jory
4ee5658053
Added network-online.target to after and wants arrays to ensure CoreDNS service starts only after network is available. This prevents service failures due to missing DNS resolution during system boot.
137 lines
5.9 KiB
Nix
137 lines
5.9 KiB
Nix
{pkgs, ...}: let
|
|
zoneFile = pkgs.writeText "severijnse.eu.db" ''
|
|
$ORIGIN severijnse.eu.
|
|
$TTL 3600
|
|
severijnse.eu. 3600 IN SOA ns1.severijnse.eu. abuse.severijnse.eu. 2026071003 3600 1800 1209600 86400
|
|
IN NS ns1.severijnse.eu.
|
|
IN NS ns2.severijnse.eu.
|
|
|
|
@ IN A 49.13.92.205
|
|
www IN A 49.13.92.205
|
|
ns1 IN A 49.13.92.205
|
|
ns2 IN A 49.13.92.205
|
|
mail IN A 49.13.92.205
|
|
|
|
@ IN AAAA 2a01:4f8:c014:2585::1
|
|
www IN AAAA 2a01:4f8:c014:2585::1
|
|
ns1 IN AAAA 2a01:4f8:c014:2585::1
|
|
ns2 IN AAAA 2a01:4f8:c014:2585::1
|
|
mail IN AAAA 2a01:4f8:c014:2585::1
|
|
|
|
*.severijnse.eu. IN A 49.13.92.205
|
|
*.severijnse.eu. IN AAAA 2a01:4f8:c014:2585::1
|
|
|
|
@ IN MX 10 mail.severijnse.eu.
|
|
|
|
mail._domainkey.severijnse.eu. 300 IN TXT (
|
|
"v=DKIM1; k=rsa; "
|
|
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAskpG7m4kninxRE4JF5KzpnBhLbOlGJL2RO/iDfzdz6sHEvxe78q9c5UnZ0OQddOSuQo4q48dJkXR/XzqY7Ak109lhoAx+Kr1neYsi8/"
|
|
"JaoTC8OURk365+/aBSmWXUCCBphCx43QWfC9h8GMQ6PUIqawkz5CcGPT7X7hPdwHQcd5Vn3CqmABptxdwshdkBjZs"
|
|
"oi79BOo9ZrQSTY7iiLcOP7hVVC9Ad+ydlZ4MWGfy5BxgyTGrrtuSuLcM219oqdovIvr2EtXs8AMx5fyXplKE3R/"
|
|
"YlwF2Jcy50Gmb5y/E9pOaFjVv8HXUmKsvuhA2b8K+rt0WVHNc3dvbgZUl8bGAQIDAQAB"
|
|
)
|
|
_dmarc.severijnse.eu. IN TXT "v=DMARC1; p=reject; rua=mailto:abuse@severijnse.eu"
|
|
severijnse.eu. IN TXT "v=spf1 mx ip4:49.13.92.205 -all"
|
|
|
|
default._bimi.severijnse.eu. IN TXT "v=BIMI1; l=https://severijnse.eu/logo.svg; avp=personal;"
|
|
|
|
severijnse.eu. IN CAA 0 issue "letsencrypt.org"
|
|
severijnse.eu. IN CAA 0 issuewild "letsencrypt.org"
|
|
severijnse.eu. IN CAA 0 iodef "mailto:abuse@severijnse.eu"
|
|
|
|
_smtp._tls.severijnse.eu. IN TXT "v=TLSRPTv1; rua=mailto:abuse@severijnse.eu"
|
|
_mta-sts.severijnse.eu. IN TXT "v=STSv1; id=2024120501"
|
|
|
|
severijnse.eu. 300 IN TXT "google-site-verification=H0HHB7zNQ10uom1zH5f8CEtHcVVcWiuu41ZQv348T5U"
|
|
|
|
; TLSA records updated dynamically by mail-cert-sync service.
|
|
; The placeholders below mirror the current live certificate so the zone is
|
|
; correct even if the sync service has not yet run (e.g. a failed boot).
