rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-05-13 15:51:09 +02:00
Code Issues Projects Releases Packages Wiki Activity

dns fuckery

Browse source
This commit is contained in:
Rouven Seifert 2025-05-10 20:17:40 +02:00
parent 5f43998de8
commit f8eee37e51
12 changed files with 62 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hosts/falkenstein/modules/caddy/default.nix
View file

@ -1,4 +1,4 @@
{ config, ... }:
{ config, caddy-patched, ... }:
let
# matrix homeserver discovery
matrix_domain = "matrix.${config.networking.domain}";

23
hosts/falkenstein/modules/dns/default.nix
View file

@ -11,7 +11,8 @@ let
{
nameServer = "ns.rfive.de.";
adminEmail = "hostmaster@rfive.de";
serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864));
# serial = lib.strings.toInt (builtins.substring 0 8 self.sourceInfo.lastModifiedDate + toString ((modulo self.sourceInfo.lastModified 86400) / 864));
serial = 2025051079;
refresh = 10800;
retry = 3600;
expire = 604800;
@ -36,9 +37,14 @@ let
subdomains =
let
# fetches all VgetVirtualHosts from the caddy config
getVirtualHosts = hostname: map (name: builtins.substring 0 (builtins.stringLength name - (builtins.stringLength domain + 1)) name) (builtins.attrNames self.nixosConfigurations."${hostname}".config.services.caddy.virtualHosts);
# generate CNAMES from caddy service to host
genCNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { CNAME = [ "${hostname}.${domain}." ]; });
# generate ACME challenge recorsd for every VirtualHost
genACMECNAMEs = hostname: lib.attrsets.genAttrs (getVirtualHosts hostname) (_label: { subdomains._acme-challenge.CNAME = [ "challenge.acme.${domain}." ]; });
# fuckery to merge the generated attribute lists
mergeRecords = recordList: lib.attrsets.mapAttrs (_host: records: lib.attrsets.mergeAttrsList records) (lib.attrsets.zipAttrs recordList);
in
lib.attrsets.mergeAttrsList [
rec {
@ -58,9 +64,15 @@ let
_domainkey.subdomains.rspamd.TXT = [ "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoirUMubro4nlmY6a8JMwK9QB2agAXiJzexDU/7ba6KCggONfoSTfUHlrM/XeM1GG/9oKpngApxDPP97adJuxc8/EELyo4HjTyYD8GBFZhg0AN7V8IPaJ1o5k6dGDk8ZLh41ZCnlAVWkhVSKs5pYtzkrlJIfUSzyuoe8nuFsVe3QIDAQAB" ];
"*".subdomains."_acme-challenge".CNAME = [ "challenge.acme.rfive.de" ];
}
(builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ]))
(builtins.removeAttrs (genCNAMEs "falkenstein") [ "mail" ":2018" ])
(mergeRecords [
(builtins.removeAttrs (genCNAMEs "nuc") ([ ":2018" ] ++ (builtins.filter (host: lib.strings.hasInfix "vpn" host) (getVirtualHosts "nuc"))))
(builtins.removeAttrs (genACMECNAMEs "nuc") ([ ":2018" ]))
])
(mergeRecords [
(builtins.removeAttrs (genCNAMEs "falkenstein") ([ ":2018" "mail" ]))
(builtins.removeAttrs (genACMECNAMEs "falkenstein") ([ ":2018" "mail" ]))
])
(builtins.removeAttrs (genACMECNAMEs "fujitsu") ([ ":2018" ]))
];
});
in
@ -89,6 +101,9 @@ in
dnssec-policy split-keys;
inline-signing yes;
serial-update-method date;
update-policy {
grant caddy. name challenge.acme.rfive.de. txt;
};
'';
file = "${directory}/rfive.de.zone.txt";
};