dns.scm
1 | ;;; Tyreunom's system administration and configuration tools. |
2 | ;;; |
3 | ;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu> |
4 | ;;; |
5 | ;;; This program is free software: you can redistribute it and/or modify |
6 | ;;; it under the terms of the GNU General Public License as published by |
7 | ;;; the Free Software Foundation, either version 3 of the License, or |
8 | ;;; (at your option) any later version. |
9 | ;;; |
10 | ;;; This program is distributed in the hope that it will be useful, |
11 | ;;; but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
13 | ;;; GNU General Public License for more details. |
14 | ;;; |
15 | ;;; You should have received a copy of the GNU General Public License |
16 | ;;; along with this program. If not, see <http://www.gnu.org/licenses/>. |
17 | |
18 | ;; |
19 | ;; DNS services |
20 | ;; |
21 | |
22 | (define-module (config dns) |
23 | #:use-module (data dns) |
24 | #:use-module (gnu services) |
25 | #:use-module (gnu services dns) |
26 | #:use-module (srfi srfi-1) |
27 | #:use-module (ice-9 textual-ports) |
28 | #:export (ipv4-reverse-master-zone |
29 | ipv6-reverse-master-zone |
30 | lepiller-master-zone |
31 | lepiller-slave-zone |
32 | master-acl |
33 | slave-acl |
34 | hermes |
35 | nono)) |
36 | |
37 | ;; Update this when changing the zone: |
38 | (define lepiller-serial 2024030901) |
39 | |
40 | (define public-dkim |
41 | (apply |
42 | string-append |
43 | (string-split |
44 | (call-with-input-file "/etc/mail/dkim/public.key" get-string-all) |
45 | #\newline))) |
46 | |
47 | (define-zone-entries lepiller.eu.zone |
48 | ;; Name TTL Class Type Data |
49 | ("ene" "" "IN" "A" ene-toulouse-ip4) |
50 | ;("ene" "" "IN" "AAAA" ene-toulouse-ip6) |
51 | ("hermes" "" "IN" "A" hermes-ip4) |
52 | ("hermes" "" "IN" "AAAA" hermes-ip6) |
53 | ("xana" "" "IN" "A" xana-ip4) |
54 | ("dark" "" "IN" "A" dark-ip4) |
55 | ("bright" "" "IN" "A" bright-ip4) |
56 | ("seven" "" "IN" "A" seven-ip4) |
57 | ("nono" "" "IN" "A" nono-ip4) |
58 | ;("nono" "" "IN" "AAAA" nono-ip6) |
59 | ("lieserl" "" "IN" "A" lieserl-ip4) |
60 | ("lieserl" "" "IN" "AAAA" lieserl-ip6) |
61 | ("@" "" "IN" "A" hermes-ip4) |
62 | ("@" "" "IN" "AAAA" hermes-ip6) |
63 | ("www" "" "IN" "CNAME" "lepiller.eu.") |
64 | |
65 | ("avatar" "" "IN" "CNAME" "nono") |
66 | ("genealogie" "" "IN" "CNAME" "nono") |
67 | ("git" "" "IN" "CNAME" "nono") |
68 | ("i18n" "" "IN" "CNAME" "xana") |
69 | ("nani" "" "IN" "CNAME" "bright") |
70 | ("offlate" "" "IN" "CNAME" "xana") |
71 | ("social" "" "IN" "CNAME" "nono") |
72 | ("dico" "" "IN" "CNAME" "hermes") |
73 | ("lfs" "" "IN" "CNAME" "bright") |
74 | |
75 | ("toulouse" "" "IN" "CNAME" "nono") |
76 | |
77 | ("@" "" "IN" "NS" "ns") |
78 | ("@" "" "IN" "NS" "ns2") |
79 | ("ns" "" "IN" "A" hermes-ip4) |
80 | ("ns" "" "IN" "AAAA" hermes-ip6) |
81 | ("ns2" "" "IN" "A" nono-ip4) |
82 | ;("ns2" "" "IN" "AAAA" nono-ip6) |
83 | |
84 | ("@" "" "IN" "MX" "10 courriel") |
85 | ("@" "" "IN" "MX" "50 b.courriel") |
86 | ("b.courriel" "" "IN" "A" hermes-ip4) |
87 | ("b.courriel" "" "IN" "AAAA" hermes-ip6) |
88 | ("courriel" "" "IN" "A" nono-ip4) |
89 | ;("courriel" "" "IN" "AAAA" nono-ip6) |
