system-configuration

system-configuration/modules/config/dns.scm

dns.scm

;;; Tyreunom's system administration and configuration tools.
;;;
;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>
;;;
;;; This program is free software: you can redistribute it and/or modify
;;; it under the terms of the GNU General Public License as published by
;;; the Free Software Foundation, either version 3 of the License, or
;;; (at your option) any later version.
;;;
;;; This program is distributed in the hope that it will be useful,
;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

;;
;; DNS services
;;

(define-module (config dns)
  #:use-module (data dns)
  #:use-module (gnu services)
  #:use-module (gnu services dns)
  #:use-module (srfi srfi-1)
  #:use-module (ice-9 textual-ports)
  #:export (ipv4-reverse-master-zone
            ipv6-reverse-master-zone
            lepiller-master-zone
            lepiller-slave-zone
            master-acl
            slave-acl
            hermes
            ene))

;; Update this when changing the zone:
(define lepiller-serial 2022112701)

(define public-dkim
  (apply
    string-append
    (string-split
      (call-with-input-file "/etc/mail/dkim/public.key" get-string-all)
      #\newline)))

(define-zone-entries lepiller.eu.zone
;; Name         TTL Class Type Data
  ("ene"        ""  "IN"  "A"       ene-toulouse-ip4)
  ("ene"        ""  "IN"  "AAAA"    ene-toulouse-ip6)
  ("hermes"     ""  "IN"  "A"       hermes-ip4)
  ("hermes"     ""  "IN"  "AAAA"    hermes-ip6)
  ("xana"       ""  "IN"  "A"       xana-ip4)
  ("dark"       ""  "IN"  "A"       dark-ip4)
  ("nono"       ""  "IN"  "A"       nono-ip4)
  ("nono"       ""  "IN"  "AAAA"    nono-ip6)
  ("lieserl"       ""  "IN"  "A"    lieserl-ip4)
  ("lieserl"       ""  "IN"  "AAAA" lieserl-ip6)
  ("@"          ""  "IN"  "A"       hermes-ip4)
  ("@"          ""  "IN"  "AAAA"    hermes-ip6)
  ("www"        ""  "IN"  "CNAME"   "lepiller.eu.")

  ("avatar"     ""  "IN"  "CNAME"   "nono")
  ("git"        ""  "IN"  "CNAME"   "nono")
  ("i18n"       ""  "IN"  "CNAME"   "xana")
  ("nani"       ""  "IN"  "CNAME"   "xana")
  ("offlate"    ""  "IN"  "CNAME"   "xana")
  ("social"     ""  "IN"  "CNAME"   "nono")
  ("lfs"        ""  "IN"  "CNAME"   "dark")

  ("toulouse"   ""  "IN"  "CNAME"   "nono")
  
  ("@"          ""  "IN"  "NS"      "ns")
  ("@"          ""  "IN"  "NS"      "ns2")
  ("ns"         ""  "IN"  "A"       hermes-ip4)
  ("ns"         ""  "IN"  "AAAA"    hermes-ip6)
  ("ns2"        ""  "IN"  "A"       nono-ip4)
  ("ns2"        ""  "IN"  "AAAA"    nono-ip6)

  ("@"          ""  "IN"  "MX"      "10 courriel")
  ("@"          ""  "IN"  "MX"      "50 b.courriel")
  ("@"          ""  "IN"  "MX"      "20 wio6sja633kwuybkyqex7vvnzqvrhrtzjix6cjhsqi42hx3n2qjfmzid.onion.")
  ("@"          ""  "IN"  "MX"      "60 5g33mrv2rp2onyvte2b3ge5a44fxansxwt4sajmmae7lgorxjgz5czad.onion.")
  ("b.courriel" ""  "IN"  "A"       hermes-ip4)
  ("b.courriel" ""  "IN"  "AAAA"    hermes-ip6)
  ("courriel"   ""  "IN"  "A"       nono-ip4)
  ("courriel"   ""  "IN"  "AAAA"    nono-ip6)
  ("imap"       ""  "IN"  "CNAME"   "courriel")
  ("smtp"       ""  "IN"  "CNAME"   "b.courriel")
  ("@"          ""  "IN"  "TXT"     "\"v=spf1 mx a ~all\"")
  ("@"          ""  "IN"  "SPF"     "\"v=spf1 mx a ~all\"")
  
