Change dmarc and disable mx-1 until ready

[perso/Immae/Config/Nix.git] / nixops / modules / dns / default.nix

diff --git a/nixops/modules/dns/default.nix b/nixops/modules/dns/default.nix
index b5187a886975cd8c00c53ac04627fe1daee7c665..0096f554833f3401e802f5acb01b2f2a2d9a7c72 100644 (file)
--- a/nixops/modules/dns/default.nix
+++ b/nixops/modules/dns/default.nix
@@ -68,8 +68,8 @@
         server-id none;
         '';
       zones = with myconfig.env.dns;
-        assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) == ".";
-        assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) == ".";
+        assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != ".";
+        assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != ".";
         (map (conf: {
           name = conf.name;
           master = false;
@@ -87,7 +87,7 @@
             else [];
           file = pkgs.writeText "${conf.name}.zone" ''
               $TTL 10800
-              @ IN SOA ${soa.primary} ${soa.email} ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl}
+              @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl}
 
               ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))}
 
@@ -95,7 +95,9 @@
 
               ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then ''
               mail IN A     ${myconfig.env.servers.immaeEu.ips.main.ip4}
+              mx-1 IN A     ${myconfig.env.servers.eldiron.ips.main.ip4}
               ${builtins.concatStringsSep "\n" (map (i: "mail IN AAAA  ${i}") myconfig.env.servers.immaeEu.ips.main.ip6)}
+              ${builtins.concatStringsSep "\n" (map (i: "mx-1 IN AAAA  ${i}") myconfig.env.servers.eldiron.ips.main.ip6)}
               ${lib.concatStringsSep "\n\n" (map (e:
               let
                 n = if e.domain == "" then "@" else "${e.domain}  ";
@@ -104,17 +106,25 @@
               ''
               ; ------------------ mail: ${n} ---------------------------
               ${if e.receive then "${n} IN MX 10 mail.${conf.name}." else ""}
+              ;${if e.receive then "${n} IN MX 50 mx-1.${conf.name}." else ""}
 
               ; Mail sender authentications
               ${n}                   IN TXT  "v=spf1 mx ~all"
-              _dmarc${suffix}              IN TXT  "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster@immae.eu; ruf=mailto:postmaster@immae.eu;"
+              _dmarc${suffix}              IN TXT  "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster+rua@immae.eu; ruf=mailto:postmaster+ruf@immae.eu;"
               ${if e.send then ''
               immae_eu._domainkey${suffix} IN TXT  ( "v=DKIM1; k=rsa; s=email; "
                         "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF"
                         "0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" )
               '' else ""}
               '') conf.withEmail)}
-              '' else ""}
+              '' + (if conf.name == "immae.eu" then ''
+              ; ----------------- Accept DMARC reports -------------------
+              ${lib.concatStringsSep "\n" (
+                lib.flatten (
+                  map (z: map (e: "${e.domain}${if builtins.stringLength e.domain > 0 then "." else ""}${z.name}._report._dmarc IN TXT \"v=DMARC1;\"") (z.withEmail or [])) masterZones
+                )
+              )}
+              '' else "") else ""}
             '';
           }) masterZones);
     };