X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fdns.nix;h=1d7fd52fb3fe6e11d27ea801da4f0518ee719069;hb=fa25ffd4583cc362075cd5e1b4130f33306103f0;hp=fb908242f143d759913ecac44121bae56ca2feb3;hpb=ab8f306d7c2c49b8116e1af7b355ed2384617ed9;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/modules/private/dns.nix b/modules/private/dns.nix index fb90824..1d7fd52 100644 --- a/modules/private/dns.nix +++ b/modules/private/dns.nix @@ -2,7 +2,25 @@ { options.myServices.dns.enable = lib.mkEnableOption "enable DNS resolver"; config = let + # taken from unstable + cartesianProductOfSets = attrsOfLists: with lib; + lib.foldl' (listOfAttrs: attrName: + concatMap (attrs: + map (listValue: attrs // { ${attrName} = listValue; }) attrsOfLists.${attrName} + ) listOfAttrs + ) [{}] (attrNames attrsOfLists); cfg = config.services.bind; + keyIncludes = builtins.concatStringsSep "\n" (map (v: "include \"${config.secrets.fullPaths."bind/${v}.key"}\";") (builtins.attrNames config.myEnv.dns.keys)); + cartProduct = lib.foldr + (s: servers: servers // { ${s.masters} = lib.unique ((servers.${s.masters} or []) ++ [s.keys]); }) + {} + (lib.unique (lib.concatMap (z: cartesianProductOfSets { masters = z.masters or []; keys = z.keys or []; }) config.myEnv.dns.slaveZones)); + toKeyList = servers: keys: builtins.concatStringsSep "\n" (map (s: '' + server ${s} { + keys { ${builtins.concatStringsSep ";" keys}; }; + }; + '') servers); + serverIncludes = builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: toKeyList (lib.flatten (builtins.attrValues config.myEnv.dns.ns."${n}"))) cartProduct); configFile = pkgs.writeText "named.conf" '' include "/etc/bind/rndc.key"; controls { @@ -24,6 +42,9 @@ ${cfg.extraOptions} }; + ${keyIncludes} + ${serverIncludes} + ${cfg.extraConfig} ${ lib.concatMapStrings @@ -50,9 +71,35 @@ '') cfg.zones } ''; + mxes = lib.attrsets.filterAttrs + (n: v: v.mx.enable) + config.myEnv.servers; + ip4mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList + (n: v: "${v.mx.subdomain} IN A ${v.ips.main.ip4}") + mxes); + ip6mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList + (n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN AAAA ${i}") v.ips.main.ip6)) + mxes); + mxmxes = n: conf: builtins.concatStringsSep "\n" (lib.mapAttrsToList + (_: v: "${n} IN MX ${v.mx.priority} ${v.mx.subdomain}.${conf.name}.") + mxes); in lib.mkIf config.myServices.dns.enable { networking.firewall.allowedUDPPorts = [ 53 ]; networking.firewall.allowedTCPPorts = [ 53 ]; + users.users.named.extraGroups = [ "keys" ]; + secrets.keys = lib.mapAttrs' (k: v: + lib.nameValuePair "bind/${k}.key" { + permissions = "0400"; + user = "named"; + text = '' + key "${k}" + { + algorithm ${v.algorithm}; + secret "${v.secret}"; + }; + ''; + } + ) config.myEnv.dns.keys; services.bind = { enable = true; cacheNetworks = ["any"]; @@ -90,14 +137,15 @@ @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl} ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))} + ${lib.optionalString (conf.withCAA != null) '' + ${conf.name}. IN CAA 0 issue "${conf.withCAA}" + ''} ${conf.entries} ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then '' - mx-1 IN A ${config.myEnv.servers.eldiron.ips.main.ip4} - mx-2 IN A ${config.myEnv.servers.immaeEu.ips.main.ip4} - ${builtins.concatStringsSep "\n" (map (i: "mx-1 IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)} - ${builtins.concatStringsSep "\n" (map (i: "mx-2 IN AAAA ${i}") config.myEnv.servers.immaeEu.ips.main.ip6)} + ${ip4mxes} + ${ip6mxes} ${lib.concatStringsSep "\n\n" (map (e: let n = if e.domain == "" then "@" else "${e.domain} "; @@ -105,8 +153,7 @@ in '' ; ------------------ mail: ${n} --------------------------- - ${n} IN MX 10 mx-1.${conf.name}. - ${n} IN MX 20 mx-2.${conf.name}. + ${mxmxes n conf} ; https://tools.ietf.org/html/rfc6186 _submission._tcp${suffix} SRV 0 1 587 smtp.immae.eu. @@ -120,7 +167,7 @@ ; MTA-STS ; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/ ; https://support.google.com/a/answer/9261504 - _mta-sts${suffix} IN TXT "v=STSv1;id=20190630054629Z" + _mta-sts${suffix} IN TXT "v=STSv1;id=20200109150200Z" _smtp._tls${suffix} IN TXT "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu" mta-sts${suffix} IN A ${config.myEnv.servers.eldiron.ips.main.ip4} ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix} IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)}