  ("dkim._domainkey" "" "IN" "TXT"  (string-append "v=DKIM1\\; p=" public-dkim "\\; s=email\\; t=s"))
  ("_dmarc"     ""  "IN"  "TXT"     "v=DMARC1\\; p=none\\; sp=reject\\; rua=mailto:rua@lepiller.eu!10m\\; ruf=mailto:ruf@lepiller.eu!10m\\; rf=afrf\\; pct=100\\; ri=86400"))

(define-zone-entries ipv4-reverse.zone
  ("@" "" "IN" "PTR" "lepiller.eu.")
  ("@"          ""  "IN"  "NS"      "ns.lepiller.eu.")
  ("@"          ""  "IN"  "NS"      "ns2.lepiller.eu."))

(define-zone-entries ipv6-reverse.zone
  ("1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0" "" "IN" "PTR" "lepiller.eu.")
  ("@"          ""  "IN"  "NS"      "ns.lepiller.eu.")
  ("@"          ""  "IN"  "NS"      "ns2.lepiller.eu."))

(define ene
  (knot-remote-configuration
    (id "ene")
    (address (list ene-toulouse-ip4 ene-toulouse-ip6))
    (key "lepiller-key")))

(define hermes
  (knot-remote-configuration
    (id "hermes")
    (address (list hermes-ip4 hermes-ip6))
    (key "lepiller-key")))

(define master-acl
  (knot-acl-configuration
    (id "master-acl")
    (address (list ene-toulouse-ip4 ene-toulouse-ip6))
    (key '("lepiller-key"))
    (action '(transfer))))

(define slave-acl
  (knot-acl-configuration
    (id "slave-acl")
    (address (list hermes-ip4 hermes-ip6))
    (key '("lepiller-key"))
    (action '(notify))))

(define lepiller-master-zone
  (knot-zone-configuration
    (domain "lepiller.eu")
    (notify '("ene"))
    (dnssec-policy "default")
    (acl '("master-acl"))
    (zonefile-load 'difference)
    (zone (zone-file
            (origin "lepiller.eu")
            (entries lepiller.eu.zone)
            (serial lepiller-serial)))))

(define lepiller-slave-zone
  (knot-zone-configuration
    (domain "lepiller.eu")
    (acl '("slave-acl"))
    (master '("hermes"))))

(define ipv6-reverse-master-zone
  (let* ((ip6 (string->list (substring (string-delete #\: hermes-ip6) 0 12)))
         (rev-ip6-lst (fold (lambda (elem acc)
                          (cons* #\. elem acc))
                        '()
                        ip6))
         (rev-ip6 (list->string (cdr rev-ip6-lst)))
         (domain (string-append rev-ip6 ".ip6.arpa")))
    (knot-zone-configuration
      (domain domain)
      (zone (zone-file
              (origin domain)
              (entries ipv6-reverse.zone)
              (ns "ns.lepiller.eu.")
              (mail "hostmaster.lepiller.eu.")
              (serial 1))))))

(define ipv4-reverse-master-zone
  (let ((domain (string-append
                  (string-join (reverse (string-split hermes-ip4 #\.)) ".")
                  ".in-addr.arpa")))
    (knot-zone-configuration
      (domain domain)
      (zone (zone-file
              (origin domain)
              (entries ipv4-reverse.zone)
              (ns "ns.lepiller.eu.")
              (mail "hostmaster.lepiller.eu.")
              (serial 1))))))


