diff options
Diffstat (limited to 'modules/private/dns.nix')
-rw-r--r-- | modules/private/dns.nix | 197 |
1 files changed, 0 insertions, 197 deletions
diff --git a/modules/private/dns.nix b/modules/private/dns.nix deleted file mode 100644 index 1d7fd52..0000000 --- a/modules/private/dns.nix +++ /dev/null | |||
@@ -1,197 +0,0 @@ | |||
1 | { lib, pkgs, config, ... }: | ||
2 | { | ||
3 | options.myServices.dns.enable = lib.mkEnableOption "enable DNS resolver"; | ||
4 | config = let | ||
5 | # taken from unstable | ||
6 | cartesianProductOfSets = attrsOfLists: with lib; | ||
7 | lib.foldl' (listOfAttrs: attrName: | ||
8 | concatMap (attrs: | ||
9 | map (listValue: attrs // { ${attrName} = listValue; }) attrsOfLists.${attrName} | ||
10 | ) listOfAttrs | ||
11 | ) [{}] (attrNames attrsOfLists); | ||
12 | cfg = config.services.bind; | ||
13 | keyIncludes = builtins.concatStringsSep "\n" (map (v: "include \"${config.secrets.fullPaths."bind/${v}.key"}\";") (builtins.attrNames config.myEnv.dns.keys)); | ||
14 | cartProduct = lib.foldr | ||
15 | (s: servers: servers // { ${s.masters} = lib.unique ((servers.${s.masters} or []) ++ [s.keys]); }) | ||
16 | {} | ||
17 | (lib.unique (lib.concatMap (z: cartesianProductOfSets { masters = z.masters or []; keys = z.keys or []; }) config.myEnv.dns.slaveZones)); | ||
18 | toKeyList = servers: keys: builtins.concatStringsSep "\n" (map (s: '' | ||
19 | server ${s} { | ||
20 | keys { ${builtins.concatStringsSep ";" keys}; }; | ||
21 | }; | ||
22 | '') servers); | ||
23 | serverIncludes = builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: toKeyList (lib.flatten (builtins.attrValues config.myEnv.dns.ns."${n}"))) cartProduct); | ||
24 | configFile = pkgs.writeText "named.conf" '' | ||
25 | include "/etc/bind/rndc.key"; | ||
26 | controls { | ||
27 | inet 127.0.0.1 allow {localhost;} keys {"rndc-key";}; | ||
28 | }; | ||
29 | |||
30 | acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} }; | ||
31 | acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} }; | ||
32 | |||
33 | options { | ||
34 | listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} }; | ||
35 | listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} }; | ||
36 | allow-query { cachenetworks; }; | ||
37 | blackhole { badnetworks; }; | ||
38 | forward first; | ||
39 | forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} }; | ||
40 | directory "/var/run/named"; | ||
41 | pid-file "/var/run/named/named.pid"; | ||
42 | ${cfg.extraOptions} | ||
43 | }; | ||
44 | |||
45 | ${keyIncludes} | ||
46 | ${serverIncludes} | ||
47 | |||
48 | ${cfg.extraConfig} | ||
49 | |||
50 | ${ lib.concatMapStrings | ||
51 | ({ name, file, master ? true, extra ? "", slaves ? [], masters ? [] }: | ||
52 | '' | ||
53 | zone "${name}" { | ||
54 | type ${if master then "master" else "slave"}; | ||
55 | file "${file}"; | ||
56 | ${ if lib.lists.length slaves > 0 then | ||
57 | '' | ||
58 | allow-transfer { | ||
59 | ${lib.concatMapStrings (ip: "${ip};\n") slaves} | ||
60 | }; | ||
61 | '' else ""} | ||
62 | ${ if lib.lists.length masters > 0 then | ||
63 | '' | ||
64 | masters { | ||
65 | ${lib.concatMapStrings (ip: "${ip};\n") masters} | ||
66 | }; | ||
67 | '' else ""} | ||
68 | allow-query { any; }; | ||
69 | ${extra} | ||
70 | }; | ||
71 | '') | ||
72 | cfg.zones } | ||
73 | ''; | ||
74 | mxes = lib.attrsets.filterAttrs | ||
75 | (n: v: v.mx.enable) | ||
76 | config.myEnv.servers; | ||
77 | ip4mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList | ||
78 | (n: v: "${v.mx.subdomain} IN A ${v.ips.main.ip4}") | ||
79 | mxes); | ||
80 | ip6mxes = builtins.concatStringsSep "\n" (lib.mapAttrsToList | ||
81 | (n: v: builtins.concatStringsSep "\n" (map (i: "${v.mx.subdomain} IN AAAA ${i}") v.ips.main.ip6)) | ||
82 | mxes); | ||
83 | mxmxes = n: conf: builtins.concatStringsSep "\n" (lib.mapAttrsToList | ||
84 | (_: v: "${n} IN MX ${v.mx.priority} ${v.mx.subdomain}.${conf.name}.") | ||
85 | mxes); | ||
86 | in lib.mkIf config.myServices.dns.enable { | ||
87 | networking.firewall.allowedUDPPorts = [ 53 ]; | ||
88 | networking.firewall.allowedTCPPorts = [ 53 ]; | ||
89 | users.users.named.extraGroups = [ "keys" ]; | ||
90 | secrets.keys = lib.mapAttrs' (k: v: | ||
91 | lib.nameValuePair "bind/${k}.key" { | ||
92 | permissions = "0400"; | ||
93 | user = "named"; | ||
94 | text = '' | ||
95 | key "${k}" | ||
96 | { | ||
97 | algorithm ${v.algorithm}; | ||
98 | secret "${v.secret}"; | ||
