Drift/PVV-DNS
1
0
Fork 1
Code Issues Pull Requests Actions Activity

Generalize pvv-domain.nix, specialize pvv.ntnu.no and pvv.org

Browse Source
This commit is contained in:
Felix Albrigtsen
2026-01-21 21:56:05 +01:00
parent 2713d657fb
commit ec3ca973b3
6 changed files with 112 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pvv-domain.nix
+95
View File
@@ -0,0 +1,95 @@
# Shared configuration for the main PVV domains; pvv.ntnu.no and pvv.org (defined in ./zones/), mainly
# - E-mail configuration (MX, SRV, mail aliases)
# - Forward records generated from the ./hosts.nix file
# - Various SRV records
{ dns, lib, ... }:
with dns.lib.combinators;
let
pvvHostRecords = import ./pvv-host-forwards.nix { inherit dns lib; };
in
{
useOrigin = true; # Don't output fully qualified names
SOA = {
nameServer = "dvask.pvv.ntnu.no.";
adminEmail = "drift@pvv.ntnu.no";
serial = 2025021701; # TODO: Automate
};
NS = [
"dvask.pvv.ntnu.no."
"nn.unintett.no."
];
MX = [
{
preference = 10;
exchange = "microbel.pvv.ntnu.no.";
}
];
# TODO - Re-add priority/weight?
SRV =
let
tcp = "tcp";
udp = "udp";
mkSrv = service: proto: port: target: {
inherit
service
proto
port
target
;
};
in
[
(mkSrv "minecraft" tcp 25565 "innovation")
(mkSrv "kerberos" tcp 88 "balduzius")
(mkSrv "kerberos" udp 88 "balduzius")
(mkSrv "kpasswd" udp 464 "balduzius")
(mkSrv "kerberos-adm" tcp 749 "balduzius")
(mkSrv "kerberos-adm" udp 749 "balduzius")
(mkSrv "http" tcp 80 "bekkalokk")
(mkSrv "https" tcp 443 "bekkalokk")
];
A = pvvHostRecords.bekkalokk.A;
AAAA = pvvHostRecords.bekkalokk.AAAA;
TXT = [
"v=spf1 mx ~all"
];
subdomains = pvvHostRecords // {
# Special services:
minecraft.SRV = [
{
service = "minecraft";
proto = "tcp";
port = 25565;
target = "innovation";
}
];
_kerberos.TXT = [ "PVV.NTNU.NO" ];
# E-mail:
_dmarc.TXT = [ "v=DMARC1; p=quarantine; fo=1;" ];
drift.CNAME = [ "mail" ];
imap.CNAME = [ "mail" ];
mailhost.CNAME = [ "mail" ];
pop.CNAME = [ "mail" ];
smtp.CNAME = [ "mail" ];
list = {
A = pvvHostRecords.microbel.A;
MX = [
{
preference = 10;
exchange = "microbel.pvv.ntnu.no.";
}
];
};
};
}
pvv-subdomains.nix → pvv-host-forwards.nix
+2 -1
View File
@@ -1,4 +1,4 @@
# Generate forwards records from the ./hosts.nix file, intended to be used in the pvv.ntnu.no and pvv.org zones
# Generate forward records (A, AAAA and CNAME) for hosts in ./hosts.nix
{ dns, lib, ... }:
with dns.lib.combinators;
@@ -43,6 +43,7 @@ let
) hosts;
setCollisions = duplicateKeys hostRecords aliasRecords;
in
if builtins.length setCollisions > 0 then
throw "Duplicate keys: '${builtins.concatStringsSep ", " setCollisions}' exist as both a host (A/AAAA) and alias (CNAME)"
zones/pvv.ntnu.no.nix
+4 -85
View File
@@ -1,97 +1,16 @@
{ dns, lib, ... }:
with dns.lib.combinators;
let
pvvHostRecords = import ../pvv-subdomains.nix { inherit dns lib; };
in
{
useOrigin = true; # Don't output fully qualified names
SOA = {
nameServer = "dvask.pvv.ntnu.no.";
adminEmail = "drift@pvv.ntnu.no";
serial = 2025021701; # TODO: Automate
};
NS = [
"dvask.pvv.ntnu.no."
