X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fdns.nix;h=cb900ffad6ca725b9853666d6055c095117b716f;hb=68ff82c61628212208bc339b9f91fd1dba6ade50;hp=fb908242f143d759913ecac44121bae56ca2feb3;hpb=ab8f306d7c2c49b8116e1af7b355ed2384617ed9;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/dns.nix b/modules/private/dns.nix
index fb90824..cb900ff 100644
--- a/modules/private/dns.nix
+++ b/modules/private/dns.nix
@@ -50,6 +50,18 @@
             '')
           cfg.zones }
     '';
+    mxes = lib.attrsets.filterAttrs
+      (n: v: v.mx.enable)
+      config.myEnv.servers;
+    ip4mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList
+      (n: v: "${v.mx.subdomain} IN A     ${v.ips.main.ip4}")
+      mxes);
+    ip6mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList
+      (n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN AAAA  ${i}") v.ips.main.ip6))
+      mxes);
+    mxmxes = n: conf: builtins.concatStringsSep "\n" (lib.mapAttrsToList
+      (_: v: "${n} IN MX ${v.mx.priority} ${v.mx.subdomain}.${conf.name}.")
+      mxes);
   in lib.mkIf config.myServices.dns.enable {
     networking.firewall.allowedUDPPorts = [ 53 ];
     networking.firewall.allowedTCPPorts = [ 53 ];
@@ -90,14 +102,15 @@
               @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl}
 
               ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))}
+              ${lib.optionalString (conf.withCAA != null) ''
+                ${conf.name}. IN CAA 0 issue "${conf.withCAA}"
+              ''}
 
               ${conf.entries}
 
               ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then ''
-              mx-1 IN A     ${config.myEnv.servers.eldiron.ips.main.ip4}
-              mx-2 IN A     ${config.myEnv.servers.immaeEu.ips.main.ip4}
-              ${builtins.concatStringsSep "\n" (map (i: "mx-1 IN AAAA  ${i}") config.myEnv.servers.eldiron.ips.main.ip6)}
-              ${builtins.concatStringsSep "\n" (map (i: "mx-2 IN AAAA  ${i}") config.myEnv.servers.immaeEu.ips.main.ip6)}
+              ${ip4mxes}
+              ${ip6mxes}
               ${lib.concatStringsSep "\n\n" (map (e:
               let
                 n = if e.domain == "" then "@" else "${e.domain}  ";
@@ -105,8 +118,7 @@
               in
               ''
               ; ------------------ mail: ${n} ---------------------------
-              ${n} IN MX 10 mx-1.${conf.name}.
-              ${n} IN MX 20 mx-2.${conf.name}.
+              ${mxmxes n conf}
 
               ; https://tools.ietf.org/html/rfc6186
               _submission._tcp${suffix}  SRV  0 1  587 smtp.immae.eu.
@@ -120,7 +132,7 @@
               ; MTA-STS
               ; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/
               ; https://support.google.com/a/answer/9261504
-              _mta-sts${suffix}   IN TXT  "v=STSv1;id=20190630054629Z"
+              _mta-sts${suffix}   IN TXT  "v=STSv1;id=20200109150200Z"
               _smtp._tls${suffix} IN TXT  "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu"
               mta-sts${suffix}    IN A    ${config.myEnv.servers.eldiron.ips.main.ip4}
               ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix}    IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)}