1	;;; Tyreunom's system administration and configuration tools.
2	;;;
3	;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>
4	;;;
5	;;; This program is free software: you can redistribute it and/or modify
6	;;; it under the terms of the GNU General Public License as published by
7	;;; the Free Software Foundation, either version 3 of the License, or
8	;;; (at your option) any later version.
9	;;;
10	;;; This program is distributed in the hope that it will be useful,
11	;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
12	;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	;;; GNU General Public License for more details.
14	;;;
15	;;; You should have received a copy of the GNU General Public License
16	;;; along with this program. If not, see <http://www.gnu.org/licenses/>.
17
18	;;
19	;; DNS services
20	;;
21
22	(define-module (config dns)
23	#:use-module (data dns)
24	#:use-module (gnu services)
25	#:use-module (gnu services dns)
26	#:use-module (srfi srfi-1)
27	#:use-module (ice-9 textual-ports)
28	#:export (ipv4-reverse-master-zone
29	ipv6-reverse-master-zone
30	lepiller-master-zone
31	lepiller-slave-zone
32	master-acl
33	slave-acl
34	hermes
35	ene))
36
37	;; Update this when changing the zone:
38	(define lepiller-serial 2022112701)
39
40	(define public-dkim
41	(apply
42	string-append
43	(string-split
44	(call-with-input-file "/etc/mail/dkim/public.key" get-string-all)
45	#\newline)))
46
47	(define-zone-entries lepiller.eu.zone
48	;; Name TTL Class Type Data
49	("ene" "" "IN" "A" ene-toulouse-ip4)
50	("ene" "" "IN" "AAAA" ene-toulouse-ip6)
51	("hermes" "" "IN" "A" hermes-ip4)
52	("hermes" "" "IN" "AAAA" hermes-ip6)
53	("xana" "" "IN" "A" xana-ip4)
54	("dark" "" "IN" "A" dark-ip4)
55	("nono" "" "IN" "A" nono-ip4)
56	("nono" "" "IN" "AAAA" nono-ip6)
57	("lieserl" "" "IN" "A" lieserl-ip4)
58	("lieserl" "" "IN" "AAAA" lieserl-ip6)
59	("@" "" "IN" "A" hermes-ip4)
60	("@" "" "IN" "AAAA" hermes-ip6)
61	("www" "" "IN" "CNAME" "lepiller.eu.")
62
63	("avatar" "" "IN" "CNAME" "nono")
64	("git" "" "IN" "CNAME" "nono")
65	("i18n" "" "IN" "CNAME" "xana")
66	("nani" "" "IN" "CNAME" "xana")
67	("offlate" "" "IN" "CNAME" "xana")
68	("social" "" "IN" "CNAME" "nono")
69	("lfs" "" "IN" "CNAME" "dark")
70
71	("toulouse" "" "IN" "CNAME" "nono")
72
73	("@" "" "IN" "NS" "ns")
74	("@" "" "IN" "NS" "ns2")
75	("ns" "" "IN" "A" hermes-ip4)
76	("ns" "" "IN" "AAAA" hermes-ip6)
77	("ns2" "" "IN" "A" nono-ip4)
78	("ns2" "" "IN" "AAAA" nono-ip6)
79
80	("@" "" "IN" "MX" "10 courriel")
81	("@" "" "IN" "MX" "50 b.courriel")
82	("@" "" "IN" "MX" "20 wio6sja633kwuybkyqex7vvnzqvrhrtzjix6cjhsqi42hx3n2qjfmzid.onion.")
83	("@" "" "IN" "MX" "60 5g33mrv2rp2onyvte2b3ge5a44fxansxwt4sajmmae7lgorxjgz5czad.onion.")
84	("b.courriel" "" "IN" "A" hermes-ip4)
85	("b.courriel" "" "IN" "AAAA" hermes-ip6)
86	("courriel" "" "IN" "A" nono-ip4)
