wip: migrate client modules

modules-clone/nixos/server/nsd/default.nix

@@ -0,0 +1,95 @@
+{ self, lib, config, globals, dns, confLib, ... }:
+let
+  inherit (confLib.gen { name = "nsd"; port = 53; }) serviceName servicePort proxyAddress4 proxyAddress6;
+  inherit (config.swarselsystems) sopsFile;
+in
+{
+  options = {
+    swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
+    swarselsystems.server.dns = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            subdomainRecords = lib.mkOption {
+              type = lib.types.attrsOf dns.lib.types.subzone;
+              default = { };
+            };
+          };
+        }
+      );
+    };
+  };
+  config = lib.mkIf config.swarselmodules.server.${serviceName} {
+
+    sops.secrets = {
+      tsig-key = { inherit sopsFile; };
+    };
+
+    # services.resolved.enable = false;
+    networking = {
+      # nameservers = [ "1.1.1.1" "8.8.8.8" ];
+      firewall = {
+        allowedUDPPorts = [ servicePort ];
+        allowedTCPPorts = [ servicePort ];
+      };
+    };
+
+    topology.self.services.${serviceName} = {
+      name = lib.toUpper serviceName;
+      icon = "${self}/files/topology-images/${serviceName}.png";
+    };
+
+    services.nsd = {
+      enable = true;
+      keys = {
+        "${globals.domains.main}.${proxyAddress4}" = {
+          algorithm = "hmac-sha256";
+          keyFile = config.sops.secrets.tsig-key.path;
+        };
+        "${globals.domains.main}.${proxyAddress6}" = {
+          algorithm = "hmac-sha256";
+          keyFile = config.sops.secrets.tsig-key.path;
+        };
+        "${globals.domains.main}" = {
+          algorithm = "hmac-sha256";
+          keyFile = config.sops.secrets.tsig-key.path;
+        };
+      };
+      interfaces = [
+        "10.1.2.157"
+        "2603:c020:801f:a0cc::9d"
+      ];
+      zones = {
+        "${globals.domains.main}" =
+          let
+            keyName4 = "${globals.domains.main}.${proxyAddress4}";
+            keyName6 = "${globals.domains.main}.${proxyAddress6}";
+            keyName = "${globals.domains.main}";
+            transferList = [
+              "213.239.242.238 ${keyName4}"
+              "2a01:4f8:0:a101::a:1 ${keyName6}"
+              "213.133.100.103 ${keyName4}"
+              "2a01:4f8:0:1::5ddc:2 ${keyName6}"
+              "193.47.99.3 ${keyName4}"
+              "2001:67c:192c::add:a3 ${keyName6}"
+            ];
+
+          in
+          {
+            outgoingInterface = "2603:c020:801f:a0cc::9d";
+            notify = transferList ++ [
+              "216.218.130.2 ${keyName}"
+            ];
+            provideXFR = transferList ++ [
+              "216.218.133.2 ${keyName}"
+              "2001:470:600::2 ${keyName}"
+            ];
+
+            # dnssec = true;
+            data = dns.lib.toString "${globals.domains.main}" (import ./site1.nix { inherit config globals dns proxyAddress4 proxyAddress6; });
+          };
+      };
+    };
+
+  };
+}

modules-clone/nixos/server/nsd/site1.nix

@@ -0,0 +1,117 @@
+{ config, globals, dns, proxyAddress4, proxyAddress6, ... }:
+with dns.lib.combinators; {
+  SOA = {
+    nameServer = "soa";
+    adminEmail = "admin@${globals.domains.main}"; # this option is not parsed as domain (we cannot just write "admin")
+    serial = 2026010201; # update this on changes for secondary dns
+  };
+
+  useOrigin = false;
+
+  NS = [
+    "soa"
+    "srv"
+  ] ++ globals.domains.externalDns;
+
+  CAA = [
+    {
+      issuerCritical = false;
+      tag = "issue";
+      value = "letsencrypt.org";
+    }
+    {
+      issuerCritical = false;
+      tag = "issuewild";
+      value = "letsencrypt.org";
+    }
+    {
+      issuerCritical = false;
+      tag = "iodef";
+      value = "mailto:${config.repo.secrets.common.dnsMail}";
+    }
+  ];
+
+  A = [ config.repo.secrets.local.dns.homepage-ip ];
+
+  SRV = [
+    {
+      service = "_matrix";
+      proto = "_tcp";
+      port = 443;
+      target = "${globals.services.matrix.subDomain}";
+      priority = 10;
+      weight = 5;
+    }
+    {
+      service = "_submissions";
+      proto = "_tcp";
+      port = 465;
+      target = "${globals.services.mailserver.subDomain}";
+      priority = 5;
+      weight = 0;
+      ttl = 3600;
+    }
+    {
+      service = "_submission";
+      proto = "_tcp";
+      port = 587;
+      target = "${globals.services.mailserver.subDomain}";
+      priority = 5;
+      weight = 0;
+      ttl = 3600;
+    }
+    {
+      service = "_imap";
+      proto = "_tcp";
+      port = 143;
+      target = "${globals.services.mailserver.subDomain}";
+      priority = 5;
+      weight = 0;
+      ttl = 3600;
+    }
+    {
+      service = "_imaps";
+      proto = "_tcp";
+      port = 993;
+      target = "${globals.services.mailserver.subDomain}";
+      priority = 5;
+      weight = 0;
+      ttl = 3600;
+    }
+  ];
+
+  MX = [
+    {
+      preference = 10;
+      exchange = "${globals.services.mailserver.subDomain}";
+    }
+  ];
+
+  DKIM = [
+    {
+      selector = "mail";
+      k = "rsa";
+      p = config.repo.secrets.local.dns.mailserver.dkim-public;
+      ttl = 10800;
+    }
+  ];
+
+  TXT = [
+    (with spf; strict [ "a:${globals.services.mailserver.subDomain}.${globals.domains.main}" ])
+    "google-site-verification=${config.repo.secrets.local.dns.google-site-verification}"
+  ];
+
+  DMARC = [
+    {
+      p = "none";
+      ttl = 10800;
+    }
+  ];
+
+  subdomains = config.swarselsystems.server.dns.${globals.domains.main}.subdomainRecords // {
+    "www".CNAME = [ "${globals.domains.main}." ];
+    "_acme-challenge".CNAME = [ "${config.repo.secrets.local.dns.acme-challenge-domain}." ];
+    "soa" = host proxyAddress4 proxyAddress6;
+    "srv" = host proxyAddress4 proxyAddress6;
+  };
+}