rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-01-18 17:11:39 +01:00
Code Issues Projects Releases Packages Wiki Activity

dns: switch to dns.nix

Browse source
This commit is contained in:
Rouven Seifert 2024-04-17 22:04:08 +02:00
parent eacec7d6ff
commit d14f499783
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
3 changed files with 87 additions and 47 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
flake.lock
View file

@ -96,6 +96,27 @@
"type": "github"
}
},
"dns": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1635273082,
"narHash": "sha256-EHiDP2jEa7Ai5ZwIf5uld9RVFcV77+2SUxjQXwJsJa0=",
"owner": "nix-community",
"repo": "dns.nix",
"rev": "c7b9645da9c0ddce4f9de4ef27ec01bb8108039a",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "dns.nix",
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
@ -134,6 +155,21 @@
}
},
"flake-utils": {
"locked": {
"lastModified": 1614513358,
"narHash": "sha256-LakhOx3S1dRjnh0b5Dg3mbZyH0ToC9I8Y2wKSkBaTzU=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "5466c5bbece17adaab2d82fae80b46e807611bf3",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
},
@ -233,7 +269,7 @@
"crane": "crane",
"flake-compat": "flake-compat",
"flake-parts": "flake-parts",
"flake-utils": "flake-utils",
"flake-utils": "flake-utils_2",
"nixpkgs": [
"nixpkgs"
],
@ -432,6 +468,7 @@
"root": {
"inputs": {
"agenix": "agenix",
"dns": "dns",
"home-manager": "home-manager",
"impermanence": "impermanence",
"lanzaboote": "lanzaboote",

10
flake.nix
View file

@ -18,9 +18,12 @@
impermanence.url = "github:nix-community/impermanence";
home-manager = {
inputs = {
nixpkgs.follows = "nixpkgs";
};
inputs.nixpkgs.follows = "nixpkgs";
};
dns = {
url = "github:nix-community/dns.nix";
inputs.nixpkgs.follows = "nixpkgs";
};
nix-colors.url = "github:Misterio77/nix-colors";
@ -56,6 +59,7 @@
{ self
, nixpkgs
, home-manager
, dns
, nix-index-database
, agenix
, impermanence

85
hosts/falkenstein/modules/dns/default.nix
View file

@ -1,53 +1,52 @@
{ pkgs, config, ... }:
{ pkgs, lib, config, dns, ... }:
let
secondary = "185.181.104.96";
zonefile = pkgs.writeText "rfive.de.zone.txt" ''
$TTL 3600
$ORIGIN rfive.de.
zonefile = with dns.lib.combinators; pkgs.writeText "rfive.de.zone.txt" (dns.lib.toString "rfive.de" {
TTL = 3600;
SOA = {
nameServer = "ns.rfive.de.";
adminEmail = "hostmaster@rfive.de";
serial = 2024041709;
refresh = 10800;
retry = 3600;
expire = 604800;
minimum = 3600;
};
NS = [
"ns.inwx.de."
"ns2.inwx.de."
"ns3.inxw.eu."
];
A = [ "23.88.121.184" ];
AAAA = [ "2a01:4f8:c012:49de::1" ];
rfive.de. 86400 IN SOA ns.rfive.de. hostmaster.rfive.de. (
2024040800 ; serial
10800 ; refresh
3600 ; retry
604800 ; expire
3600 ) ; negatives caching, ehem. minimum
CAA = letsEncrypt "ca@rfive.de";
@ NS ns.inwx.de.
@ NS ns2.inwx.de.
@ NS ns3.inwx.eu.
MX = [{ preference = 1; exchange = "mail.rfive.de."; }];
@ A 23.88.121.184
@ AAAA 2a01:4f8:c012:49de::1
TXT = [
(spf.soft [ "mx" ])
];
@ CAA 0 iodef "mailto:ca@rfive.de"
@ CAA 0 issue "letsencrypt.org"
@ CAA 0 issuewild ";"
subdomains = lib.attrsets.mergeAttrsList [
rec {
nuc = {
A = [ "141.30.227.6" ];
};
falkenstein = {
A = [ "23.88.121.184" ];
AAAA = [ "2a01:4f8:c012:49de::1" ];
};
ns = falkenstein;
mail = falkenstein;
_dmarc.TXT = [ "v=DMARC1; p=none; adkim=s; fo=1; rua=mailto:dmarc@rfive.de; ruf=mailto:dmarc@rfive.de" ];
_domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ];
ns A 23.88.121.184
ns AAAA 2a01:4f8:c012:49de::1
nuc A 141.30.227.6
falkenstein A 23.88.121.184
falkenstein AAAA 2a01:4f8:c012:49de::1
@ MX 1 mail.rfive.de.
mail A 23.88.121.184
mail AAAA 2a01:4f8:c012:49de::1
@ TXT "v=spf1 mx ~all"
rspamd._domainkey TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB"
_dmarc TXT "v=DMARC1; p=none; adkim=s; fo=1; rua=mailto:dmarc@rfive.de; ruf=mailto:dmarc@rfive.de"
cache CNAME nuc.rfive.de.
chat CNAME nuc.rfive.de.
matrix CNAME nuc.rfive.de.
seafile CNAME nuc.rfive.de.
vault CNAME nuc.rfive.de.
purge CNAME falkenstein.rfive.de.
rspamd CNAME falkenstein.rfive.de.
trucks CNAME falkenstein.rfive.de.
'';
}
(lib.attrsets.genAttrs [ "cache" "chat" "matrix" "seafile" "vault" ] (label: { CNAME = [ "nuc.rfive.de." ]; }))
(lib.attrsets.genAttrs [ "purge" "rspamd" "trucks" ] (label: { CNAME = [ "falkenstein.rfive.de." ]; }))
];
});
in
{
services.bind = rec {