rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-05-13 07:41:08 +02:00
Code Issues Projects Releases Packages Wiki Activity

caddy: enable dns challenges

Browse source
This commit is contained in:
Rouven Seifert 2025-05-11 16:49:43 +02:00
parent f8eee37e51
commit 0cf89b0ae4
10 changed files with 48 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

6
flake.lock generated
View file

@ -92,11 +92,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1746901403, "lastModified": 1746905309,
"narHash": "sha256-2tkRHeNEkaE1x0ayfi30+nrIQv4Nio/NeT8U3i3qeQA=", "narHash": "sha256-m5sov8Pcj1PbCF3JmcPNTJC1FJVOEvFB1Bx9o35FiYw=",
"owner": "rouven0", "owner": "rouven0",
"repo": "nixos-caddy-patched", "repo": "nixos-caddy-patched",
"rev": "ad2df7623e62ee4595c8f523b30cf6914a2cb6bd", "rev": "c65d3f16d1f821983a6a8de3aeeb00b05d142272",
"type": "github" "type": "github"
}, },
"original": { "original": {

49
hosts/falkenstein/modules/dns/default.nix
View file

@ -2,6 +2,12 @@
let let
secondary = "185.181.104.96"; secondary = "185.181.104.96";
domain = config.networking.domain; domain = config.networking.domain;
# fetches all VgetVirtualHosts from the caddy config
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts);
# generate CNAMES from caddy service to host
genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { CNAME = [ "${hostname}.${domain}." ]; });
# generate Bind config to allow dynamic updates
genKeyGrants = hostname: builtins.foldl' (x: y: x + "grant caddy name _acme-challenge." + y + ".${domain} txt;\n") "" (lib.lists.remove ":2018" (getVirtualHosts hostname));
zonefile = with dns.lib.combinators; pkgs.writeText "rfive.de.zone.txt" (dns.lib.toString domain { zonefile = with dns.lib.combinators; pkgs.writeText "rfive.de.zone.txt" (dns.lib.toString domain {
TTL = 3600; TTL = 3600;
SOA = SOA =
@ -11,8 +17,8 @@ let
{ {
nameServer = "ns.rfive.de."; nameServer = "ns.rfive.de.";
adminEmail = "hostmaster@rfive.de"; adminEmail = "hostmaster@rfive.de";
# serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864)); serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864));
serial = 2025051079; # serial = 2025051143;
refresh = 10800; refresh = 10800;
retry = 3600; retry = 3600;
expire = 604800; expire = 604800;
@ -37,12 +43,10 @@ let
subdomains = subdomains =
let let
# fetches all VgetVirtualHosts from the caddy config
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts);
# generate CNAMES from caddy service to host
genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { CNAME = [ "${hostname}.${domain}." ]; });
# generate ACME challenge recorsd for every VirtualHost # generate ACME challenge recorsd for every VirtualHost
genACMECNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { subdomains._acme-challenge.CNAME = [ "challenge.acme.${domain}." ]; }); genACMECNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: {
subdomains._acme-challenge.CNAME = [ "challenge.acme.${domain}." ];
});
# fuckery to merge the generated attribute lists # fuckery to merge the generated attribute lists
mergeRecords = recordList: lib.attrsets.mapAttrs (_host: records: lib.attrsets.mergeAttrsList records) (lib.attrsets.zipAttrs recordList); mergeRecords = recordList: lib.attrsets.mapAttrs (_host: records: lib.attrsets.mergeAttrsList records) (lib.attrsets.zipAttrs recordList);
in in
@ -62,21 +66,26 @@ let
mail = falkenstein; mail = falkenstein;
_dmarc.TXT = [ "v=DMARC1; p=none; adkim=s; fo=1; rua=mailto:dmarc@rfive.de; ruf=mailto:dmarc@rfive.de" ]; _dmarc.TXT = [ "v=DMARC1; p=none; adkim=s; fo=1; rua=mailto:dmarc@rfive.de; ruf=mailto:dmarc@rfive.de" ];
_domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ]; _domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ];
"*".subdomains."_acme-challenge".CNAME = [ "challenge.acme.rfive.de" ];
} }
(mergeRecords [ (builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc")))) (builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
(builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ])) # (mergeRecords [
]) # (builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(mergeRecords [ # (builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ]))
(builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ])) # ])
(builtins.removeAttrs (genACMECNAMEs "falkenstein") ([ ":2018" "mail" ])) # (mergeRecords [
]) # (builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
(builtins.removeAttrs (genACMECNAMEs "fujitsu") ([ ":2018" ])) # (builtins.removeAttrs (genACMECNAMEs "falkenstein") ([ ":2018" "mail" ]))
# ])
# (builtins.removeAttrs (genACMECNAMEs "fujitsu") ([ ":2018" ]))
]; ];
}); });
in in
{ {
age.secrets.acme-dns = {
file = ../../../../secrets/falkenstein/acme-dns.age;
owner = "named";
};
services.bind = rec { services.bind = rec {
enable = true; enable = true;
directory = "/var/lib/bind"; directory = "/var/lib/bind";
@ -89,6 +98,7 @@ in
publish-safety 1d; publish-safety 1d;
retire-safety 1d; retire-safety 1d;
}; };
include "${config.age.secrets.acme-dns.path}";
''; '';
zones = { zones = {
"rfive.de" = { "rfive.de" = {
@ -102,7 +112,10 @@ in
inline-signing yes; inline-signing yes;
serial-update-method date; serial-update-method date;
update-policy { update-policy {
grant caddy. name challenge.acme.rfive.de. txt; grant caddy name _acme-challenge.cinema.vpn.rfive.de. txt;
${genKeyGrants "nuc"}
${genKeyGrants "falkenstein"}
${genKeyGrants "fujitsu"}
}; };
''; '';
file = "${directory}/rfive.de.zone.txt"; file = "${directory}/rfive.de.zone.txt";

1
hosts/falkenstein/modules/networks/default.nix
View file

@ -28,6 +28,7 @@
extraInputRules = '' extraInputRules = ''
ip saddr 192.168.0.0/16 tcp dport 19531 accept comment "Allow journald gateway access from local networks" ip saddr 192.168.0.0/16 tcp dport 19531 accept comment "Allow journald gateway access from local networks"
''; '';
trustedInterfaces = [ "wg0" ];
}; };
}; };
services.resolved = { services.resolved = {

2
hosts/fujitsu/modules/jellyfin/default.nix
View file

@ -1,6 +1,6 @@
{ ... }: { ... }:
let let
domain = "media.vpn.rfive.de"; domain = "cinema.vpn.rfive.de";
in in
{ {
services.jellyfin = { services.jellyfin = {

2
hosts/thinkpad/modules/security/default.nix
View file

@ -18,8 +18,6 @@
cue = true; cue = true;
}; };
}; };
# fixes run0 failing to execute
services.systemd-run0 = { };
}; };
krb5 = { krb5 = {
enable = true; enable = true;

3
secrets.nix
View file

@ -3,6 +3,7 @@ let
nuc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH6pI2rVvnEMG7oHzA47NRahEKQj99pagrat+Q7pOT2v"; nuc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH6pI2rVvnEMG7oHzA47NRahEKQj99pagrat+Q7pOT2v";
falkenstein = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJxar1P+KXVPzHCaIcGg33Gvog+a5Z8snHWSFqbY3WC6"; falkenstein = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJxar1P+KXVPzHCaIcGg33Gvog+a5Z8snHWSFqbY3WC6";
rouven = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILkxTuzjS3EswMfj+wSKu9ciRyStvjDlDUXzkqEUGDaP"; rouven = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILkxTuzjS3EswMfj+wSKu9ciRyStvjDlDUXzkqEUGDaP";
fujitsu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGC8bPI3sl4l1Xy+/JdfU+3bXJT5sqmFwF+46s1PErr3";
in in
{ {
# thinkpad # thinkpad
@ -37,7 +38,9 @@ in
"secrets/falkenstein/borg/passphrase.age".publicKeys = [ rouven falkenstein ]; "secrets/falkenstein/borg/passphrase.age".publicKeys = [ rouven falkenstein ];
"secrets/falkenstein/borg/key.age".publicKeys = [ rouven falkenstein ]; "secrets/falkenstein/borg/key.age".publicKeys = [ rouven falkenstein ];
"secrets/falkenstein/dmarc.age".publicKeys = [ rouven falkenstein ]; "secrets/falkenstein/dmarc.age".publicKeys = [ rouven falkenstein ];
"secrets/falkenstein/acme-dns.age".publicKeys = [ rouven falkenstein ];
#shared #shared
"secrets/shared/maxmind.age".publicKeys = [ rouven nuc falkenstein ]; "secrets/shared/maxmind.age".publicKeys = [ rouven nuc falkenstein ];
"secrets/shared/acme-caddy.age".publicKeys = [ rouven nuc falkenstein fujitsu ];
} }

BIN
secrets/falkenstein/acme-dns.age Normal file
View file

Binary file not shown.

BIN
secrets/shared/acme-caddy.age Normal file
View file

Binary file not shown.

8
shared/caddy/default.nix
View file

@ -1,15 +1,21 @@
{ config, caddy-patched, ... }: { config, caddy-patched, ... }:
{ {
age.secrets.acme-caddy = {
file = ../../secrets/shared/acme-caddy.age;
owner = "caddy";
};
services.caddy = { services.caddy = {
enable = true; enable = true;
# package = caddy-patched.packages.x86_64-linux.default; package = caddy-patched.packages.x86_64-linux.default;
email = "ca@${config.networking.domain}"; email = "ca@${config.networking.domain}";
logFormat = "format console"; logFormat = "format console";
globalConfig = '' globalConfig = ''
servers { servers {
metrics metrics
} }
import ${config.age.secrets.acme-caddy.path}
''; '';
virtualHosts.":2018" = { virtualHosts.":2018" = {
extraConfig = '' extraConfig = ''
metrics metrics

2
shared/systemd.nix
View file

@ -1,6 +1,8 @@
{ pkgs, lib, ... }: { pkgs, lib, ... }:
{ {
# fixes run0 failing to execute
security.pam.services.systemd-run0 = { };
systemd = { systemd = {
# package = lib.mkDefault (nixpkgs-systemd-256.legacyPackages.x86_64-linux.systemd.override { withHomed = false; }); # package = lib.mkDefault (nixpkgs-systemd-256.legacyPackages.x86_64-linux.systemd.override { withHomed = false; });