._tls${suffix} IN TXT "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu"
134 mta-sts${suffix} IN A ${config.myEnv.servers.eldiron.ips.main.ip4}
135 ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix} IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)}
136
137 ; Mail sender authentications
138 ${n} IN TXT "v=spf1 mx ~all"
139 _dmarc${suffix} IN TXT "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster+rua@immae.eu; ruf=mailto:postmaster+ruf@immae.eu;"
140 ${if e.send then ''
141 immae_eu._domainkey${suffix} IN TXT ( "v=DKIM1; k=rsa; s=email; "
142 "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF"
143 "0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" )
144 eldiron._domainkey${suffix} IN TXT ${config.myEnv.mail.dkim.eldiron.public}
145 '' else ""}
146 '') conf.withEmail)}
147 '' + (if conf.name == "immae.eu" then ''
148 ; ----------------- Accept DMARC reports -------------------
149 ${lib.concatStringsSep "\n" (
150 lib.flatten (
151 map (z: map (e: "${e.domain}${if builtins.stringLength e.domain > 0 then "." else ""}${z.name}._report._dmarc IN TXT \"v=DMARC1;\"") (z.withEmail or [])) masterZones
152 )
153 )}
154 '' else "") else ""}
155 '';
156 }) masterZones);
157 };
158 };
159 }