From 045ae224dc7462d9d3416cbd0868f93114da1523 Mon Sep 17 00:00:00 2001 From: Noah Pederson Date: Fri, 24 Jul 2026 18:17:53 -0500 Subject: [PATCH] Manage Porkbun DNS with DNSControl --- flake.lock | 6 +- host-specific/misaki/configuration.nix | 1 + host-specific/misaki/dnscontrol.nix | 480 +++++++++++++++++++++++++ 3 files changed, 484 insertions(+), 3 deletions(-) create mode 100644 host-specific/misaki/dnscontrol.nix diff --git a/flake.lock b/flake.lock index 89cf734..18c7838 100644 --- a/flake.lock +++ b/flake.lock @@ -638,11 +638,11 @@ ] }, "locked": { - "lastModified": 1784648624, - "narHash": "sha256-hQPq50+aL2MHrWUKWarKlYZ79nwzw6aCFHa3pRxNs6c=", + "lastModified": 1784934932, + "narHash": "sha256-zNTmEARhmMOx2VRsVjOWepPNz0PEXLqTif6vXBH3two=", "owner": "chiefnoah", "repo": "ngp-nur", - "rev": "a6fa67b2f0613bdb8ed95be22386e3ab13c47bfc", + "rev": "fe84e01975caee61cde6ab44571185ba24bb788c", "type": "github" }, "original": { diff --git a/host-specific/misaki/configuration.nix b/host-specific/misaki/configuration.nix index 8646051..b90ac9c 100644 --- a/host-specific/misaki/configuration.nix +++ b/host-specific/misaki/configuration.nix @@ -2,6 +2,7 @@ { imports = [ ./boot.nix + ./dnscontrol.nix ./users.nix ./hardware-configuration.nix ./networking.nix diff --git a/host-specific/misaki/dnscontrol.nix b/host-specific/misaki/dnscontrol.nix new file mode 100644 index 0000000..23b2c35 --- /dev/null +++ b/host-specific/misaki/dnscontrol.nix @@ -0,0 +1,480 @@ +{ + config, + inputs, + ... +}: +let + record = type: args: { inherit type args; }; + ignoreAcme = [ + { expression = ''IGNORE("_acme-challenge", "TXT")''; } + { expression = ''IGNORE("_acme-challenge.**", "TXT")''; } + ]; +in +{ + imports = [ inputs.ngp-nur.nixosModules.dnscontrol ]; + + ngp.dnscontrol = { + enable = true; + + environmentFiles = [ config.age.secrets.acme.path ]; + providers.porkbun = { + type = "PORKBUN"; + settings = { + api_key = "$PORKBUN_API_KEY"; + secret_key = "$PORKBUN_SECRET_API_KEY"; + max_attempts = "10"; + }; + }; + + zones = { + "athenaeum.wiki" = { + dnsProviders = [ "porkbun" ]; + defaultTTL = 600; + records = ignoreAcme ++ [ + (record "A" [ + "@" + "199.180.249.183" + ]) + (record "A" [ + "*" + "199.180.249.183" + ]) + (record "CNAME" [ + "key3._domainkey" + "key3.athenaeum.wiki._domainkey.migadu.com." + ]) + (record "CNAME" [ + "key2._domainkey" + "key2.athenaeum.wiki._domainkey.migadu.com." + ]) + (record "CNAME" [ + "key1._domainkey" + "key1.athenaeum.wiki._domainkey.migadu.com." + ]) + (record "MX" [ + "*" + 10 + "aspmx1.migadu.com." + ]) + (record "MX" [ + "*" + 20 + "aspmx2.migadu.com." + ]) + (record "MX" [ + "@" + 10 + "aspmx1.migadu.com." + ]) + (record "MX" [ + "@" + 20 + "aspmx2.migadu.com." + ]) + (record "SRV" [ + "_autodiscover._tcp" + 0 + 1 + 443 + "autodiscover.migadu.com." + ]) + (record "SRV" [ + "_imaps._tcp" + 0 + 1 + 993 + "imap.migadu.com." + ]) + (record "SRV" [ + "_pop3s._tcp" + 0 + 1 + 995 + "pop.migadu.com." + ]) + (record "SRV" [ + "_submissions._tcp" + 0 + 1 + 465 + "smtp.migadu.com." + ]) + (record "TXT" [ + "@" + "v=spf1 include:spf.migadu.com -all" + ]) + (record "TXT" [ + "@" + "hosted-email-verify=oecx3mkt" + ]) + (record "TXT" [ + "_dmarc" + "v=DMARC1; p=quarantine;" + ]) + ]; + }; + + "ngp.computer" = { + dnsProviders = [ "porkbun" ]; + defaultTTL = 600; + records = ignoreAcme ++ [ + (record "A" [ + "stats" + "100.72.241.95" + ]) + (record "A" [ + "pds" + "173.249.220.70" + ]) + (record "A" [ + "cache" + "100.72.241.95" + ]) + (record "A" [ + "coder" + "100.72.241.95" + ]) + (record "A" [ + "photos" + "173.249.220.70" + ]) + (record "A" [ + "edge" + "173.249.220.70" + ]) + (record "A" [ + "files" + "173.249.220.70" + ]) + (record "A" [ + "@" + "62.113.212.141" + ]) + (record "A" [ + "id" + "100.72.241.95" + ]) + (record "A" [ + "photos" + "100.72.241.95" + ]) + (record "A" [ + "img" + "173.249.220.70" + ]) + (record "A" [ + "odin" + "100.127.136.117" + ]) + (record "AAAA" [ + "id" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "stats" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "photos" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "@" + "2600:6c44:e7f:25e4:32f7:62cf:307a:20b7" + ]) + (record "AAAA" [ + "odin" + "2604:2b40:21d1:26:3af7:cdff:fec7:54f" + ]) + (record "AAAA" [ + "img" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "files" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "edge" + "2607:9000:1000:8062::" + ]) + (record "AAAA" [ + "coder" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "cache" + "fd7a:115c:a1e0::c901:f15f" + ]) + (record "AAAA" [ + "cache" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "pds" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "CNAME" [ + "key2._domainkey" + "key2.ngp.computer._domainkey.migadu.com." + ]) + (record "CNAME" [ + "pybare" + "pages.sr.ht." + ]) + (record "CNAME" [ + "tsk" + "pgs.sh." + ]) + (record "CNAME" [ + "key3._domainkey" + "key3.ngp.computer._domainkey.migadu.com." + ]) + (record "CNAME" [ + "key1._domainkey" + "key1.ngp.computer._domainkey.migadu.com." + ]) + (record "CNAME" [ + "autoconfig" + "autoconfig.migadu.com." + ]) + (record "MX" [ + "*" + 10 + "aspmx1.migadu.com." + ]) + (record "MX" [ + "@" + 20 + "aspmx2.migadu.com." + ]) + (record "MX" [ + "@" + 10 + "aspmx1.migadu.com." + ]) + (record "MX" [ + "*" + 20 + "aspmx2.migadu.com." + ]) + (record "SRV" [ + "_autodiscover._tcp" + 0 + 1 + 443 + "autodiscover.migadu.com." + ]) + (record "SRV" [ + "_imaps._tcp" + 0 + 1 + 993 + "imap.migadu.com." + ]) + (record "SRV" [ + "_pop3s._tcp" + 0 + 1 + 995 + "pop.migadu.com." + ]) + (record "SRV" [ + "_submissions._tcp" + 0 + 1 + 465 + "smtp.migadu.com." + ]) + (record "TXT" [ + "@" + "v=spf1 include:spf.migadu.com -all" + ]) + (record "TXT" [ + "@" + "hosted-email-verify=g65gltl9" + ]) + (record "TXT" [ + "@" + "garden-domain-verification=WqoReZ4XoIYAuKyGVXHgIhGaODxfAoqkhC0V+XwP0zU=" + ]) + (record "TXT" [ + "_atproto" + "did=did:plc:hjp23blu4y7bgf7zrzhzdemi" + ]) + (record "TXT" [ + "_dmarc" + "v=DMARC1; p=quarantine;" + ]) + (record "TXT" [ + "_github-pages-challenge-chiefnoah" + "b7bf59bbac573ab23ce1ed7482feef" + ]) + (record "TXT" [ + "_pgs.tsk" + ''"ngp-tsk"'' + ]) + ]; + }; + + "packetlost.dev" = { + dnsProviders = [ "porkbun" ]; + defaultTTL = 600; + records = ignoreAcme ++ [ + (record "A" [ + "plex" + "173.249.220.70" + ]) + (record "A" [ + "spindle" + "173.249.220.70" + ]) + (record "A" [ + "blog" + "95.217.30.133" + ]) + (record "A" [ + "jellyfin" + "100.72.241.95" + ]) + (record "A" [ + "*.irc" + "199.180.249.183" + ]) + (record "A" [ + "tiny" + "199.180.249.183" + ]) + (record "A" [ + "knot" + "173.249.220.70" + ]) + (record "A" [ + "nats" + "199.180.249.183" + ]) + (record "AAAA" [ + "nats" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "plex" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "spindle" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "ts" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "odin" + "2604:2b40:21d1:26:3af7:cdff:fec7:54f" + ]) + (record "AAAA" [ + "knot" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "AAAA" [ + "jellyfin" + "2604:2b40:21d1:26:9ab7:85ff:fe1e:dfe8" + ]) + (record "ALIAS" [ + "@" + "prose.sh." + ]) + (record "CNAME" [ + "key3._domainkey" + "key3.packetlost.dev._domainkey.migadu.com." + ]) + (record "CNAME" [ + "key2._domainkey" + "key2.packetlost.dev._domainkey.migadu.com." + ]) + (record "CNAME" [ + "key1._domainkey" + "key1.packetlost.dev._domainkey.migadu.com." + ]) + (record "CNAME" [ + "autoconfig" + "autoconfig.migadu.com." + ]) + (record "CNAME" [ + "resume" + "pgs.sh." + ]) + (record "MX" [ + "@" + 10 + "aspmx1.migadu.com." + ]) + (record "MX" [ + "@" + 20 + "aspmx2.migadu.com." + ]) + (record "MX" [ + "*" + 20 + "aspmx2.migadu.com." + ]) + (record "MX" [ + "*" + 10 + "aspmx1.migadu.com." + ]) + (record "SRV" [ + "_autodiscover._tcp" + 0 + 1 + 443 + "autodiscover.migadu.com." + ]) + (record "SRV" [ + "_imaps._tcp" + 0 + 1 + 993 + "imap.migadu.com." + ]) + (record "SRV" [ + "_pop3s._tcp" + 0 + 1 + 995 + "pop.migadu.com." + ]) + (record "SRV" [ + "_submissions._tcp" + 0 + 1 + 465 + "smtp.migadu.com." + ]) + (record "TXT" [ + "@" + "v=spf1 include:spf.migadu.com -all" + ]) + (record "TXT" [ + "@" + "hosted-email-verify=dkn7r7vi" + ]) + (record "TXT" [ + "_dmarc" + "v=DMARC1; p=quarantine;" + ]) + (record "TXT" [ + "_pgs.resume" + ''"ngp-resume"'' + ]) + (record "TXT" [ + "_prose" + "ngp" + ]) + ]; + }; + }; + }; +} -- 2.51.2