Add CAA to dns

[perso/Immae/Config/Nix.git] / modules / private / dns.nix

diff --git a/modules/private/dns.nix b/modules/private/dns.nix
index af536958e59767e6cf0d079d10f1833876ec3923..cb900ffad6ca725b9853666d6055c095117b716f 100644 (file)
--- a/modules/private/dns.nix
+++ b/modules/private/dns.nix
@@ -1,5 +1,6 @@
-{ lib, pkgs, config, myconfig,  ... }:
+{ lib, pkgs, config, ... }:
 {
+  options.myServices.dns.enable = lib.mkEnableOption "enable DNS resolver";
   config = let
     cfg = config.services.bind;
     configFile = pkgs.writeText "named.conf" ''
@@ -49,8 +50,19 @@
             '')
           cfg.zones }
     '';
-  in
-    {
+    mxes = lib.attrsets.filterAttrs
+      (n: v: v.mx.enable)
+      config.myEnv.servers;
+    ip4mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList
+      (n: v: "${v.mx.subdomain} IN A     ${v.ips.main.ip4}")
+      mxes);
+    ip6mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList
+      (n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN AAAA  ${i}") v.ips.main.ip6))
+      mxes);
+    mxmxes = n: conf: builtins.concatStringsSep "\n" (lib.mapAttrsToList
+      (_: v: "${n} IN MX ${v.mx.priority} ${v.mx.subdomain}.${conf.name}.")
+      mxes);
+  in lib.mkIf config.myServices.dns.enable {
     networking.firewall.allowedUDPPorts = [ 53 ];
     networking.firewall.allowedTCPPorts = [ 53 ];
     services.bind = {
@@ -61,13 +73,13 @@
         allow-recursion { 127.0.0.1; };
         allow-transfer  { none; };
 
-        notify-source    ${myconfig.env.servers.eldiron.ips.main.ip4};
-        notify-source-v6 ${lib.head myconfig.env.servers.eldiron.ips.main.ip6};
+        notify-source    ${config.myEnv.servers.eldiron.ips.main.ip4};
+        notify-source-v6 ${lib.head config.myEnv.servers.eldiron.ips.main.ip6};
         version   none;
         hostname  none;
         server-id none;
         '';
-      zones = with myconfig.env.dns;
+      zones = with config.myEnv.dns;
         assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != ".";
         assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != ".";
         (map (conf: {
@@ -90,14 +102,15 @@
               @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl}
 
               ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))}
+              ${lib.optionalString (conf.withCAA != null) ''
+                ${conf.name}. IN CAA 0 issue "${conf.withCAA}"
+              ''}
 
               ${conf.entries}
 
               ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then ''
-              mail IN A     ${myconfig.env.servers.immaeEu.ips.main.ip4}
-              mx-1 IN A     ${myconfig.env.servers.eldiron.ips.main.ip4}
-              ${builtins.concatStringsSep "\n" (map (i: "mail IN AAAA  ${i}") myconfig.env.servers.immaeEu.ips.main.ip6)}
-              ${builtins.concatStringsSep "\n" (map (i: "mx-1 IN AAAA  ${i}") myconfig.env.servers.eldiron.ips.main.ip6)}
+              ${ip4mxes}
+              ${ip6mxes}
               ${lib.concatStringsSep "\n\n" (map (e:
               let
                 n = if e.domain == "" then "@" else "${e.domain}  ";
@@ -105,8 +118,24 @@
               in
               ''
               ; ------------------ mail: ${n} ---------------------------
-              ${n} IN MX 10 mail.${conf.name}.
-              ;${n} IN MX 50 mx-1.${conf.name}.
+              ${mxmxes n conf}
+
+              ; https://tools.ietf.org/html/rfc6186
+              _submission._tcp${suffix}  SRV  0 1  587 smtp.immae.eu.
+              _submissions._tcp${suffix} SRV  0 1  465 smtp.immae.eu.
+              _imap._tcp${suffix}        SRV  0 1  143 imap.immae.eu.
+              _imaps._tcp${suffix}       SRV  0 1  993 imap.immae.eu.
+              _pop3._tcp${suffix}        SRV 10 1  110 pop3.immae.eu.
+              _pop3s._tcp${suffix}       SRV 10 1  995 pop3.immae.eu.
+              _sieve._tcp${suffix}       SRV  0 1 4190 imap.immae.eu.
+
+              ; MTA-STS
+              ; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/
+              ; https://support.google.com/a/answer/9261504
+              _mta-sts${suffix}   IN TXT  "v=STSv1;id=20200109150200Z"
+              _smtp._tls${suffix} IN TXT  "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu"
+              mta-sts${suffix}    IN A    ${config.myEnv.servers.eldiron.ips.main.ip4}
+              ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix}    IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)}
 
               ; Mail sender authentications
               ${n}                   IN TXT  "v=spf1 mx ~all"
@@ -115,6 +144,7 @@
               immae_eu._domainkey${suffix} IN TXT  ( "v=DKIM1; k=rsa; s=email; "
                         "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF"
                         "0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" )
+              eldiron._domainkey${suffix}  IN TXT  ${config.myEnv.mail.dkim.eldiron.public}
               '' else ""}
               '') conf.withEmail)}
               '' + (if conf.name == "immae.eu" then ''