fix certs for darkkirb.de #594
6 changed files with 5 additions and 247 deletions
|
|
@ -9,6 +9,9 @@
|
||||||
certs."darkkirb.de" = {
|
certs."darkkirb.de" = {
|
||||||
domain = "*.darkkirb.de";
|
domain = "*.darkkirb.de";
|
||||||
extraDomainNames = ["darkkirb.de"];
|
extraDomainNames = ["darkkirb.de"];
|
||||||
|
dnsProvider = "gcloud";
|
||||||
|
credentialsFile = config.sops.secrets."security/acme/gcloud".path;
|
||||||
|
dnsResolver = "1.1.1.1:53";
|
||||||
};
|
};
|
||||||
certs."chir.rs" = {
|
certs."chir.rs" = {
|
||||||
domain = "*.chir.rs";
|
domain = "*.chir.rs";
|
||||||
|
|
|
||||||
|
|
@ -13,10 +13,8 @@ in {
|
||||||
services.bind = {
|
services.bind = {
|
||||||
enable = true;
|
enable = true;
|
||||||
zones = {
|
zones = {
|
||||||
"darkkirb.de" = mkZone "darkkirb.de";
|
|
||||||
"chir.rs" = mkZone "chir.rs";
|
"chir.rs" = mkZone "chir.rs";
|
||||||
"int.chir.rs" = mkZone "int.chir.rs";
|
"int.chir.rs" = mkZone "int.chir.rs";
|
||||||
"shitallover.me" = mkZone "shitallover.me";
|
|
||||||
};
|
};
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
statistics-channels {
|
statistics-channels {
|
||||||
|
|
|
||||||
|
|
@ -4,7 +4,6 @@
|
||||||
dns,
|
dns,
|
||||||
...
|
...
|
||||||
}: let
|
}: let
|
||||||
darkkirb-de = import ../../zones/darkkirb.de.nix {inherit dns;};
|
|
||||||
chir-rs = import ../../zones/chir.rs.nix {inherit dns;};
|
chir-rs = import ../../zones/chir.rs.nix {inherit dns;};
|
||||||
int-chir-rs = import ../../zones/int.chir.rs.nix {inherit dns;};
|
int-chir-rs = import ../../zones/int.chir.rs.nix {inherit dns;};
|
||||||
signzone = import ../../zones/signzone.nix;
|
signzone = import ../../zones/signzone.nix;
|
||||||
|
|
@ -24,33 +23,11 @@ in {
|
||||||
zone = int-chir-rs;
|
zone = int-chir-rs;
|
||||||
zonename = "int.chir.rs";
|
zonename = "int.chir.rs";
|
||||||
})
|
})
|
||||||
(signzone {
|
|
||||||
inherit dns;
|
|
||||||
ksk = "services/dns/de/darkkirb/53136";
|
|
||||||
zsk = "services/dns/de/darkkirb/61825";
|
|
||||||
zone = darkkirb-de;
|
|
||||||
zonename = "darkkirb.de";
|
|
||||||
})
|
|
||||||
];
|
];
|
||||||
|
|
||||||
services.bind = {
|
services.bind = {
|
||||||
enable = true;
|
enable = true;
|
||||||
zones = {
|
zones = {
|
||||||
"darkkirb.de" = {
|
|
||||||
master = true;
|
|
||||||
file = "/var/lib/named/darkkirb.de";
|
|
||||||
slaves = ["fd7a:115c:a1e0:ab12:4843:cd96:6263:ad6b" "100.99.173.107"];
|
|
||||||
extraConfig = "also-notify {fd7a:115c:a1e0:ab12:4843:cd96:6263:ad6b; 100.99.173.107;};";
|
|
||||||
};
|
|
||||||
"_acme-challenge.darkkirb.de" = {
|
|
||||||
master = true;
|
|
||||||
file = "/var/lib/named/_acme-challenge.darkkirb.de";
|
|
||||||
extraConfig = ''
|
|
||||||
update-policy {
|
|
||||||
grant certbot. name _acme-challenge.darkkirb.de. txt;
|
|
||||||
};
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
"chir.rs" = {
|
"chir.rs" = {
|
||||||
master = true;
|
master = true;
|
||||||
file = "/var/lib/named/chir.rs";
|
file = "/var/lib/named/chir.rs";
|
||||||
|
|
|
||||||
|
|
@ -144,15 +144,13 @@ with dns.lib.combinators; let
|
||||||
SOA = {
|
SOA = {
|
||||||
nameServer = "ns1.chir.rs.";
|
nameServer = "ns1.chir.rs.";
|
||||||
adminEmail = "lotte@chir.rs";
|
adminEmail = "lotte@chir.rs";
|
||||||
serial = 55;
|
serial = 56;
|
||||||
};
|
};
|
||||||
NS = [
|
NS = [
|
||||||
"ns1.chir.rs."
