blob: fb908242f143d759913ecac44121bae56ca2feb3 (
plain) (
tree)
|
|
{ lib, pkgs, config, ... }:
{
options.myServices.dns.enable = lib.mkEnableOption "enable DNS resolver";
config = let
cfg = config.services.bind;
configFile = pkgs.writeText "named.conf" ''
include "/etc/bind/rndc.key";
controls {
inet 127.0.0.1 allow {localhost;} keys {"rndc-key";};
};
acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} };
acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} };
options {
listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} };
listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} };
allow-query { cachenetworks; };
blackhole { badnetworks; };
forward first;
forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} };
directory "/var/run/named";
pid-file "/var/run/named/named.pid";
${cfg.extraOptions}
};
${cfg.extraConfig}
${ lib.concatMapStrings
({ name, file, master ? true, extra ? "", slaves ? [], masters ? [] }:
''
zone "${name}" {
type ${if master then "master" else "slave"};
file "${file}";
${ if lib.lists.length slaves > 0 then
''
allow-transfer {
${lib.concatMapStrings (ip: "${ip};\n") slaves}
};
'' else ""}
${ if lib.lists.length masters > 0 then
''
masters {
${lib.concatMapStrings (ip: "${ip};\n") masters}
};
'' else ""}
allow-query { any; };
${extra}
};
'')
cfg.zones }
'';
in lib.mkIf config.myServices.dns.enable {
networking.firewall.allowedUDPPorts = [ 53 ];
networking.firewall.allowedTCPPorts = [ 53 ];
services.bind = {
enable = true;
cacheNetworks = ["any"];
configFile = configFile;
extraOptions = ''
allow-recursion { 127.0.0.1; };
allow-transfer { none; };
notify-source ${config.myEnv.servers.eldiron.ips.main.ip4};
notify-source-v6 ${lib.head config.myEnv.servers.eldiron.ips.main.ip6};
version none;
hostname none;
server-id none;
'';
zones = with config.myEnv.dns;
assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != ".";
assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != ".";
(map (conf: {
name = conf.name;
master = false;
file = "/var/run/named/${conf.name}.zone";
masters = if lib.attrsets.hasAttr "masters" conf
then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.masters)
else [];
}) slaveZones)
++ (map (conf: {
name = conf.name;
master = true;
extra = if lib.attrsets.hasAttr "extra" conf then conf.extra else "";
slaves = if lib.attrsets.hasAttr "slaves" conf
then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.slaves)
else [];
file = pkgs.writeText "${conf.name}.zone" ''
$TTL 10800
@ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl}
${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))}
${conf.entries}
${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then ''
mx-1 IN A ${config.myEnv.servers.eldiron.ips.main.ip4}
mx-2 IN A ${config.myEnv.servers.immaeEu.ips.main.ip4}
${builtins.concatStringsSep "\n" (map (i: "mx-1 IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)}
${builtins.concatStringsSep "\n" (map (i: "mx-2 IN AAAA ${i}") config.myEnv.servers.immaeEu.ips.main.ip6)}
${lib.concatStringsSep "\n\n" (map (e:
let
n = if e.domain == "" then "@" else "${e.domain} ";
suffix = if e.domain == "" then "" else ".${e.domain}";
in
''
; ------------------ mail: ${n} ---------------------------
${n} IN MX 10 mx-1.${conf.name}.
${n} IN MX 20 mx-2.${conf.name}.
; https://tools.ietf.org/html/rfc6186
_submission._tcp${suffix} SRV 0 1 587 smtp.immae.eu.
_submissions._tcp${suffix} SRV 0 1 465 smtp.immae.eu.
_imap._tcp${suffix} SRV 0 1 143 imap.immae.eu.
_imaps._tcp${suffix} SRV 0 1 993 imap.immae.eu.
_pop3._tcp${suffix} SRV 10 1 110 pop3.immae.eu.
_pop3s._tcp${suffix} SRV 10 1 995 pop3.immae.eu.
_sieve._tcp${suffix} SRV 0 1 4190 imap.immae.eu.
; MTA-STS
; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/
; https://support.google.com/a/answer/9261504
_mta-sts${suffix} IN TXT "v=STSv1;id=20190630054629Z"
_smtp._tls${suffix} IN TXT "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu"
mta-sts${suffix} IN A ${config.myEnv.servers.eldiron.ips.main.ip4}
${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix} IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)}
; Mail sender authentications
${n} IN TXT "v=spf1 mx ~all"
_dmarc${suffix} IN TXT "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster+rua@immae.eu; ruf=mailto:postmaster+ruf@immae.eu;"
${if e.send then ''
immae_eu._domainkey${suffix} IN TXT ( "v=DKIM1; k=rsa; s=email; "
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF"
"0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" )
eldiron._domainkey${suffix} IN TXT ${config.myEnv.mail.dkim.eldiron.public}
'' else ""}
'') conf.withEmail)}
'' + (if conf.name == "immae.eu" then ''
; ----------------- Accept DMARC reports -------------------
${lib.concatStringsSep "\n" (
lib.flatten (
map (z: map (e: "${e.domain}${if builtins.stringLength e.domain > 0 then "." else ""}${z.name}._report._dmarc IN TXT \"v=DMARC1;\"") (z.withEmail or [])) masterZones
)
)}
'' else "") else ""}
'';
}) masterZones);
};
};
}
|
