Set up a master/slave DNS config for ene and hermes

Julien LepillerTue Jul 23 21:53:14+0200 2019

9f73162

Set up a master/slave DNS config for ene and hermes

modules/config/dns.scm

2626 
  #:use-module (srfi srfi-1)
2727 
  #:export (ipv4-reverse-master-zone
2828 
            ipv6-reverse-master-zone
29-
            lepiller-master-zone))
29+
            lepiller-master-zone
30+
	    master-acl
31+
	    slave-acl
32+
	    hermes
33+
	    ene))
3034 
3135 
(define-zone-entries lepiller.eu.zone
3236 
;; Name         TTL Class Type Data
…
6973 
  ("@"          ""  "IN"  "NS"    "ns.lepiller.eu.")
7074 
  ("@"          ""  "IN"  "NS"    "ns2.lepiller.eu."))
7175 
76+
(define ene
77+
  (knot-remote-configuration
78+
    (id "ene")
79+
    (address (list ene-ip4))
80+
    (key "lepiller-key")))
81+
82+
(define hermes
83+
  (knot-remote-configuration
84+
    (id "hermes")
85+
    (address (list hermes-ip4))
86+
    (key "lepiller-key")))
87+
88+
(define master-acl
89+
  (knot-acl-configuration
90+
    (id "master-acl")
91+
    (address (list hermes-ip4))
92+
    (key '("lepiller-key"))
93+
    (action '(transfer))))
94+
95+
(define slave-acl
96+
  (knot-acl-configuration
97+
    (id "master-acl")
98+
    (address (list ene-ip4))
99+
    (key '("lepiller-key"))
100+
    (action '(notify))))
101+
72102 
(define lepiller-master-zone
73103 
  (knot-zone-configuration
74104 
    (domain "lepiller.eu")
105+
    (notify '("hermes"))
75106 
    (dnssec-policy "default")
107+
    (acl '("master-acl"))
76108 
    (zonefile-load 'difference)
77109 
    (zone (zone-file
78110 
            (origin "lepiller.eu")
79111 
            (entries lepiller.eu.zone)
80112 
            (serial 2019041202)))))
81113 
114+
(define lepiller-slave-zone
115+
  (knot-zone-configuration
116+
    (domain "lepiller.eu")
117+
    (acl '("slave-acl"))
118+
    (master '("ene"))))
119+
82120 
(define ipv6-reverse-master-zone
83121 
  (let* ((ip6 (string->list (substring (string-delete hermes-ip6 #\:) 0 12)))
84122 
         (rev-ip6-lst (fold (lambda (elem acc)
systems/ene.scm
4848 
  (services
4949 
    (append
5050 
      (list
51-
	(service dhcp-client-service-type)
52-
	(agetty-service
53-
	  (agetty-configuration
54-
	    (extra-options '("-L"))
55-
	    (baud-rate "115200")
56-
	    (term "vt100")
57-
	    (tty "ttyS0")))
51+
        (service dhcp-client-service-type)
52+
        (agetty-service
53+
          (agetty-configuration
54+
            (extra-options '("-L"))
55+
            (baud-rate "115200")
56+
            (term "vt100")
57+
            (tty "ttyS0")))
5858 
        (service nginx-service-type)
5959 
        (service knot-service-type
6060 
                 (knot-configuration
61+
                   (includes '("/etc/knot/secrets.conf"))
62+
                   (acls (list master-acl))
63+
                   (remotes (list hermes))
6164 
                   (zones (list lepiller-master-zone
6265 
                                ipv4-reverse-master-zone
6366 
                                ipv6-reverse-master-zone))))
6467 
        (certbot-service `(("courriel.lepiller.eu" "imap.lepiller.eu")
65-
			   ("ene.lepiller.eu" "rennes.lepiller.eu")
66-
			   ("avatar.lepiller.eu")))
67-
	(service php-fpm-service-type)
68-
	(cat-avatar-generator-service
69-
	  #:configuration
70-
	  (nginx-server-configuration
71-
	    (server-name '("avatar.lepiller.eu"))
72-
	    (ssl-certificate "/etc/letsencrypt/live/avatar.lepiller.eu/fullchain.pem")
73-
	    (ssl-certificate-key "/etc/letsencrypt/live/avatar.lepiller.eu/privkey.pem")
74-
	    (listen '("443 ssl http2" "[::]:443 ssl http2"))))
68+
                           ("ene.lepiller.eu" "rennes.lepiller.eu")
69+
                           ("avatar.lepiller.eu")))
70+
        (service php-fpm-service-type)
71+
        (cat-avatar-generator-service
72+
          #:configuration
73+