|
"ns1.chir.rs."
|
||||||
"ns2.chir.rs."
|
"ns2.chir.rs."
|
||||||
"ns3.chir.rs."
|
"ns3.chir.rs."
|
||||||
"ns4.chir.rs."
|
"ns4.chir.rs."
|
||||||
"ns1.darkkirb.de."
|
|
||||||
"ns2.darkkirb.de."
|
|
||||||
];
|
];
|
||||||
MX = [
|
MX = [
|
||||||
(ttl zoneTTL (mx.mx 10 "mx.zoho.eu."))
|
(ttl zoneTTL (mx.mx 10 "mx.zoho.eu."))
|
||||||
|
|
|
||||||
|
|
@ -1,216 +0,0 @@
|
||||||
{
|
|
||||||
dns ? (import (builtins.fetchTarball "https://github.com/DarkKirb/dns.nix/archive/master.zip")).outputs,
|
|
||||||
zoneTTL ? 3600,
|
|
||||||
}:
|
|
||||||
with dns.lib.combinators; let
|
|
||||||
inherit (builtins) hasAttr;
|
|
||||||
merge = a: b:
|
|
||||||
(a // b)
|
|
||||||
// (
|
|
||||||
if ((hasAttr "subdomains" a) && (hasAttr "subdomains" b))
|
|
||||||
then {subdomains = a.subdomains // b.subdomains;}
|
|
||||||
else {}
|
|
||||||
);
|
|
||||||
oracleBase = {
|
|
||||||
A = [
|
|
||||||
(ttl zoneTTL (a "130.162.60.127"))
|
|
||||||
];
|
|
||||||
AAAA = [
|
|
||||||
(ttl zoneTTL (aaaa "2603:c020:8009:f100:f09a:894d:ef57:a278"))
|
|
||||||
];
|
|
||||||
SSHFP = [
|
|
||||||
{
|
|
||||||
algorithm = "rsa";
|
|
||||||
mode = "sha1";
|
|
||||||
fingerprint = "b44a837703b22d8cbc2ca4e7019af4bcb0185348";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
algorithm = "rsa";
|
|
||||||
mode = "sha256";
|
|
||||||
fingerprint = "8f276ce01188fdd2bbf2aaa03d477c58c911a6c1f9bee3f8ab35ca4b42aa19a9";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
algorithm = "ed25519";
|
|
||||||
mode = "sha1";
|
|
||||||
fingerprint = "8dfd784c5f239822b086dc4fa7c058f260331e5d";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
algorithm = "ed25519";
|
|
||||||
mode = "sha256";
|
|
||||||
fingerprint = "82d51bd3ab43af3b94801c6b68812c4f1db013ac5b53a466fbcdbb955de6d3e5";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
HTTPS = [
|
|
||||||
{
|
|
||||||
svcPriority = 1;
|
|
||||||
targetName = ".";
|
|
||||||
alpn = ["http/1.1" "h2" "h3"];
|
|
||||||
ipv4hint = ["130.162.60.127"];
|
|
||||||
ipv6hint = ["2603:c020:8009:f100:f09a:894d:ef57:a278"];
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
zoneBase = {
|
|
||||||
A = [
|
|
||||||
(ttl zoneTTL (a "138.201.155.128"))
|
|
||||||
];
|
|
||||||
AAAA = [
|
|
||||||
(ttl zoneTTL (aaaa "2a01:4f8:1c17:d953:b4e1:8ff:e658:6f49"))
|
|
||||||
];
|
|
||||||
SSHFP = [
|
|
||||||
{
|
|
||||||
algorithm = "rsa";
|
|
||||||
mode = "sha1";
|
|
||||||
fingerprint = "97b910c37194cd98e7edca2d68104f4531721c22";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
algorithm = "rsa";
|
|
||||||
mode = "sha256";
|
|
||||||