87	("courriel" "" "IN" "AAAA" nono-ip6)
88	("imap" "" "IN" "CNAME" "courriel")
89	("smtp" "" "IN" "CNAME" "b.courriel")
90	("@" "" "IN" "TXT" "\"v=spf1 mx a ~all\"")
91	("@" "" "IN" "SPF" "\"v=spf1 mx a ~all\"")
92
93	("dkim._domainkey" "" "IN" "TXT" (string-append "v=DKIM1\\; p=" public-dkim "\\; s=email\\; t=s"))
94	("_dmarc" "" "IN" "TXT" "v=DMARC1\\; p=none\\; sp=reject\\; rua=mailto:rua@lepiller.eu!10m\\; ruf=mailto:ruf@lepiller.eu!10m\\; rf=afrf\\; pct=100\\; ri=86400"))
95
96	(define-zone-entries ipv4-reverse.zone
97	("@" "" "IN" "PTR" "lepiller.eu.")
98	("@" "" "IN" "NS" "ns.lepiller.eu.")
99	("@" "" "IN" "NS" "ns2.lepiller.eu."))
100
101	(define-zone-entries ipv6-reverse.zone
102	("1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0" "" "IN" "PTR" "lepiller.eu.")
103	("@" "" "IN" "NS" "ns.lepiller.eu.")
104	("@" "" "IN" "NS" "ns2.lepiller.eu."))
105
106	(define ene
107	(knot-remote-configuration
108	(id "ene")
109	(address (list ene-toulouse-ip4 ene-toulouse-ip6))
110	(key "lepiller-key")))
111
112	(define hermes
113	(knot-remote-configuration
114	(id "hermes")
115	(address (list hermes-ip4 hermes-ip6))
116	(key "lepiller-key")))
117
118	(define master-acl
119	(knot-acl-configuration
120	(id "master-acl")
121	(address (list ene-toulouse-ip4 ene-toulouse-ip6))
122	(key '("lepiller-key"))
123	(action '(transfer))))
124
125	(define slave-acl
126	(knot-acl-configuration
127	(id "slave-acl")
128	(address (list hermes-ip4 hermes-ip6))
129	(key '("lepiller-key"))
130	(action '(notify))))
131
132	(define lepiller-master-zone
133	(knot-zone-configuration
134	(domain "lepiller.eu")
135	(notify '("ene"))
136	(dnssec-policy "default")
137	(acl '("master-acl"))
138	(zonefile-load 'difference)
139	(zone (zone-file
140	(origin "lepiller.eu")
141	(entries lepiller.eu.zone)
142	(serial lepiller-serial)))))
143
144	(define lepiller-slave-zone
145	(knot-zone-configuration
146	(domain "lepiller.eu")
147	(acl '("slave-acl"))
148	(master '("hermes"))))
149
150	(define ipv6-reverse-master-zone
151	(let* ((ip6 (string->list (substring (string-delete #\: hermes-ip6) 0 12)))
152	(rev-ip6-lst (fold (lambda (elem acc)
153	(cons* #\. elem acc))
154	'()
155	ip6))
156	(rev-ip6 (list->string (cdr rev-ip6-lst)))
157	(domain (string-append rev-ip6 ".ip6.arpa")))
158	(knot-zone-configuration
159	(domain domain)
160	(zone (zone-file
161	(origin domain)
162	(entries ipv6-reverse.zone)
163	(ns "ns.lepiller.eu.")
164	(mail "hostmaster.lepiller.eu.")
165	(serial 1))))))
166
167	(define ipv4-reverse-master-zone
168	(let ((domain (string-append
169	(string-join (reverse (string-split hermes-ip4 #\.)) ".")
170	".in-addr.arpa")))
171	(knot-zone-configuration
172	(domain domain)
173	(zone (zone-file
174	(origin domain)
175	(entries ipv4-reverse.zone)
176	(ns "ns.lepiller.eu.")
177	(mail "hostmaster.lepiller.eu.")
178	(serial 1))))))
179