99 | }; | ||
100 | ''; | ||
101 | } | ||
102 | ) config.myEnv.dns.keys; | ||
103 | services.bind = { | ||
104 | enable = true; | ||
105 | cacheNetworks = ["any"]; | ||
106 | configFile = configFile; | ||
107 | extraOptions = '' | ||
108 | allow-recursion { 127.0.0.1; }; | ||
109 | allow-transfer { none; }; | ||
110 | |||
111 | notify-source ${config.myEnv.servers.eldiron.ips.main.ip4}; | ||
112 | notify-source-v6 ${lib.head config.myEnv.servers.eldiron.ips.main.ip6}; | ||
113 | version none; | ||
114 | hostname none; | ||
115 | server-id none; | ||
116 | ''; | ||
117 | zones = with config.myEnv.dns; | ||
118 | assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != "."; | ||
119 | assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != "."; | ||
120 | (map (conf: { | ||
121 | name = conf.name; | ||
122 | master = false; | ||
123 | file = "/var/run/named/${conf.name}.zone"; | ||
124 | masters = if lib.attrsets.hasAttr "masters" conf | ||
125 | then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.masters) | ||
126 | else []; | ||
127 | }) slaveZones) | ||
128 | ++ (map (conf: { | ||
129 | name = conf.name; | ||
130 | master = true; | ||
131 | extra = if lib.attrsets.hasAttr "extra" conf then conf.extra else ""; | ||
132 | slaves = if lib.attrsets.hasAttr "slaves" conf | ||
133 | then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.slaves) | ||
134 | else []; | ||
135 | file = pkgs.writeText "${conf.name}.zone" '' | ||
136 | $TTL 10800 | ||
137 | @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl} | ||
138 | |||
139 | ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))} | ||
140 | ${lib.optionalString (conf.withCAA != null) '' | ||
141 | ${conf.name}. IN CAA 0 issue "${conf.withCAA}" | ||
142 | ''} | ||
143 | |||
144 | ${conf.entries} | ||
145 | |||
146 | ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then '' | ||
147 | ${ip4mxes} | ||
148 | ${ip6mxes} | ||
149 | ${lib.concatStringsSep "\n\n" (map (e: | ||
150 | let | ||
151 | n = if e.domain == "" then "@" else "${e.domain} "; | ||
152 | suffix = if e.domain == "" then "" else ".${e.domain}"; | ||
153 | in | ||
154 | '' | ||
155 | ; ------------------ mail: ${n} --------------------------- | ||
156 | ${mxmxes n conf} | ||
157 | |||
158 | ; https://tools.ietf.org/html/rfc6186 | ||
159 | _submission._tcp${suffix} SRV 0 1 587 smtp.immae.eu. | ||
160 | _submissions._tcp${suffix} SRV 0 1 465 smtp.immae.eu. | ||
161 | _imap._tcp${suffix} SRV 0 1 143 imap.immae.eu. | ||
162 | _imaps._tcp${suffix} SRV 0 1 993 imap.immae.eu. | ||
163 | _pop3._tcp${suffix} SRV 10 1 110 pop3.immae.eu. | ||
164 | _pop3s._tcp${suffix} SRV 10 1 995 pop3.immae.eu. | ||
165 | _sieve._tcp${suffix} SRV 0 1 4190 imap.immae.eu. | ||
166 | |||
167 | ; MTA-STS | ||
168 | ; https://blog.delouw.ch/2018/12/16/using-mta-sts-to-enhance-email-transport-security-and-privacy/ | ||
169 | ; https://support.google.com/a/answer/9261504 | ||
170 | _mta-sts${suffix} IN TXT "v=STSv1;id=20200109150200Z" | ||
171 | _smtp._tls${suffix} IN TXT "v=TLSRPTv1;rua=mailto:postmaster+mta-sts@immae.eu" | ||
172 | mta-sts${suffix} IN A ${config.myEnv.servers.eldiron.ips.main.ip4} | ||
173 | ${builtins.concatStringsSep "\n" (map (i: "mta-sts${suffix} IN AAAA ${i}") config.myEnv.servers.eldiron.ips.main.ip6)} | ||
174 | |||
175 | ; Mail sender authentications | ||
176 | ${n} IN TXT "v=spf1 mx ~all" | ||
177 | _dmarc${suffix} IN TXT "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster+rua@immae.eu; ruf=mailto:postmaster+ruf@immae.eu;" | ||
178 | ${if e.send then '' | ||
179 | immae_eu._domainkey${suffix} IN TXT ( "v=DKIM1; k=rsa; s=email; " | ||
180 | "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF" | ||
181 | "0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" ) | ||
182 | eldiron._domainkey${suffix} IN TXT ${config.myEnv.mail.dkim.eldiron.public} | ||
183 | '' else ""} | ||
184 | '') conf.withEmail)} | ||
185 | '' + (if conf.name == "immae.eu" then '' | ||
186 | ; ----------------- Accept DMARC reports ------------------- | ||
187 | ${lib.concatStringsSep "\n" ( | ||
188 | lib.flatten ( | ||
189 | map (z: map (e: "${e.domain}${if builtins.stringLength e.domain > 0 then "." else ""}${z.name}._report._dmarc IN TXT \"v=DMARC1;\"") (z.withEmail or [])) masterZones | ||
190 | ) | ||
191 | )} | ||
192 | '' else "") else ""} | ||
193 | ''; | ||
194 | }) masterZones); | ||
195 | }; | ||
196 | }; | ||
197 | } | ||