grace/dots

dotfiles/nix configs

git clone https://git.gae.moe/grace/dots

Grace Yoderchanged words.gay and added home manager dijkstra stuff01e3245

main
branchesidkmainvulcanwafrn-testingall refs →
3.6 KiB164 linesraw
1{ pkgs, ... }:
2
3let
4  serial = "2026101503";
5
6  public = {
7    lee = "152.44.40.91";
8    knuth = "209.50.50.6";
9  };
10
11  tailnet = import ../tailnet.nix;
12
13  tailnetRecords = builtins.concatStringsSep "\n" (
14    builtins.map (name: "${name}.i IN A ${tailnet.${name}}\n*.${name}.i IN A ${tailnet.${name}}") (
15      builtins.attrNames tailnet
16    )
17  );
18
19  mafiaSecondaries = [
20    "45.8.201.122"
21    "45.8.201.114"
22    "158.101.112.125"
23  ];
24
25  publicNameservers = ''
26    @ IN NS ns1.gae.moe.
27    @ IN NS ns1.inx.moe.
28    @ IN NS denise.charbroil.me.
29    @ IN NS ns1.shad.moe.
30  '';
31
32  mkPrimaryZone =
33    {
34      domain,
35      address,
36      extraRecords ? "",
37    }:
38    pkgs.writeText "zone-${domain}" ''
39      $ORIGIN ${domain}.
40      $TTL 300
41
42      @ IN SOA ns1.gae.moe. hostmaster.gae.moe. (
43        ${serial}
44        1h
45        15m
46        1w
47        5m
48      )
49
50      ${publicNameservers}
51
52      @ IN A ${address}
53      * IN A ${address}
54
55      ${extraRecords}
56    '';
57
58  mkSecondary =
59    master: zones:
60    builtins.listToAttrs (
61      map (zone: {
62        name = zone;
63        value = {
64          master = false;
65          masters = [ master ];
66          file = zone;
67        };
68      }) zones
69    );
70
71  mafiaZones =
72    mkSecondary "45.8.201.122" [
73      "inx.moe"
74      "doge-inc.net"
75      "foxy.software"
76      "swedish.fish"
77      "unreliable.email"
78      "funmafia.industries"
79      "vulcan.moe"
80    ]
81    // mkSecondary "45.8.201.114" [
82      "charbroil.me"
83      "puppy.observer"
84      "bdsm.equipment"
85      "ilovehewlettpackard.com"
86    ]
87    // mkSecondary "158.101.112.125" [
88      "shad.moe"
89      "konpeki.solutions"
90      "konpekisolutions.com"
91    ];
92
93in
94{
95  services.bind = {
96    enable = true;
97
98    cacheNetworks = [
99      "127.0.0.0/8"
100      "::1/128"
101      "100.64.0.0/10"
102    ];
103
104    zones = {
105      "gae.moe" = {
106        master = true;
107        slaves = mafiaSecondaries;
108
109        # Potentially could use DNAME forwarding while defining a Quad100 forwarder?
110        # https://github.com/tailscale/tailscale/issues/1543#issuecomment-4703759447
111        file = mkPrimaryZone {
112          domain = "gae.moe";
113          address = public.knuth;
114          extraRecords = ''
115            ns1 IN A ${public.knuth}
116            _hi 3600 IN TXT "hi :3"
117
118            ${tailnetRecords}
119          '';
120        };
121      };
122
123      "grace.pink" = {
124        master = true;
125        slaves = mafiaSecondaries;
126
127        file = mkPrimaryZone {
128          domain = "grace.pink";
129          address = public.knuth;
130          extraRecords = ''
131            _atproto 3600 IN TXT "did=did:plc:rtokeh2dsmapicefqxkefbfn"
132
133            @ IN TXT "purelymail_ownership_proof=c083dcd542b6a981ce2cda4010f07a6cc6789b717458229dddebb6cb482cbc5231efdca56f447af364d124031ce81bf5398a97cbb0d3412dfb5c90b89101fca9"
134            @ IN MX 50 mailserver.purelymail.com.
135            @ IN TXT "v=spf1 include:_spf.purelymail.com ~all"
136
137            purelymail1._domainkey IN CNAME key1.dkimroot.purelymail.com.
138            purelymail2._domainkey IN CNAME key2.dkimroot.purelymail.com.
139            purelymail3._domainkey IN CNAME key3.dkimroot.purelymail.com.
140            _dmarc IN CNAME dmarcroot.purelymail.com.
141            autoconfig IN CNAME autoconfig.purelymail.com.
142            _autodiscover._tcp IN SRV 0 0 443 autodiscover.purelymail.com.
143          '';
144        };
145      };
146
147      "words.gay" = {
148        master = true;
149        slaves = mafiaSecondaries;
150
151        file = mkPrimaryZone {
152          domain = "words.gay";
153          address = public.knuth;
154        };
155      };
156    }
157    // mafiaZones;
158  };
159
160  networking.firewall = {
161    allowedTCPPorts = [ 53 ];
162    allowedUDPPorts = [ 53 ];
163  };
164}