90 | ("imap" "" "IN" "CNAME" "courriel") |
91 | ("smtp" "" "IN" "CNAME" "b.courriel") |
92 | ("@" "" "IN" "TXT" "\"v=spf1 mx a ~all\"") |
93 | ("@" "" "IN" "SPF" "\"v=spf1 mx a ~all\"") |
94 | |
95 | ("dkim._domainkey" "" "IN" "TXT" (string-append "v=DKIM1\\; p=" public-dkim "\\; s=email\\; t=s")) |
96 | ("_dmarc" "" "IN" "TXT" "v=DMARC1\\; p=none\\; sp=reject\\; rua=mailto:rua@lepiller.eu!10m\\; ruf=mailto:ruf@lepiller.eu!10m\\; rf=afrf\\; pct=100\\; ri=86400")) |
97 | |
98 | (define-zone-entries ipv4-reverse.zone |
99 | ("@" "" "IN" "PTR" "lepiller.eu.") |
100 | ("@" "" "IN" "NS" "ns.lepiller.eu.") |
101 | ("@" "" "IN" "NS" "ns2.lepiller.eu.")) |
102 | |
103 | (define-zone-entries ipv6-reverse.zone |
104 | ("1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0" "" "IN" "PTR" "lepiller.eu.") |
105 | ("@" "" "IN" "NS" "ns.lepiller.eu.") |
106 | ("@" "" "IN" "NS" "ns2.lepiller.eu.")) |
107 | |
108 | (define nono |
109 | (knot-remote-configuration |
110 | (id "nono") |
111 | (address (list nono-ip4 #;nono-ip6)) |
112 | (key "lepiller-key"))) |
113 | |
114 | (define hermes |
115 | (knot-remote-configuration |
116 | (id "hermes") |
117 | (address (list hermes-ip4 hermes-ip6)) |
118 | (key "lepiller-key"))) |
119 | |
120 | (define master-acl |
121 | (knot-acl-configuration |
122 | (id "master-acl") |
123 | (address (list nono-ip4 #;nono-ip6)) |
124 | (key '("lepiller-key")) |
125 | (action '(transfer)))) |
126 | |
127 | (define slave-acl |
128 | (knot-acl-configuration |
129 | (id "slave-acl") |
130 | (address (list hermes-ip4 hermes-ip6)) |
131 | (key '("lepiller-key")) |
132 | (action '(notify)))) |
133 | |
134 | (define lepiller-master-zone |
135 | (knot-zone-configuration |
136 | (domain "lepiller.eu") |
137 | (notify '("nono")) |
138 | (dnssec-policy "default") |
139 | (acl '("master-acl")) |
140 | (zonefile-load 'difference) |
141 | (zone (zone-file |
142 | (origin "lepiller.eu") |
143 | (entries lepiller.eu.zone) |
144 | (serial lepiller-serial))))) |
145 | |
146 | (define lepiller-slave-zone |
147 | (knot-zone-configuration |
148 | (domain "lepiller.eu") |
149 | (acl '("slave-acl")) |
150 | (master '("hermes")))) |
151 | |
152 | (define ipv6-reverse-master-zone |
153 | (let* ((ip6 (string->list (substring (string-delete #\: hermes-ip6) 0 12))) |
154 | (rev-ip6-lst (fold (lambda (elem acc) |
155 | (cons* #\. elem acc)) |
156 | '() |
157 | ip6)) |
158 | (rev-ip6 (list->string (cdr rev-ip6-lst))) |
159 | (domain (string-append rev-ip6 ".ip6.arpa"))) |
160 | (knot-zone-configuration |
161 | (domain domain) |
162 | (zone (zone-file |
163 | (origin domain) |
164 | (entries ipv6-reverse.zone) |
165 | (ns "ns.lepiller.eu.") |
166 | (mail "hostmaster.lepiller.eu.") |
167 | (serial 1)))))) |
168 | |
169 | (define ipv4-reverse-master-zone |
170 | (let ((domain (string-append |
171 | (string-join (reverse (string-split hermes-ip4 #\.)) ".") |
172 | ".in-addr.arpa"))) |
173 | (knot-zone-configuration |
174 | (domain domain) |
175 | (zone (zone-file |
176 | (origin domain) |
177 | (entries ipv4-reverse.zone) |
178 | (ns "ns.lepiller.eu.") |
179 | (mail "hostmaster.lepiller.eu.") |
180 | (serial 1)))))) |
181 |