aboutsummaryrefslogtreecommitdiff
path: root/nixops/modules/dns.nix
blob: 0096f554833f3401e802f5acb01b2f2a2d9a7c72 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
{ lib, pkgs, config, myconfig, mylibs, ... }:
{
  config = let
    cfg = config.services.bind;
    configFile = pkgs.writeText "named.conf" ''
      include "/etc/bind/rndc.key";
      controls {
        inet 127.0.0.1 allow {localhost;} keys {"rndc-key";};
      };

      acl cachenetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.cacheNetworks} };
      acl badnetworks { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.blockedNetworks} };

      options {
        listen-on { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOn} };
        listen-on-v6 { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} };
        allow-query { cachenetworks; };
        blackhole { badnetworks; };
        forward first;
        forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} };
        directory "/var/run/named";
        pid-file "/var/run/named/named.pid";
        ${cfg.extraOptions}
      };

      ${cfg.extraConfig}

      ${ lib.concatMapStrings
          ({ name, file, master ? true, extra ? "", slaves ? [], masters ? [] }:
            ''
              zone "${name}" {
                type ${if master then "master" else "slave"};
                file "${file}";
                ${ if lib.lists.length slaves > 0 then
                  ''
                    allow-transfer {
                      ${lib.concatMapStrings (ip: "${ip};\n") slaves}
                    };
                  '' else ""}
                ${ if lib.lists.length masters > 0 then
                  ''
                    masters {
                      ${lib.concatMapStrings (ip: "${ip};\n") masters}
                    };
                  '' else ""}
                allow-query { any; };
                ${extra}
              };
            '')
          cfg.zones }
    '';
  in
    {
    networking.firewall.allowedUDPPorts = [ 53 ];
    networking.firewall.allowedTCPPorts = [ 53 ];
    services.bind = {
      enable = true;
      cacheNetworks = ["any"];
      configFile = configFile;
      extraOptions = ''
        allow-recursion { 127.0.0.1; };
        allow-transfer  { none; };

        notify-source    ${myconfig.env.servers.eldiron.ips.main.ip4};
        notify-source-v6 ${lib.head myconfig.env.servers.eldiron.ips.main.ip6};
        version   none;
        hostname  none;
        server-id none;
        '';
      zones = with myconfig.env.dns;
        assert (builtins.substring ((builtins.stringLength soa.email)-1) 1 soa.email) != ".";
        assert (builtins.substring ((builtins.stringLength soa.primary)-1) 1 soa.primary) != ".";
        (map (conf: {
          name = conf.name;
          master = false;
          file = "/var/run/named/${conf.name}.zone";
          masters = if lib.attrsets.hasAttr "masters" conf
            then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.masters)
            else [];
        }) slaveZones)
        ++ (map (conf: {
          name = conf.name;
          master = true;
          extra = if lib.attrsets.hasAttr "extra" conf then conf.extra else "";
          slaves = if lib.attrsets.hasAttr "slaves" conf
            then lib.lists.flatten (map (n: lib.attrsets.attrValues ns.${n}) conf.slaves)
            else [];
          file = pkgs.writeText "${conf.name}.zone" ''
              $TTL 10800
              @ IN SOA ${soa.primary}. ${builtins.replaceStrings ["@"] ["."] soa.email}. ${soa.serial} ${soa.refresh} ${soa.retry} ${soa.expire} ${soa.ttl}

              ${lib.concatStringsSep "\n" (map (x: "@ IN NS ${x}.") (lib.concatMap (n: lib.attrsets.mapAttrsToList (k: v: k) ns.${n}) conf.ns))}

              ${conf.entries}

              ${if lib.attrsets.hasAttr "withEmail" conf && lib.lists.length conf.withEmail > 0 then ''
              mail IN A     ${myconfig.env.servers.immaeEu.ips.main.ip4}
              mx-1 IN A     ${myconfig.env.servers.eldiron.ips.main.ip4}
              ${builtins.concatStringsSep "\n" (map (i: "mail IN AAAA  ${i}") myconfig.env.servers.immaeEu.ips.main.ip6)}
              ${builtins.concatStringsSep "\n" (map (i: "mx-1 IN AAAA  ${i}") myconfig.env.servers.eldiron.ips.main.ip6)}
              ${lib.concatStringsSep "\n\n" (map (e:
              let
                n = if e.domain == "" then "@" else "${e.domain}  ";
                suffix = if e.domain == "" then "" else ".${e.domain}";
              in
              ''
              ; ------------------ mail: ${n} ---------------------------
              ${if e.receive then "${n} IN MX 10 mail.${conf.name}." else ""}
              ;${if e.receive then "${n} IN MX 50 mx-1.${conf.name}." else ""}

              ; Mail sender authentications
              ${n}                   IN TXT  "v=spf1 mx ~all"
              _dmarc${suffix}              IN TXT  "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:postmaster+rua@immae.eu; ruf=mailto:postmaster+ruf@immae.eu;"
              ${if e.send then ''
              immae_eu._domainkey${suffix} IN TXT  ( "v=DKIM1; k=rsa; s=email; "
                        "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzl3vLd8W5YAuumC5+ZT9OV7/14Pmh5JYtwyqKI3cfe9NnAqInt3xO4bZ7oqIxRKWN4SD39vm7O/QOvFdBt00ENOOzdP90s5gKw6eIP/4+vPTh0IWltAsmu9B2agzdtWUE7t2xFKIzEn8l9niRE2QYbVaqZv4sub98vY55fIgFoHtjkmNC7325S8fjDJGp6OPbyhAs6Xl5/adjF"
                        "0ko4Y2p6RaxLQfjlS0bxmK4Qg6C14pIXHtzVeqOuWrwApqt5+AULSn97iUtqV/IJlEEjC6DUR44t3C/G0G/k46iFclCqRRi0hdPrOHCtZDbtMubnTN9eaUiNpkXh1WnCflHwtjQwIDAQAB" )
              '' else ""}
              '') conf.withEmail)}
              '' + (if conf.name == "immae.eu" then ''
              ; ----------------- Accept DMARC reports -------------------
              ${lib.concatStringsSep "\n" (
                lib.flatten (
                  map (z: map (e: "${e.domain}${if builtins.stringLength e.domain > 0 then "." else ""}${z.name}._report._dmarc IN TXT \"v=DMARC1;\"") (z.withEmail or [])) masterZones
                )
              )}
              '' else "") else ""}
            '';
          }) masterZones);
    };
  };
}