diff options
Diffstat (limited to '')
| -rw-r--r-- | zones/default.nix | 1 | ||||
| -rw-r--r-- | zones/jaki.li/zone.nix | 149 |
2 files changed, 150 insertions, 0 deletions
diff --git a/zones/default.nix b/zones/default.nix index babb531..b143a06 100644 --- a/zones/default.nix +++ b/zones/default.nix @@ -1,3 +1,4 @@ {lib, ...}: { "vhack.eu" = import ./vhack.eu/zone.nix {inherit lib;}; + "jaki.li" = import ./jaki.li/zone.nix {inherit lib;}; } diff --git a/zones/jaki.li/zone.nix b/zones/jaki.li/zone.nix new file mode 100644 index 0000000..ae28d56 --- /dev/null +++ b/zones/jaki.li/zone.nix @@ -0,0 +1,149 @@ +{lib, ...}: let + /* + Computes a reasonable value for the DNS serial number from the date of last change + and the iteration of that day. + + # Type + + mkSerial :: Number -> Number -> Number -> Number -> Number + + # Arguments + + year + : The year of the last change in the format YYYY. + + month + : The month of the last change in the format MM. + + day + : The day of the last change in the format DD. + + iteration + : The number of change on that day. The format should be CC (assuming there are less + than 100 changes happening on a day) . + + # Examples + + mkSerial 2025 04 01 01 + => 2025040101 + */ + mkSerial = year: month: day: iteration: let + n2 = lib.strings.fixedWidthNumber 2; + n4 = lib.strings.fixedWidthNumber 4; + in + lib.strings.toIntBase10 "${n4 year}${n2 month}${n2 day}${n2 iteration}"; +in { + SOA = { + nameServer = "name-server1.vhack.eu."; + adminEmail = "dns-admin@foss-syndicate.org"; + # NOTE(@bpeetz): ALWAYS change the serial number, when you change something in the + # zone file! <2025-04-01> + serial = mkSerial 2026 08 14 01; + }; + useOrigin = false; + + # NOTE: matrix/mastodon need to have the point from `vhack.eu` to their IP <2025-03-10> + A = [ + "92.60.38.179" + ]; + AAAA = [ + "2a03:4000:33:25b::4f4e" + ]; + + NS = [ + "name-server1.jaki.li." + "name-server2.jaki.li." + ]; + + CAA = [ + { + issuerCritical = false; + tag = "issue"; + value = "letsencrypt.org"; + } + ]; + + # Mail section {{{ + MX = [ + # { + # preference = 10; + # exchange = "mail.vhack.eu."; + # } + { + preference = 10; + exchange = "mail.foss-syndicate.org."; + } + ]; + + # https://www.rfc-editor.org/rfc/rfc7208.html + TXT = [ + (builtins.concatStringsSep " " [ + "v=spf1" # The version. + "+mx" # Allow mail from this domain MX record. + "-all" # Reject all other emails if the previous mechanism did not match. + ]) + ]; + + # https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.1 + # https://www.rfc-editor.org/rfc/rfc6376.html#section-7.5 + DKIM = [ + { + selector = "mail"; + k = "ed25519"; + p = "U0eOxgLD3yK7PKzQRSZdJ3EH/UwVxPeYmfm42gYXsDg="; + s = ["email"]; + t = ["s"]; + } + ]; + + # https://www.rfc-editor.org/rfc/rfc7489.html#section-6.3 + DMARC = [ + { + adkim = "strict"; + aspf = "strict"; + fo = [ + "0" + "1" + "d" + "s" + ]; + p = "reject"; + rua = "admin@foss-syndicate.org"; + ruf = ["admin@foss-syndicate.org"]; + } + ]; + + # https://www.rfc-editor.org/rfc/rfc2782.txt + SRV = [ + { + service = "imaps"; + proto = "tcp"; + priority = 0; + weight = 1; + port = 993; + target = "mail.foss-syndicate.org."; + } + { + service = "pop3s"; + proto = "tcp"; + priority = 0; + weight = 1; + port = 995; + target = "mail.foss-snydicate.org."; + } + { + service = "smtps"; + proto = "tcp"; + priority = 0; + weight = 1; + port = 465; + target = "mail.foss-syndicate.org."; + } + ]; + # }}} + + subdomains = { + name-server1.CNAME = ["server2.vhack.eu."]; + name-server2.CNAME = ["server3.vhack.eu."]; + }; +} |