X-Git-Url: https://git.immae.eu/?p=perso%2FImmae%2FConfig%2FNix.git;a=blobdiff_plain;f=modules%2Fprivate%2Fdns.nix;fp=modules%2Fprivate%2Fdns.nix;h=0000000000000000000000000000000000000000;hp=1d7fd52fb3fe6e11d27ea801da4f0518ee719069;hb=1a64deeb894dc95e2645a75771732c6cc53a79ad;hpb=fa25ffd4583cc362075cd5e1b4130f33306103f0 diff --git a/modules/private/dns.nix b/modules/private/dns.nix deleted file mode 100644 index 1d7fd52..0000000 --- a/modules/private/dns.nix +++ /dev/null @@ -1,197 +0,0 @@ -{ lib, pkgs, config, ... }: -{ - options.myServices.dns.enable = lib.mkEnableOption "enable DNS resolver"; - config = let - # taken from unstable - cartesianProductOfSets = attrsOfLists: with lib; - lib.foldl' (listOfAttrs: attrName: - concatMap (attrs: - map (listValue: attrs // { ${attrName} = listValue; }) attrsOfLists.${attrName} - ) listOfAttrs - ) [{}] (attrNames attrsOfLists); - cfg = config.services.bind; - keyIncludes = builtins.concatStringsSep "\n" (map (v: "include \"${config.secrets.fullPaths."bind/${v}.key"}\";") (builtins.attrNames config.myEnv.dns.keys)); - cartProduct = lib.foldr - (s: servers: servers // { ${s.masters} = lib.unique ((servers.${s.masters} or []) ++ [s.keys]); }) - {} - (lib.unique (lib.concatMap (z: cartesianProductOfSets { masters = z.masters or []; keys = z.keys or []; }) config.myEnv.dns.slaveZones)); - toKeyList = servers: keys: builtins.concatStringsSep "\n" (map (s: '' - server ${s} { - keys { ${builtins.concatStringsSep ";" keys}; }; - }; - '') servers); - serverIncludes = builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: toKeyList (lib.flatten (builtins.attrValues config.myEnv.dns.ns."${n}"))) cartProduct); - configFile = pkgs.writeText "named.conf" '' - include "/etc/bind/rndc.key"; - controls { - inet 127.0.0.1 allow {localhost;} keys {"rndc-key";}; - }; - - acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} }; - acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} }; - - options { - listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} }; - listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} }; - allow-query { cachenetworks; }; - blackhole { badnetworks; }; - forward first; - forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} }; - directory "/var/run/named"; - pid-file "/var/run/named/named.pid"; - ${cfg.extraOptions} - }; - - ${keyIncludes} - ${serverIncludes} - - ${cfg.extraConfig} - - ${ lib.concatMapStrings - ({ name, file, master ? true, extra ? "", slaves ? [], masters ? [] }: - '' - zone "${name}" { - type ${if master then "master" else "slave"}; - file "${file}"; - ${ if lib.lists.length slaves > 0 then - '' - allow-transfer { - ${lib.concatMapStrings (ip: "${ip};\n") slaves} - }; - '' else ""} - ${ if lib.lists.length masters > 0 then - '' - masters { - ${lib.concatMapStrings (ip: "${ip};\n") masters} - }; - '' else ""} - allow-query { any; }; - ${extra} - }; - '') - cfg.zones } - ''; - mxes = lib.attrsets.filterAttrs - (n: v: v.mx.enable) - config.myEnv.servers; - ip4mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList - (n: v: "${v.mx.subdomain} IN A ${v.ips.main.ip4}") - mxes); - ip6mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList - (n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN AAAA ${i}") v.ips.main.ip6)) - mxes); - mxmxes = n: conf: builtins.concatStringsSep "\n" (lib.mapAttrsToList - (_: v: "${n} IN MX ${v.mx.priority} ${v.mx.subdomain}.