fingerprint = "7915470f9275116889d5ca1fdbea20416d8372636c3d63653b272308608cf70f";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
algorithm = "ed25519";
|
|
||||||
mode = "sha1";
|
|
||||||
fingerprint = "1aff467e745a8d68ba032dd3d54597e10d31ccf8";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
algorithm = "ed25519";
|
|
||||||
mode = "sha256";
|
|
||||||
fingerprint = "e6dcdb73dc381ee2b354528cdaf8552364e75c34316d7e0c9819801daea5c951";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
HTTPS = [
|
|
||||||
{
|
|
||||||
svcPriority = 1;
|
|
||||||
targetName = ".";
|
|
||||||
alpn = ["http/1.1" "h2" "h3"];
|
|
||||||
ipv4hint = ["138.201.155.128"];
|
|
||||||
ipv6hint = ["2a01:4f8:1c17:d953:b4e1:8ff:e658:6f49"];
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
CAA = [
|
|
||||||
{
|
|
||||||
issuerCritical = false;
|
|
||||||
tag = "issue";
|
|
||||||
value = "letsencrypt.org";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
issuerCritical = false;
|
|
||||||
tag = "issuewild";
|
|
||||||
value = "letsencrypt.org";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
issuerCritical = false;
|
|
||||||
tag = "iodef";
|
|
||||||
value = "mailto:lotte@chir.rs";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
createZone = merge zoneBase;
|
|
||||||
zone = createZone {
|
|
||||||
SOA = {
|
|
||||||
nameServer = "ns1.darkkirb.de.";
|
|
||||||
adminEmail = "lotte@chir.rs";
|
|
||||||
serial = 5;
|
|
||||||
};
|
|
||||||
NS = [
|
|
||||||
"ns1.chir.rs."
|
|
||||||
"ns2.chir.rs."
|
|
||||||
"ns3.chir.rs."
|
|
||||||
"ns4.chir.rs."
|
|
||||||
"ns1.darkkirb.de."
|
|
||||||
"ns2.darkkirb.de."
|
|
||||||
];
|
|
||||||
MX = [
|
|
||||||
(ttl zoneTTL (mx.mx 10 "mail.chir.rs."))
|
|
||||||
];
|
|
||||||
SRV = [
|
|
||||||
{
|
|
||||||
service = "submission";
|
|
||||||
proto = "tcp";
|
|
||||||
port = 587;
|
|
||||||
target = "mail.chir.rs.";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
service = "imap";
|
|
||||||
proto = "tcp";
|
|
||||||
port = 143;
|
|
||||||
target = "mail.chir.rs.";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
service = "imaps";
|
|
||||||
proto = "tcp";
|
|
||||||
port = 993;
|
|
||||||
target = "mail.chir.rs.";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
service = "pop3";
|
|
||||||
proto = "tcp";
|
|
||||||
port = 110;
|
|
||||||
target = "mail.chir.rs.";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
service = "pop3s";
|
|
||||||
proto = "tcp";
|
|
||||||
port = 995;
|
|
||||||
target = "mail.chir.rs.";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
TXT = [
|
|
||||||
(ttl zoneTTL (txt "v=spf1 ip4:138.201.155.128 ip6:2a01:4f8:1c17:d953/64 -all"))
|
|
||||||
