Merge 3c1ec0f287 into 56cf4e9212

nix/modules/caddy/default.nix

@@ -4,6 +4,7 @@ let
   caddy = pkgs.caddy.withPlugins {
     plugins = [
       "github.com/noratrieb-mirrors/certmagic-s3@v1.1.3"
+      "github.com/caddy-dns/rfc2136@v1.0.0"
     ];
     hash = "sha256-HdCXbqrrGPZSdHv7bZvGz9T6loVbrfKydTbjTyt5Wt0=";
   };
@@ -47,6 +48,17 @@ in
         insecure true
       }
 
+      acme_dns rfc2136 {
+        key_name "test"
+        key_alg "hmac-sha256"
+        key ""
+        server "dns1.local:53"
+      }
+
+      tls {
+        dns_challenge_override_domain "nilstrieb.dev"
+      }
+
       servers {
         metrics
       }

nix/modules/dns/default.nix

@@ -1,6 +1,12 @@
-{ pkgs, lib, networkingConfig, ... }:
+{ pkgs, lib, networkingConfig, config, ... }:
 let metricsPort = 9433; in
 {
+  age.secrets.knot_dns_rfc2136_key_config = {
+    file =
+      ../../secrets/knot_dns_rfc2136_key_config.age;
+    owner = "knot";
+  };
+
   # get the package for the debugging tools
   environment.systemPackages = with pkgs; [ knot-dns ];
 
@@ -21,12 +27,25 @@ let metricsPort = 9433; in
 
   services.knot = {
     enable = true;
+    keyFiles = [ config.age.secrets.knot_dns_rfc2136_key_config.path ];
     settingsFile = pkgs.writeTextFile {
       name = "knot.conf";
       text = ''
         server:
             listen: 0.0.0.0@53
             listen: ::@53
+        
+        key:
+          - id: rfc2136-update
+            algorithm: hmac-sha256
+            secret: QRpeYCJLokRWyzT/tWrxaly5Seb5yTkE6/Ub66edWds=
+        
+        acl:
+          - id: update_acl
+            address: 10.0.0.0/24
+            key: rfc2136-update
+            action: update
+            update-type: [TXT]
 
         zone:
           - domain: noratrieb.dev
@@ -35,6 +54,7 @@ let metricsPort = 9433; in
           - domain: nilstrieb.dev
             storage: /var/lib/knot/zones/
             file: ${import ./nilstrieb.dev.nix { inherit pkgs lib networkingConfig; }}
+            acl: update_acl
         log:
           - target: syslog
             any: info

nix/modules/dns/noratrieb.dev.nix

@@ -51,6 +51,9 @@ let
         ns1 = dns1;
         ns2 = dns2;
 
+        # --- ACME setup for caddy
+        _acme-challenge.CNAME = [ (cname "_acme-challenge.nilstrieb.dev.") ];
+
         # --- website stuff
         blog = vps1;
         www = vps1;

nix/secrets/docker_registry_password.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg kxQujT+O6ZGlzTONdS/18DUVoxNapwtxitQo8GKr2hc
-b7KjCjuvhmWcqNB6BvNruL17Ww6yWkVKjjm/MGd+jlE
---- q3EzroLr8b0T2gKQ4xUR67YOLSwFP1V8UxAnKY0PP24
-ﾟl貊0嬌1ｽCXq<58>謎{T姻tg傅ﾘﾟｭﾍ<EFBDAD>ﾛ捕詑<E68D95>ｦ<EFBFBD>s5<13>hxk-
+-> ssh-ed25519 qM6TYg py66rUtQIWm6K163vaJaoAseekNA70yQKMDH1FkWYVc
+rP7T1akj7LmzIcJeoK+mq+GfOjWpnWFnSpUhIA9Vihc
+--- UjRtQl6/Gz3QPiLhSyksrsRvFoCjiCKi4D0HdBb1dJY
+¦àq™ƒ(¯mÑzÁºÚhžØÒàk½šÔHÚ9:¾ãM>c–=”ά֦äÀMŠ”â³L1

