From ec3ca973b39144a3a7577f10457a6ec117185e24 Mon Sep 17 00:00:00 2001 From: Felix Albrigtsen Date: Wed, 21 Jan 2026 21:56:05 +0100 Subject: [PATCH] Generalize pvv-domain.nix, specialize pvv.ntnu.no and pvv.org --- pvv-domain.nix | 95 +++++++++++++++++++++ pvv-subdomains.nix => pvv-host-forwards.nix | 3 +- zones/pvv.ntnu.no.nix | 89 +------------------ zones/pvv.org.nix | 28 ++---- zones/reverse-ipv4.nix | 2 +- zones/reverse-ipv6.nix | 2 +- 6 files changed, 112 insertions(+), 107 deletions(-) create mode 100644 pvv-domain.nix rename pvv-subdomains.nix => pvv-host-forwards.nix (93%) diff --git a/pvv-domain.nix b/pvv-domain.nix new file mode 100644 index 0000000..1c06f4f --- /dev/null +++ b/pvv-domain.nix @@ -0,0 +1,95 @@ +# Shared configuration for the main PVV domains; pvv.ntnu.no and pvv.org (defined in ./zones/), mainly +# - E-mail configuration (MX, SRV, mail aliases) +# - Forward records generated from the ./hosts.nix file +# - Various SRV records + +{ dns, lib, ... }: + +with dns.lib.combinators; +let + pvvHostRecords = import ./pvv-host-forwards.nix { inherit dns lib; }; +in +{ + useOrigin = true; # Don't output fully qualified names + + SOA = { + nameServer = "dvask.pvv.ntnu.no."; + adminEmail = "drift@pvv.ntnu.no"; + serial = 2025021701; # TODO: Automate + }; + + NS = [ + "dvask.pvv.ntnu.no." + "nn.unintett.no." + ]; + + MX = [ + { + preference = 10; + exchange = "microbel.pvv.ntnu.no."; + } + ]; + + # TODO - Re-add priority/weight? + SRV = + let + tcp = "tcp"; + udp = "udp"; + mkSrv = service: proto: port: target: { + inherit + service + proto + port + target + ; + }; + in + [ + (mkSrv "minecraft" tcp 25565 "innovation") + (mkSrv "kerberos" tcp 88 "balduzius") + (mkSrv "kerberos" udp 88 "balduzius") + (mkSrv "kpasswd" udp 464 "balduzius") + (mkSrv "kerberos-adm" tcp 749 "balduzius") + (mkSrv "kerberos-adm" udp 749 "balduzius") + (mkSrv "http" tcp 80 "bekkalokk") + (mkSrv "https" tcp 443 "bekkalokk") + ]; + + A = pvvHostRecords.bekkalokk.A; + AAAA = pvvHostRecords.bekkalokk.AAAA; + TXT = [ + "v=spf1 mx ~all" + ]; + + subdomains = pvvHostRecords // { + # Special services: + minecraft.SRV = [ + { + service = "minecraft"; + proto = "tcp"; + port = 25565; + target = "innovation"; + } + ]; + + _kerberos.TXT = [ "PVV.NTNU.NO" ]; + + # E-mail: + _dmarc.TXT = [ "v=DMARC1; p=quarantine; fo=1;" ]; + drift.CNAME = [ "mail" ]; + imap.CNAME = [ "mail" ]; + mailhost.CNAME = [ "mail" ]; + pop.CNAME = [ "mail" ]; + smtp.CNAME = [ "mail" ]; + + list = { + A = pvvHostRecords.microbel.A; + MX = [ + { + preference = 10; + exchange = "microbel.pvv.ntnu.no."; + } + ]; + }; + }; +} diff --git a/pvv-subdomains.nix b/pvv-host-forwards.nix similarity index 93% rename from pvv-subdomains.nix rename to pvv-host-forwards.nix index 819f943..962098e 100644 --- a/pvv-subdomains.nix +++ b/pvv-host-forwards.nix @@ -1,4 +1,4 @@ -# Generate forwards records from the ./hosts.nix file, intended to be used in the pvv.ntnu.no and pvv.org zones +# Generate forward records (A, AAAA and CNAME) for hosts in ./hosts.nix { dns, lib, ... }: with dns.lib.combinators; @@ -43,6 +43,7 @@ let ) hosts; setCollisions = duplicateKeys hostRecords aliasRecords; + in if builtins.length setCollisions > 0 then throw "Duplicate keys: '${builtins.concatStringsSep ", " setCollisions}' exist as both a host (A/AAAA) and alias (CNAME)" diff --git a/zones/pvv.ntnu.no.nix b/zones/pvv.ntnu.no.nix index 5fec1ee..2319f34 100644 --- a/zones/pvv.ntnu.no.nix +++ b/zones/pvv.ntnu.no.nix @@ -1,97 +1,16 @@ { dns, lib, ... }: -with dns.lib.combinators; -let - pvvHostRecords = import ../pvv-subdomains.nix { inherit dns lib; }; -in -{ - useOrigin = true; # Don't output fully qualified names - - SOA = { - nameServer = "dvask.pvv.ntnu.no."; - adminEmail = "drift@pvv.ntnu.no"; - serial = 2025021701; # TODO: Automate - }; - - NS = [ - "dvask.pvv.ntnu.no." - "nn.unintett.no." - ]; - - MX = [ - { - preference = 10; - exchange = "microbel.pvv.ntnu.no."; - } - ]; - - # TODO - Re-add priority/weight? - SRV = let - tcp = "tcp"; - udp = "udp"; - mkSrv = service: proto: port: target: { - inherit service proto port target; - }; - in [ - (mkSrv "minecraft" tcp 25565 "innovation") - (mkSrv "kerberos" tcp 88 "balduzius") - (mkSrv "kerberos" udp 88 "balduzius") - (mkSrv "kpasswd" udp 464 "balduzius") - (mkSrv "kerberos-adm" tcp 749 "balduzius") - (mkSrv "kerberos-adm" udp 749 "balduzius") - (mkSrv "http" tcp 80 "bekkalokk") - (mkSrv "https" tcp 443 "bekkalokk") - ]; - - A = pvvHostRecords.bekkalokk.A; - AAAA = pvvHostRecords.bekkalokk.AAAA; - TXT = [ - "v=spf1 mx ~all" - ]; - - subdomains = pvvHostRecords // { +lib.recursiveUpdate (import ../pvv-domain.nix { inherit dns lib; }) { + subdomains = { # *.stackit.pvv.ntnu.no handled by openstack-designate stackit.NS = [ "ns1.stack.it.ntnu.no." "ns2.stack.it.ntnu.no." ]; - # Special services: - - minecraft.SRV = [ - { - service = "minecraft"; - proto = "tcp"; - port = 25565; - target = "innovation"; - } - ]; - - _kerberos.TXT = [ "PVV.NTNU.NO" ]; - - # E-mail: - + # DKIM "mail._domainkey".TXT = [ - "v=DKIM1; h=sha256; k=rsa; " - "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsLAI4Fj8lGS1gQbumMCftoynu9G5LCOrs8G/EzbXysKuV5EtCCS3ioJVdt3Bbu5RoTZq0lv0KbIClzW7qPa3u0spt9skOQswkSOhzoraPIwPacEUBRMyc2NYSmnIPthKyb6BTAYB1qcKpRswrNzZ6zbsG8DFD8zEJsbpPGjYSxbluLm+FsQXiX21Biha+psCpDTAGcQODri+Fh5UChYi7MnT7UGd8rvNIYlVPAYPeU0xoUcRRZxHfxLNyOU6TrFQ3MhjSKq06p35y3nN2z/6hjbkxQ8aKc30GB+y2SPrTE8TAXKmIMlWbmhaReFHhOS25XGWfzNVhUfNxa21b5UY7wIDAQAB" + "v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsLAI4Fj8lGS1gQbumMCftoynu9G5LCOrs8G/EzbXysKuV5EtCCS3ioJVdt3Bbu5RoTZq0lv0KbIClzW7qPa3u0spt9skOQswkSOhzoraPIwPacEUBRMyc2NYSmnIPthKyb6BTAYB1qcKpRswrNzZ6zbsG8DFD8zEJsbpPGjYSxbluLm+FsQXiX21Biha+psCpDTAGcQODri+Fh5UChYi7MnT7UGd8rvNIYlVPAYPeU0xoUcRRZxHfxLNyOU6TrFQ3MhjSKq06p35y3nN2z/6hjbkxQ8aKc30GB+y2SPrTE8TAXKmIMlWbmhaReFHhOS25XGWfzNVhUfNxa21b5UY7wIDAQAB" ]; - - _dmarc.TXT = [ "v=DMARC1; p=quarantine; fo=1;" ]; - drift.CNAME = [ "mail" ]; - imap.CNAME = [ "mail" ]; - mailhost.CNAME = [ "mail" ]; - pop.CNAME = [ "mail" ]; - smtp.CNAME = [ "mail" ]; - - list = { - A = pvvHostRecords.microbel.A; - MX = [ - { - preference = 10; - exchange = "microbel.pvv.ntnu.no."; - } - ]; - }; - }; } diff --git a/zones/pvv.org.nix b/zones/pvv.org.nix index 51ad83e..c1cb934 100644 --- a/zones/pvv.org.nix +++ b/zones/pvv.org.nix @@ -1,26 +1,16 @@ { dns, lib, ... }: -with dns.lib.combinators; -let - pvvHostRecords = import ../pvv-subdomains.nix { inherit dns lib; }; -in -{ - useOrigin = true; # Don't output fully qualified names - - SOA = { - nameServer = "dvask.pvv.ntnu.no"; - adminEmail = "drift@pvv.ntnu.no"; - serial = 2025021701; # TODO: Automate - }; - NS = [ - "dvask.pvv.ntnu.no" - "nn.unintett.no" - ]; - +lib.recursiveUpdate (import ../pvv-domain.nix { inherit dns lib; }) { CNAME = [ "www.pvv.org" ]; - subdomains = pvvHostRecords // { - # Override with custom / additional subdomains + subdomains = { + # DKIM + "mail._domainkey".TXT = [ + "v=DKIM1; h=sha256; k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwfk8XRbUjXEmnqkZHu6+zH+D6Z26mXZt3SZzKStCdoCz8YGE4N7z4WapOXp/q/5SygY4RJbKvPBi60C0TDTeTbVZ479BGwqveDW3Xa0j7SWE4zM8ygB9wF7iPut4zeQUVPsswpF7FOx4wV8mdECvpjPHr3LmfIcvyJvAy4Au/Vu6hU841sXuMHq0FOUNSz4vcnhgv8uy+QHW38uWqu5D7arL4Md19xGu1Wm5t6m2qegSM1ygWC1kxf2zVHC3dhVInLdc6UPCOZhxhSOYHVRW6muSu6pSxcvJcBLNLBmGBUhEAnkpSfAtq0db6lWl+IcjR9yDfpw2+Q0ULTwhtbY3HQIDAQAB" + ]; + "mail._domainkey.list".TXT = [ + "v=DKIM1; h=sha256; k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxe+hAmB+L9QpPc6q05pRuG/opqnajHV8BydpABgxGbo5gv6RD4JadB9Ve2+38LJ7t7hdjdkIcZA39njFlpekO3ShcjlHi1JpgZ42pSdUbLihRbKnQoAX63WelC8cT7zstpoE31yOlVAyEcMipnc/9pYYX5VsiJEH6iZUyqNu5X81Sldt6EGqCNE+f+fW1ZC1jXICWJ94Ky52qbmra//u/gdHLX/yDSf3W6nU8IRhQf53nORrUOLacEC61mJiCFGmc7u41HYoh50xRLbd5ZLtKPZ/brgEuxQCJsQikqO67l52p6VJskn+1sBof3M6jdsl2e/M2xayrmQqpvEXZpjFCQIDAQAB" + ]; }; } diff --git a/zones/reverse-ipv4.nix b/zones/reverse-ipv4.nix index 00a158a..b6d0a0a 100644 --- a/zones/reverse-ipv4.nix +++ b/zones/reverse-ipv4.nix @@ -5,7 +5,7 @@ let pvvv4Prefix = "129.241.210."; domainSuffix = ".pvv.ntnu.no."; - pvvHostRecords = import ../pvv-subdomains.nix { inherit dns lib; }; + pvvHostRecords = import ../pvv-host-forwards.nix { inherit dns lib; }; # Find all the A-records pointing into the PVV-network, and generate the opposing PTR records # TODO: Handle duplicates? Avoid NVG-IPs? pvvHostReverseRecords = builtins.listToAttrs ( diff --git a/zones/reverse-ipv6.nix b/zones/reverse-ipv6.nix index 3756637..67f0588 100644 --- a/zones/reverse-ipv6.nix +++ b/zones/reverse-ipv6.nix @@ -42,7 +42,7 @@ let (lib.concatStringsSep ".") ]); - pvvHostRecords = import ../pvv-subdomains.nix { inherit dns lib; }; + pvvHostRecords = import ../pvv-host-forwards.nix { inherit dns lib; }; # Find all the AAAA-records pointing into the PVV-network, and generate the opposing PTR records # TODO: Handle duplicates?