rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-05-13 15:51:09 +02:00
Code Issues Projects Releases Packages Wiki Activity

caddy: enable dns challenges

Browse source
This commit is contained in:
Rouven Seifert 2025-05-11 16:49:43 +02:00
parent f8eee37e51
commit 0cf89b0ae4
10 changed files with 48 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

49
hosts/falkenstein/modules/dns/default.nix
View file

@ -2,6 +2,12 @@
let
secondary = "185.181.104.96";
domain = config.networking.domain;
# fetches all VgetVirtualHosts from the caddy config
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts);
# generate CNAMES from caddy service to host
genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { CNAME = [ "${hostname}.${domain}." ]; });
# generate Bind config to allow dynamic updates
genKeyGrants = hostname: builtins.foldl' (x: y: x + "grant caddy name _acme-challenge." + y + ".${domain} txt;\n") "" (lib.lists.remove ":2018" (getVirtualHosts hostname));
zonefile = with dns.lib.combinators; pkgs.writeText "rfive.de.zone.txt" (dns.lib.toString domain {
TTL = 3600;
SOA =
@ -11,8 +17,8 @@ let
{
nameServer = "ns.rfive.de.";
adminEmail = "hostmaster@rfive.de";
# serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864));
serial = 2025051079;
serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864));
# serial = 2025051143;
refresh = 10800;
retry = 3600;
expire = 604800;
@ -37,12 +43,10 @@ let
subdomains =
let
# fetches all VgetVirtualHosts from the caddy config
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts);
# generate CNAMES from caddy service to host
genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { CNAME = [ "${hostname}.${domain}." ]; });
# generate ACME challenge recorsd for every VirtualHost
genACMECNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { subdomains._acme-challenge.CNAME = [ "challenge.acme.${domain}." ]; });
genACMECNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: {
subdomains._acme-challenge.CNAME = [ "challenge.acme.${domain}." ];
});
# fuckery to merge the generated attribute lists
mergeRecords = recordList: lib.attrsets.mapAttrs (_host: records: lib.attrsets.mergeAttrsList records) (lib.attrsets.zipAttrs recordList);
in
@ -62,21 +66,26 @@ let
mail = falkenstein;
_dmarc.TXT = [ "v=DMARC1; p=none; adkim=s; fo=1; rua=mailto:dmarc@rfive.de; ruf=mailto:dmarc@rfive.de" ];
_domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ];
"*".subdomains."_acme-challenge".CNAME = [ "challenge.acme.rfive.de" ];
}
(mergeRecords [
(builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ]))
])
(mergeRecords [
(builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
(builtins.removeAttrs (genACMECNAMEs "falkenstein") ([ ":2018" "mail" ]))
])
(builtins.removeAttrs (genACMECNAMEs "fujitsu") ([ ":2018" ]))
(builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
# (mergeRecords [
# (builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
# (builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ]))
# ])
# (mergeRecords [
# (builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
# (builtins.removeAttrs (genACMECNAMEs "falkenstein") ([ ":2018" "mail" ]))
# ])
# (builtins.removeAttrs (genACMECNAMEs "fujitsu") ([ ":2018" ]))
];
});
in
{
age.secrets.acme-dns = {
file = ../../../../secrets/falkenstein/acme-dns.age;
owner = "named";
};
services.bind = rec {
enable = true;
directory = "/var/lib/bind";
@ -89,6 +98,7 @@ in
publish-safety 1d;
retire-safety 1d;
};
include "${config.age.secrets.acme-dns.path}";
'';
zones = {
"rfive.de" = {
@ -102,7 +112,10 @@ in
inline-signing yes;
serial-update-method date;
update-policy {
grant caddy. name challenge.acme.rfive.de. txt;
grant caddy name _acme-challenge.cinema.vpn.rfive.de. txt;
${genKeyGrants "nuc"}
${genKeyGrants "falkenstein"}
${genKeyGrants "fujitsu"}
};
'';
file = "${directory}/rfive.de.zone.txt";

1
hosts/falkenstein/modules/networks/default.nix
View file

@ -28,6 +28,7 @@
extraInputRules = ''
ip saddr 192.168.0.0/16 tcp dport 19531 accept comment "Allow journald gateway access from local networks"
'';
trustedInterfaces = [ "wg0" ];
};
};
services.resolved = {

2
hosts/fujitsu/modules/jellyfin/default.nix
View file

@ -1,6 +1,6 @@
{ ... }:
let
domain = "media.vpn.rfive.de";
domain = "cinema.vpn.rfive.de";
in
{
services.jellyfin = {

2
hosts/thinkpad/modules/security/default.nix
View file

@ -18,8 +18,6 @@
cue = true;
};
};
# fixes run0 failing to execute
services.systemd-run0 = { };
};
krb5 = {
enable = true;