nix/secrets/forgejo_s3_key_secret.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg yxVVZ7LOgN9NiKsl1+dN7Rp6Rsf0zlqb25Y6w43styk
-gQ5g7TL8+lyGp0SxdcoRg0nTpu1w6WbZZK0ERyqRpkc
---- 5uKpMbkW4zZ035mNXCuty+64IZ360gly/ezxnwtRX/0
-šË<EFBFBD>ô±ëSϸ>q!ŁźěOß·żźŤ”ÉT››CU˙ż¸ŁŇşž<C59F>Ď[ń*󅬟«’\wźÝ‹tcÇ×Őíg?
|B±ŘĹë;’»"*îd<C3AE>Wţ<57>ţÔvŔ/vĚnqe
+-> ssh-ed25519 qM6TYg DlJpvGP2I1iGodnEufzr0qCAmmU6XiKbnNCRJmjPsHs
+upNAkX1DPfs7AJi+/hUKKcehn7tTcR0knW8W+kP1u/k
+--- ZEI6vM0+n33fVLPssJyEWYW/xNgoa0/2BIZeG3NzBrk
+¯¾-r `
+ÈgR/n´|òS“\h}•LR£áèE‡Ú@ø„¦ðš‡‚˜OüåjF"VŠ¶¨ëív-ƒqË“<C38B>ðxjf´Ì
ŒÂ­f=×ÁaI¤‚8–òÖѦãlÃàž	C

nix/secrets/generic_backup_password.age

@@ -1,14 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg IBVFRlOVLHcuS6xa7UVGA1z9NTBtNwGbt94c/yTB8wE
-T+VtsTngND9kAd6DAtksXN4xYs+E8JZSxDeOm+G23tc
--> ssh-ed25519 91VHug nUkRwHgpn2i56NNY0VAuG+r3CX1rjt1M0ZVKj+ijwGo
-ea8Ry6JIJlPOObY+v2Q5MkdcZqCeDLAOxC583WY38Hg
--> ssh-ed25519 XzACZQ 7f+8YcecMvwnOgwxjRMUUUm9Sp4cyKpIZWWMDrrCtzg
-Bqhd2kpuTg3Xchme5wHfg4zkuikeM4H9GdOZVUv+HZk
--> ssh-ed25519 51bcvA DUk4CsGXhdj4uIqzYpoGmtHs5dnjIBUb0c9zj1DEum4
-hGe3j5Ycn/WVV5wgg+vZuh2KhnamHACkHrDWcVgkSjo
--> ssh-ed25519 vT7ExA Zf67OkbMvOpgABZDuXw3U94KqX32VG8nnjo3Xmkbih0
-5K5fnBxkQDaYwuMPhyNU5ZrZLjkgknG7dzMzyuANMuU
---- Jon4j4/xeZqS/6KsWszsVOoVOgJgsPEKxmtC7PcocCA
-Ú솳—µ’~Š…
-¢íNŒ+jKþ߬Ÿ/á]Ó !䂶Œ¢.7\«–„k~<÷ñfÃCÖT.ªO
ŸêÅ¥*aÁ
•Û
+-> ssh-ed25519 qM6TYg SrZQBYLsUcrDu6ds1fJAyjM+mHPpAW04U6yRqA/TjH8
+LZUTPquz+YNmlRWrXwY2fvXsVwOEM/uhzWcaf7WsY5o
+-> ssh-ed25519 91VHug sVXnaD5sruvFKnPwldWzlH8KUIeZ/toWqYe/F2tfBX0
+CapfF55c1MvBDcDywNpnS4blYwD0HrPyrcncMRbl5lo
+-> ssh-ed25519 XzACZQ WqU7ebK4SnCyxP4zxIdmMDAaH7mk2HpgvUwbFWhoNWs
+wm0ZtnIQCKZW+WJIDtAIdOQkvp5LLyvTQ2vNFC7C26U
+-> ssh-ed25519 51bcvA xtMa2mIZ7GHOFJEcpZjr13vOovJsyo9fMWAnm66pxEg
+DqNSop7GSDMvsDzu9NK5ubf2xWMLX1fFLSiZUA42RUU
+-> ssh-ed25519 vT7ExA 24tU87648MvZgbvt9PNWBUQsQBDyeBd2QV0jiKGMwWs
+mSuA/G6ZjRYhG3TMGt8SQ8aqK8s9s81YBslBwQLr4Fg
+--- sr5nQObjSdkQ+eILGm+p/nnD1XxrcCXwVY70INFlZMU
+ÚÊ›.ê)¶½uT}nw?”ñ‡]4^žjk„ž…*y"©#Oû÷N*6}ÿÏyIÙ†
<01>.7ÄT˜¥ïSéº- ©R©