(ttl zoneTTL (txt "google-site-verification=f2XWRDvD4F99pM7ux7sMtVJ9ZGtjKRLI_rfcO2IWIMI"))
|
|
||||||
];
|
|
||||||
DNSKEY = [
|
|
||||||
{
|
|
||||||
flags.zoneSigningKey = true;
|
|
||||||
flags.secureEntryPoint = true;
|
|
||||||
algorithm = "ecdsap256sha256";
|
|
||||||
publicKey = "FZklP7KowbXVjfkT5ndAE60QFvaKoghhLY2TavukRBGFA8pyGm+ce9QHekbrjE14q8sb5x0uXl4VdyDIUNZ3XQ==";
|
|
||||||
ttl = zoneTTL;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
flags.zoneSigningKey = true;
|
|
||||||
algorithm = "ecdsap256sha256";
|
|
||||||
publicKey = "WH9JM7Qvi2Hz3bCp7O5/WFLNdKUA/2aUkQqByfhaItfqoAm+hw6x4Qj8+umu5EDyo2A/HD/h9b/eO3zVq6pebw==";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
subdomains = {
|
|
||||||
_dmarc.TXT = [
|
|
||||||
(ttl zoneTTL (txt "v=DMARC1; p=quarantine; rua=mailto:dmarc@chir.rs; ruf=dmarc@chir.rs; fo=1; adkim=s; aspf=s; sp=reject;"))
|
|
||||||
];
|
|
||||||
_domainkey.subdomains = {
|
|
||||||
dkim.TXT = [
|
|
||||||
(ttl zoneTTL (txt "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDk4XK4c7xWGIalV+yTj5F8B2eXOeFtp0p9VNMlG/dZMv1GGS9hUBEkZOOYhAuE2GhKhHsGtxMalGAIbCqJJglVBLTxDerPGLRAsgZ9EZCyhIh9ebOqv0SfhTfdoz6RZkNrB2DK4nnvzaOa0NQzp+a8a5pAN6niDFBbTF3FFBwkOQIDAQAB"))
|
|
||||||
];
|
|
||||||
mail.TXT = [
|
|
||||||
(ttl zoneTTL (txt "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHmbBT9OJwDu5x7C2C/WhzeHirrxAlLwuh8Z9q7UBGS98MsLbS1NnCvZic4N3H/z80RHABF9KFhvJWy60NhM+UKWDEYSlgc8Z3KJZjuqOCUsajjf2cdhaTOKLbu57388tjghBD0cpK3mdqPU5aw2GY4jJR4YC4c0fqJ6vRTvyOSwIDAQAB"))
|
|
||||||
];
|
|
||||||
};
|
|
||||||
_keybase.TXT = [
|
|
||||||
(ttl zoneTTL (txt "keybase-site-verification=9DC6G-moMF8zfcm7_lpjhh2cvT9gL4hHV5yQqf_RgBk"))
|
|
||||||
];
|
|
||||||
_acme-challenge = delegateTo [
|
|
||||||
"ns1.chir.rs."
|
|
||||||
"ns2.chir.rs."
|
|
||||||
];
|
|
||||||
www = createZone {};
|
|
||||||
static = createZone {};
|
|
||||||
ns1 = createZone {};
|
|
||||||
ns2 = createZone oracleBase;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
in
|
|
||||||
zone
|
|
||||||
|
|
@ -15,15 +15,13 @@ in {
|
||||||
SOA = {
|
SOA = {
|
||||||
nameServer = "ns1.chir.rs.";
|
nameServer = "ns1.chir.rs.";
|
||||||
adminEmail = "lotte@chir.rs";
|
adminEmail = "lotte@chir.rs";
|
||||||
serial = 38;
|
serial = 39;
|
||||||
};
|
};
|
||||||
NS = [
|
NS = [
|
||||||
"ns1.chir.rs."
|
"ns1.chir.rs."
|
||||||
"ns2.chir.rs."
|
"ns2.chir.rs."
|
||||||
"ns3.chir.rs."
|
"ns3.chir.rs."
|
||||||
"ns4.chir.rs."
|
"ns4.chir.rs."
|
||||||
"ns1.darkkirb.de."
|
|
||||||
"ns2.darkkirb.de."
|
|
||||||
];
|
];
|
||||||
DNSKEY = [
|
DNSKEY = [
|
||||||
{
|
{
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue