rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-05-13 07:41:08 +02:00
Code Issues Projects Releases Packages Wiki Activity

caddy: enable dns challenges

Browse source
This commit is contained in:
Rouven Seifert 2025-05-11 16:49:43 +02:00
parent f8eee37e51
commit 0cf89b0ae4
10 changed files with 48 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

6
flake.lock generated
View file

@ -92,11 +92,11 @@
]
},
"locked": {
"lastModified": 1746901403,
"narHash": "sha256-2tkRHeNEkaE1x0ayfi30+nrIQv4Nio/NeT8U3i3qeQA=",
"lastModified": 1746905309,
"narHash": "sha256-m5sov8Pcj1PbCF3JmcPNTJC1FJVOEvFB1Bx9o35FiYw=",
"owner": "rouven0",
"repo": "nixos-caddy-patched",
"rev": "ad2df7623e62ee4595c8f523b30cf6914a2cb6bd",
"rev": "c65d3f16d1f821983a6a8de3aeeb00b05d142272",
"type": "github"
},
"original": {

49
hosts/falkenstein/modules/dns/default.nix
View file

@ -2,6 +2,12 @@
let
secondary = "185.181.104.96";
domain = config.networking.domain;
# fetches all VgetVirtualHosts from the caddy config
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts);
# generate CNAMES from caddy service to host
genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { CNAME = [ "${hostname}.${domain}." ]; });
# generate Bind config to allow dynamic updates
genKeyGrants = hostname: builtins.foldl' (x: y: x + "grant caddy name _acme-challenge." + y + ".${domain} txt;\n") "" (lib.lists.remove ":2018" (getVirtualHosts hostname));
zonefile = with dns.lib.combinators; pkgs.writeText "rfive.de.zone.txt" (dns.lib.toString domain {
TTL = 3600;
SOA =
@ -11,8 +17,8 @@ let
{
nameServer = "ns.rfive.de.";
adminEmail = "hostmaster@rfive.de";
# serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864));
serial = 2025051079;
serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864));
# serial = 2025051143;
refresh = 10800;
retry = 3600;
expire = 604800;
@ -37,12 +43,10 @@ let
subdomains =
let
# fetches all VgetVirtualHosts from the caddy config
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts);
# generate CNAMES from caddy service to host
genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { CNAME = [ "${hostname}.${domain}." ]; });
# generate ACME challenge recorsd for every VirtualHost
genACMECNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { subdomains._acme-challenge.CNAME = [ "challenge.acme.${domain}." ]; });
genACMECNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: {
subdomains._acme-challenge.CNAME = [ "challenge.acme.${domain}." ];
});
# fuckery to merge the generated attribute lists
mergeRecords = recordList: lib.attrsets.mapAttrs (_host: records: lib.attrsets.mergeAttrsList records) (lib.attrsets.zipAttrs recordList);
in
@ -62,21 +66,26 @@ let
mail = falkenstein;
_dmarc.TXT = [ "v=DMARC1; p=none; adkim=s; fo=1; rua=mailto:dmarc@rfive.de; ruf=mailto:dmarc@rfive.de" ];
_domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ];
"*".subdomains."_acme-challenge".CNAME = [ "challenge.acme.rfive.de" ];
}
(mergeRecords [
(builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ]))
])
(mergeRecords [
(builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
(builtins.removeAttrs (genACMECNAMEs "falkenstein") ([ ":2018" "mail" ]))
])
(builtins.removeAttrs (genACMECNAMEs "fujitsu") ([ ":2018" ]))
(builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
# (mergeRecords [
# (builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
# (builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ]))
# ])
# (mergeRecords [
# (builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
# (builtins.removeAttrs (genACMECNAMEs "falkenstein") ([ ":2018" "mail" ]))
# ])
# (builtins.removeAttrs (genACMECNAMEs "fujitsu") ([ ":2018" ]))
];
});
in
{
age.secrets.acme-dns = {
file = ../../../../secrets/falkenstein/acme-dns.age;
owner = "named";
};
services.bind = rec {
enable = true;
directory = "/var/lib/bind";
@ -89,6 +98,7 @@ in
publish-safety 1d;
retire-safety 1d;
};
include "${config.age.secrets.acme-dns.path}";
'';
zones = {
"rfive.de" = {
@ -102,7 +112,10 @@ in
inline-signing yes;
serial-update-method date;
update-policy {
grant caddy. name challenge.acme.rfive.de. txt;
grant caddy name _acme-challenge.cinema.vpn.rfive.de. txt;
${genKeyGrants "nuc"}
${genKeyGrants "falkenstein"}
${genKeyGrants "fujitsu"}
};
'';
file = "${directory}/rfive.de.zone.txt";