${conf.name}.") - mxes); - in lib.mkIf config.myServices.dns.enable { - networking.firewall.allowedUDPPorts = [ 53 ]; - networking.firewall.allowedTCPPorts = [ 53 ]; - users.users.named.extraGroups = [ "keys" ]; - secrets.keys = lib.mapAttrs' (k: v: - lib.nameValuePair "bind/${k}.key" { - permissions = "0400"; - user = "named"; - text = '' - key "${k}" - { - algorithm ${v.algorithm}; - secret "${v.secret}"; - }; - ''; - } - ) config.myEnv.dns.keys; - services.bind = { - enable = true; - cacheNetworks = ["any"]; - configFile = configFile; - extraOptions = '' - allow-recursion { 127.0.0.1; }; - allow-transfer { none; }; - - notify-source ${config.myEnv.servers.eldiron.ips.main.ip4}; - notify-source-v6 ${lib.head config.myEnv.servers.eldiron.ips.main.ip6}; - version none; - hostname none; - server-id none; - ''; - zones = with config.myEnv.dns; - assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != "."; - assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != "."; - (map (conf: { - name = conf.name; - master = false; - file = "/var/run/named/${conf.name}.zone"; - masters = if lib.attrsets.hasAttr "masters" conf - then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.masters) - else []; - }) slaveZones) - ++ (map (conf: { - name = conf.name; - master = true; - extra = if lib.attrsets.hasAttr "extra" conf then conf.extra else ""; - slaves = if lib.attrsets.hasAttr "slaves" conf - then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.slaves) - else []; - file = pkgs.writeText "${conf.name}.zone" '' - $TTL 10800 - @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl} - - ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))} - ${lib.optionalString (conf.withCAA != null) '' - ${conf.name}. IN CAA 0 issue "${conf.withCAA}" - ''} - - ${conf.entries} - - ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then '' - ${ip4mxes} - ${ip6mxes} - ${lib.concatStringsSep "\n\n" (map (e: - let - n = if e.domain == "" then "@" else "${e.domain} "; - suffix = if e.domain == "" then "" else ".${e.domain}"; - in - '' - ; ------------------ mail: ${n} --------------------------- - ${mxmxes n conf} - - ; https://tools.ietf.org/html/rfc6186 - _submission._tcp${suffix} SRV 0 1 587 smtp.immae.eu. - _submissions._tcp${suffix} SRV 0 1 465 smtp.immae.eu. - _imap._tcp${suffix} SRV 0 1 143 imap.immae.eu. - _imaps._tcp${suffix} SRV 0 1 993 imap.immae.eu. - _pop3._tcp${suffix} SRV 10 1 110 pop3.immae.eu. - _pop3s._tcp${suffix} SRV 10 1 995 pop3.immae.eu. - _sieve._tcp${suffix} SRV 0 1 4190 imap.immae.eu. - - ; MTA-STS - ; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/ - ; https://support.google.com/a/answer/9261504 - _mta-sts${suffix} IN TXT "v=STSv1;id=20200109150200Z" - _smtp._tls${suffix} IN TXT "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu" - mta-sts${suffix} IN A ${config.myEnv.servers.eldiron.ips.main.ip4} - ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix} IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)} - - ; Mail sender authentications - ${n} IN TXT "v=spf1 mx ~all" - _dmarc${suffix} IN TXT "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster+rua@immae.eu; ruf=mailto:postmaster+ruf@immae.eu;" - ${if e.send then '' - immae_eu._domainkey${suffix} IN TXT ( "v=DKIM1; k=rsa; s=email; " - "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF" - "0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" ) - eldiron._domainkey${suffix} IN TXT ${config.myEnv.mail.dkim.eldiron.public} - '' else ""} - '') conf.withEmail)} - '' + (if conf.name == "immae.eu" then '' - ; ----------------- Accept DMARC reports ------------------- - ${lib.concatStringsSep "\n" ( - lib.flatten ( - map (z: map (e: "${e.domain}${if builtins.stringLength e.domain > 0 then "." else ""}${z.name}._report._dmarc IN TXT \"v=DMARC1;\"") (z.withEmail or [])) masterZones - ) - )} - '' else "") else ""} - ''; - }) masterZones); - }; - }; -}