|
|
_25._tcp.mail.severijnse.eu. 3600 IN TLSA 3 1 1 15ec4d8823874c8363af004188338f76e6e6c5878faf25cdf40556b44b26677d
|
|
_465._tcp.mail.severijnse.eu. 3600 IN TLSA 3 1 1 15ec4d8823874c8363af004188338f76e6e6c5878faf25cdf40556b44b26677d
|
|
_993._tcp.mail.severijnse.eu. 3600 IN TLSA 3 1 1 15ec4d8823874c8363af004188338f76e6e6c5878faf25cdf40556b44b26677d
|
|
|
|
severijnse.eu. IN DS 20930 13 2 B0D9B13DCE5FA0D41589239EB5166D124B0C9D3060A538726DDCCBFC91E8DBD8
|
|
|
|
@ IN DNSKEY 257 3 13 kOc88RGHKdWa7YLjNs7mljux7cT9/9wVNgcp+8jaVe6zle4cHAk6+Sub9wKEVa7Q4FlQYzS1KFL2HOW05Azq1A==
|
|
@ IN DNSKEY 256 3 13 QTFplRlXes5NExKLvuCJmX0l8FhulFNS+sJw+pvcAq4+0T3cCzT6hmcJPjd4BVl6KvvyS78Vij2f7HjrcjyHfw==
|
|
@ IN CDS 20930 13 2 B0D9B13DCE5FA0D41589239EB5166D124B0C9D3060A538726DDCCBFC91E8DBD8
|
|
@ IN CDNSKEY 257 3 13 kOc88RGHKdWa7YLjNs7mljux7cT9/9wVNgcp+8jaVe6zle4cHAk6+Sub9wKEVa7Q4FlQYzS1KFL2HOW05Azq1A==
|
|
|
|
severijnse.eu IN SSHFP 1 1 7f5235b2997e0c621fe773acaaae45b9551049ce
|
|
severijnse.eu IN SSHFP 1 2 2ec1d37df094915253c0b059762052ae19e66cd97e82d7a58ac1a0d1bd5d5e52
|
|
severijnse.eu IN SSHFP 3 1 240418eb7cc2a3969257c30363d16103dbfd5822
|
|
severijnse.eu IN SSHFP 3 2 43dbfdd8b131efda4c98844e1434e4f35e773f472bdb355ede94f8a9f7001c35
|
|
severijnse.eu IN SSHFP 4 1 efbd7836208684d110f3a72543eba74ad8e54b44
|
|
severijnse.eu IN SSHFP 4 2 c02f4b13aef78579f3466851fcc741c0169eaa63237463ceacc9bb72a2be0519
|
|
'';
|
|
in {
|
|
systemd = {
|
|
services = {
|
|
decrypt-coredns-keys = {
|
|
description = "Decrypt CoreDNS DNSSEC signing keys";
|
|
before = ["coredns.service"];
|
|
wantedBy = ["coredns.service"];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
Environment = "SOPS_AGE_KEY_FILE=/etc/age/keys.txt";
|
|
};
|
|
script = ''
|
|
SOPS_FILE=${../../secrets/coredns-keys.yaml}
|
|
KEYS_DIR=/var/lib/coredns/keys
|
|
mkdir -p "$KEYS_DIR"
|
|
|
|
${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.key"
|
|
${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.private"
|
|
${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.key"
|
|
${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.private"
|
|
|
|
chmod 644 "$KEYS_DIR/"*
|
|
'';
|
|
};
|
|
coredns = {
|
|
after = ["decrypt-coredns-keys.service" "network-online.target"];
|
|
wants = ["network-online.target"];
|
|
requires = ["decrypt-coredns-keys.service"];
|
|
|
|
# Copy zone file from Nix store to writable location on service start
|
|
# TLSA updater will modify the writable copy at runtime
|
|
preStart = ''
|
|
cp -f ${zoneFile} /var/lib/coredns/zones/severijnse.eu.db
|
|
chown coredns:coredns /var/lib/coredns/zones/severijnse.eu.db
|
|
'';
|
|
};
|
|
};
|
|
tmpfiles.rules = [
|
|
"d /var/lib/coredns 0750 coredns coredns -"
|
|
"d /var/lib/coredns/zones 0750 coredns coredns -"
|
|
"d /var/lib/coredns/keys 0750 coredns coredns -"
|
|
];
|
|
};
|
|
services.coredns = {
|
|
enable = true;
|
|
config = ''
|
|
severijnse.eu {
|
|
bind 127.0.0.1 49.13.92.205 2a01:4f8:c014:2585::1
|
|
file /var/lib/coredns/zones/severijnse.eu.db {
|
|
reload 300s
|
|
}
|
|
dnssec {
|
|
key file /var/lib/coredns/keys/Kseverijnse.eu.+013+38678
|
|
key file /var/lib/coredns/keys/Kseverijnse.eu.+013+20930
|
|
}
|
|
log
|
|
errors
|
|
}
|
|
|
|
. {
|
|
bind 127.0.0.1
|
|
forward . 1.1.1.1 8.8.8.8
|
|
log
|
|
errors
|
|
}
|
|
'';
|
|
};
|
|
}
|