          (nginx-server-configuration
74+
            (server-name '("avatar.lepiller.eu"))
75+
            (ssl-certificate "/etc/letsencrypt/live/avatar.lepiller.eu/fullchain.pem")
76+
            (ssl-certificate-key "/etc/letsencrypt/live/avatar.lepiller.eu/privkey.pem")
77+
            (listen '("443 ssl http2" "[::]:443 ssl http2"))))
7578 
        (simple-service 'default-http-server nginx-service-type
7679 
          (list (nginx-server-configuration
7780 
                  (ssl-certificate "/etc/letsencrypt/live/ene.lepiller.eu/fullchain.pem")
…
7982 
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
8083 
                  (server-name '(default))(root "/srv/http/default")))))
8184 
      (lepiller-mail-services
82-
	#:interface "eth0"
83-
	#:domain "courriel.lepiller.eu")
85+
        #:interface "eth0"
86+
        #:domain "courriel.lepiller.eu")
8487 
      (server-services "ene"))))
systems/hermes.scm
4040 
        (service nginx-service-type)
4141 
        (service knot-service-type
4242 
                 (knot-configuration
43-
                   (zones (list lepiller-master-zone
43+
                   (includes '("/etc/knot/secrets.conf"))
44+
                   (acls (list glave-acl))
45+
                   (remotes (list ene))
46+
                   (zones (list lepiller-slave-zone
4447 
                                ipv4-reverse-master-zone
4548 
                                ipv6-reverse-master-zone))))
4649 
        (certbot-service `(("lepiller.eu" "www.lepiller.eu" "smtp.lepiller.eu")))
…
5558 
                  (try-files '("$uri.$language_suffix.html" "$uri" "$uri/" "=404"))
5659 
                  (raw-content
5760 
                    '("add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"
58-
		      "add_header X-Frame-Options DENY;"
59-
		      "add_header X-Content-Type-Options nosniff;"
60-
		      "add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"
61-
		      "add_header Referrer-Policy no-referrer;"
62-
		      "set $first_language $http_accept_language;"
61+
                      "add_header X-Frame-Options DENY;"
62+
                      "add_header X-Content-Type-Options nosniff;"
63+
                      "add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"
64+
                      "add_header Referrer-Policy no-referrer;"
65+
                      "set $first_language $http_accept_language;"
6366 
                      "if ($http_accept_language ~* '(en|eo|fr)') {"
6467 
                      "    set $first_language $1;"
6568 
                      "}"
…
8386 
                      "    add_header Set-Cookie 'language=$language_suffix;HttpOnly;Secure';"
8487 
                      "    add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';"
8588 
                      "    add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"
86-
		      "    add_header X-Frame-Options DENY;"
87-
		      "    add_header X-Content-Type-Options nosniff;"
88-
		      "    add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"
89-
		      "    add_header Referrer-Policy no-referrer;"
89+
                      "    add_header X-Frame-Options DENY;"
90+
                      "    add_header X-Content-Type-Options nosniff;"
91+
                      "    add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"
92+
                      "    add_header Referrer-Policy no-referrer;"
9093 
                      "    expires off;"
9194 
                      "    try_files $my_uri $uri $uri/ =404;"
9295 
                      "}"
…
98101 
                  (listen '("443 ssl http2" "[::]:443 ssl http2"))
99102 
                  (server-name '(default))(root "/srv/http/default")))))
100103 
      (lepiller-mail-services
101-
	#:interface "ens18"
102-
	#:domain "lepiller.eu")
104+
        #:interface "ens18"
105+
        #:domain "lepiller.eu")
103106 
      (server-services "hermes"))))