1
hosts/falkenstein/modules/networks/default.nix
View file

@ -28,6 +28,7 @@
extraInputRules = ''
ip saddr 192.168.0.0/16 tcp dport 19531 accept comment "Allow journald gateway access from local networks"
'';
trustedInterfaces = [ "wg0" ];
};
};
services.resolved = {

2
hosts/fujitsu/modules/jellyfin/default.nix
View file

@ -1,6 +1,6 @@
{ ... }:
let
domain = "media.vpn.rfive.de";
domain = "cinema.vpn.rfive.de";
in
{
services.jellyfin = {

2
hosts/thinkpad/modules/security/default.nix
View file

@ -18,8 +18,6 @@
cue = true;
};
};
# fixes run0 failing to execute
services.systemd-run0 = { };
};
krb5 = {
enable = true;

3
secrets.nix
View file

@ -3,6 +3,7 @@ let
nuc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH6pI2rVvnEMG7oHzA47NRahEKQj99pagrat+Q7pOT2v";
falkenstein = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJxar1P+KXVPzHCaIcGg33Gvog+a5Z8snHWSFqbY3WC6";
rouven = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILkxTuzjS3EswMfj+wSKu9ciRyStvjDlDUXzkqEUGDaP";
fujitsu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGC8bPI3sl4l1Xy+/JdfU+3bXJT5sqmFwF+46s1PErr3";
in
{
# thinkpad
@ -37,7 +38,9 @@ in
"secrets/falkenstein/borg/passphrase.age".publicKeys = [ rouven falkenstein ];
"secrets/falkenstein/borg/key.age".publicKeys = [ rouven falkenstein ];
"secrets/falkenstein/dmarc.age".publicKeys = [ rouven falkenstein ];
"secrets/falkenstein/acme-dns.age".publicKeys = [ rouven falkenstein ];
#shared
"secrets/shared/maxmind.age".publicKeys = [ rouven nuc falkenstein ];
"secrets/shared/acme-caddy.age".publicKeys = [ rouven nuc falkenstein fujitsu ];
}

BIN
secrets/falkenstein/acme-dns.age Normal file
View file

Binary file not shown.

BIN
secrets/shared/acme-caddy.age Normal file
View file

Binary file not shown.

8
shared/caddy/default.nix
View file

@ -1,15 +1,21 @@
{ config, caddy-patched, ... }:
{
age.secrets.acme-caddy = {
file = ../../secrets/shared/acme-caddy.age;
owner = "caddy";
};
services.caddy = {
enable = true;
# package = caddy-patched.packages.x86_64-linux.default;
package = caddy-patched.packages.x86_64-linux.default;
email = "ca@${config.networking.domain}";
logFormat = "format console";
globalConfig = ''
servers {
metrics
}
import ${config.age.secrets.acme-caddy.path}
'';
virtualHosts.":2018" = {
extraConfig = ''
metrics

2
shared/systemd.nix
View file

@ -1,6 +1,8 @@
{ pkgs, lib, ... }:
{
# fixes run0 failing to execute
security.pam.services.systemd-run0 = { };
systemd = {
# package = lib.mkDefault (nixpkgs-systemd-256.legacyPackages.x86_64-linux.systemd.override { withHomed = false; });