"nn.unintett.no."
];
MX = [
{
preference = 10;
exchange = "microbel.pvv.ntnu.no.";
}
];
# TODO - Re-add priority/weight?
SRV = let
tcp = "tcp";
udp = "udp";
mkSrv = service: proto: port: target: {
inherit service proto port target;
};
in [
(mkSrv "minecraft" tcp 25565 "innovation")
(mkSrv "kerberos" tcp 88 "balduzius")
(mkSrv "kerberos" udp 88 "balduzius")
(mkSrv "kpasswd" udp 464 "balduzius")
(mkSrv "kerberos-adm" tcp 749 "balduzius")
(mkSrv "kerberos-adm" udp 749 "balduzius")
(mkSrv "http" tcp 80 "bekkalokk")
(mkSrv "https" tcp 443 "bekkalokk")
];
A = pvvHostRecords.bekkalokk.A;
AAAA = pvvHostRecords.bekkalokk.AAAA;
TXT = [
"v=spf1 mx ~all"
];
subdomains = pvvHostRecords // {
lib.recursiveUpdate (import ../pvv-domain.nix { inherit dns lib; }) {
subdomains = {
# *.stackit.pvv.ntnu.no handled by openstack-designate
stackit.NS = [
"ns1.stack.it.ntnu.no."
"ns2.stack.it.ntnu.no."
];
# Special services:
minecraft.SRV = [
{
service = "minecraft";
proto = "tcp";
port = 25565;
target = "innovation";
}
];
_kerberos.TXT = [ "PVV.NTNU.NO" ];
# E-mail:
# DKIM
"mail._domainkey".TXT = [
"v=DKIM1; h=sha256; k=rsa; "
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsLAI4Fj8lGS1gQbumMCftoynu9G5LCOrs8G/EzbXysKuV5EtCCS3ioJVdt3Bbu5RoTZq0lv0KbIClzW7qPa3u0spt9skOQswkSOhzoraPIwPacEUBRMyc2NYSmnIPthKyb6BTAYB1qcKpRswrNzZ6zbsG8DFD8zEJsbpPGjYSxbluLm+FsQXiX21Biha+psCpDTAGcQODri+Fh5UChYi7MnT7UGd8rvNIYlVPAYPeU0xoUcRRZxHfxLNyOU6TrFQ3MhjSKq06p35y3nN2z/6hjbkxQ8aKc30GB+y2SPrTE8TAXKmIMlWbmhaReFHhOS25XGWfzNVhUfNxa21b5UY7wIDAQAB"
"v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsLAI4Fj8lGS1gQbumMCftoynu9G5LCOrs8G/EzbXysKuV5EtCCS3ioJVdt3Bbu5RoTZq0lv0KbIClzW7qPa3u0spt9skOQswkSOhzoraPIwPacEUBRMyc2NYSmnIPthKyb6BTAYB1qcKpRswrNzZ6zbsG8DFD8zEJsbpPGjYSxbluLm+FsQXiX21Biha+psCpDTAGcQODri+Fh5UChYi7MnT7UGd8rvNIYlVPAYPeU0xoUcRRZxHfxLNyOU6TrFQ3MhjSKq06p35y3nN2z/6hjbkxQ8aKc30GB+y2SPrTE8TAXKmIMlWbmhaReFHhOS25XGWfzNVhUfNxa21b5UY7wIDAQAB"
];
_dmarc.TXT = [ "v=DMARC1; p=quarantine; fo=1;" ];
drift.CNAME = [ "mail" ];
imap.CNAME = [ "mail" ];
mailhost.CNAME = [ "mail" ];
pop.CNAME = [ "mail" ];
smtp.CNAME = [ "mail" ];
list = {
A = pvvHostRecords.microbel.A;
MX = [
{
preference = 10;
exchange = "microbel.pvv.ntnu.no.";
}
];
};
};
}
zones/pvv.org.nix
+9 -19
View File
@@ -1,26 +1,16 @@
{ dns, lib, ... }:
with dns.lib.combinators;
let
pvvHostRecords = import ../pvv-subdomains.nix { inherit dns lib; };
in
{
useOrigin = true; # Don't output fully qualified names
SOA = {
nameServer = "dvask.pvv.ntnu.no";
adminEmail = "drift@pvv.ntnu.no";
serial = 2025021701; # TODO: Automate
};
NS = [
"dvask.pvv.ntnu.no"
"nn.unintett.no"
];
lib.recursiveUpdate (import ../pvv-domain.nix { inherit dns lib; }) {
CNAME = [ "www.pvv.org" ];
subdomains = pvvHostRecords // {
# Override with custom / additional subdomains
subdomains = {
# DKIM
"mail._domainkey".TXT = [
"v=DKIM1; h=sha256; k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwfk8XRbUjXEmnqkZHu6+zH+D6Z26mXZt3SZzKStCdoCz8YGE4N7z4WapOXp/q/5SygY4RJbKvPBi60C0TDTeTbVZ479BGwqveDW3Xa0j7SWE4zM8ygB9wF7iPut4zeQUVPsswpF7FOx4wV8mdECvpjPHr3LmfIcvyJvAy4Au/Vu6hU841sXuMHq0FOUNSz4vcnhgv8uy+QHW38uWqu5D7arL4Md19xGu1Wm5t6m2qegSM1ygWC1kxf2zVHC3dhVInLdc6UPCOZhxhSOYHVRW6muSu6pSxcvJcBLNLBmGBUhEAnkpSfAtq0db6lWl+IcjR9yDfpw2+Q0ULTwhtbY3HQIDAQAB"
];
"mail._domainkey.list".TXT = [
"v=DKIM1; h=sha256; k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxe+hAmB+L9QpPc6q05pRuG/opqnajHV8BydpABgxGbo5gv6RD4JadB9Ve2+38LJ7t7hdjdkIcZA39njFlpekO3ShcjlHi1JpgZ42pSdUbLihRbKnQoAX63WelC8cT7zstpoE31yOlVAyEcMipnc/9pYYX5VsiJEH6iZUyqNu5X81Sldt6EGqCNE+f+fW1ZC1jXICWJ94Ky52qbmra//u/gdHLX/yDSf3W6nU8IRhQf53nORrUOLacEC61mJiCFGmc7u41HYoh50xRLbd5ZLtKPZ/brgEuxQCJsQikqO67l52p6VJskn+1sBof3M6jdsl2e/M2xayrmQqpvEXZpjFCQIDAQAB"
];
};
}
zones/reverse-ipv4.nix
+1 -1
View File
@@ -5,7 +5,7 @@ let
pvvv4Prefix = "129.241.210.";
domainSuffix = ".pvv.ntnu.no.";
pvvHostRecords = import ../pvv-subdomains.nix { inherit dns lib; };
pvvHostRecords = import ../pvv-host-forwards.nix { inherit dns lib; };
# Find all the A-records pointing into the PVV-network, and generate the opposing PTR records
# TODO: Handle duplicates? Avoid NVG-IPs?
pvvHostReverseRecords = builtins.listToAttrs (
zones/reverse-ipv6.nix
+1 -1
View File
@@ -42,7 +42,7 @@ let
(lib.concatStringsSep ".")
]);
pvvHostRecords = import ../pvv-subdomains.nix { inherit dns lib; };
pvvHostRecords = import ../pvv-host-forwards.nix { inherit dns lib; };
# Find all the AAAA-records pointing into the PVV-network, and generate the opposing PTR records
# TODO: Handle duplicates?