nix/secrets/grafana_admin_password.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ OeTS5wU4ac+Qh7s1PXbdFH3LDlRW1LV+qFtoVGI47XQ
-JsixYPLzpnF45ODQH7nuVowXzwbNQi8lWx1Bp2YFVWc
---- MEG4bfGwoFRm9HizYdqtK7KApYhYH+QjAIEp7CpLznA
-CŒ¢µÍ/wC
-F‘<EFBFBD>zÙ?ŸMÀõókÙr‰ Žx£N¸©'NTzùà¼WŽÈb¹åº{›ÞóÕéAj3X6m¹Ý²²J@í¼OI—{u<15>ßý
”Ï?¹ A,CÃdûý^
+-> ssh-ed25519 XzACZQ 8I9FjYxsWRwFE9W5eUEA3CdAG1etcJsYrT/QIFTkf18
+bmwA4zP6sG54vh1l8tAW7i7g5L6y7bB6jj43YaGIC9U
+--- c3xQGTTlsALUeTz+FbECQMUPmp4/PHTaosgDRzOIrk0
+9‡,<1C>ö$ĂJE%Ůł2×`¬ÄźśřK:aĽţ]ßŢ,ĚTM>µŠ°Ň›xŽô-yn€ˇ§ö|®Ý/‚źŠ+ňµęO˛˘×Z‚¨QűWŹĹqh^÷]Ž^Ě€˝$?

nix/secrets/knot_dns_rfc2136_key_config.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 LZU5Eg rwUOiYywkv8pql/vl0b4K10Ic2oTijgDY3j2Y4e5elY
+8HAY4fQqjST5LqwZQIw83Z3cLZqnziq/czDpkJ/ncaM
+-> ssh-ed25519 5bWSnQ E6u+2wa3+f3iRxFCSa8evey5D703lNTGrsMT5hJhSGo
+RRuKjTOOunRLD2re/Vy87maIkNLiFa0p0AugeYbGpEk
+--- +5iOAG1dYXmUdxXY0dN8bhFpylZhVn90M0/OSbNTSL0
+(¿‚"`4*€¦7gY¼šØ<C5A1>¤±ÞNš9§TˆpžÆZµ•Ë,<2C>¡ç<²ÞzæeŠtdz몲œÄÐÂó;ãÓA‰õB¬
’.[<5B>õ¤ú*N¶	
+Œ<EFBFBD>š¼éZö`jM¼Íÿò+=ÕÝBq=³ ÅEŽ¥Q{þ™Ûƒ’S~
+ßÊF	©a€<61>¨­IhD:¯pA{
+îµ

nix/secrets/minio_env_file.age

@@ -1,8 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg k3jtd2qoiQCsKZYJliH9ySFuO7CVQQ5Sv2ikFYcaD2c
-TSIg6y4C2WaLQJUyNT3HQOj09VmKSkQxlsVlaDc+1tY
--> ssh-ed25519 XzACZQ NZhP9TD5nYxBMgO1O3vDOITeh7qxq4vhjG7AppQmRlM
-I1JiT8ISWLVUgoCphHSbhYvfssfP55NuBI2jclG3DVQ
---- 6UR3wbSTB/f0s8hP/YHaY9HFDpnLAts0yksKCv7p9BA
-¤<EFBFBD>­iÓÆg50ß2LQÑî°káL†
-»vÛB×$5Ñ˵m²¾#„{_8Õê‹ÏÞj&+<2B><>Ñ;Zûç-'ƒÐWHSòÑ‹aÄæ·f?óÎ56[t8¿¥&Zë¸_/î3BÀ”Ó_4½n
+-> ssh-ed25519 qM6TYg t4OIcjhlaEBxFFK/VibGcE0D5zb4LrMv0zS1vxMKxHA
+/OIYeC0s9Jd5R6MaLQPHlgscrSkNwpdK1doADIZwmHE
+-> ssh-ed25519 XzACZQ 7ieKRLiY3EzGlRcAzxnhzDQkUMmpNutUViBeMrSkWkM
+qxeyBVm6aHDH7oQXDShuEqUGY9W8bp2vHfWvJEssfLg
+--- RuCRpuvvN5pIBe4zMaF0X0J5oW2z9ytkSfwKdkQlqo4
+t9͆“¤ľ™żáî/ˇý‹”/d3Žĺů˝ÚńfůÁŁY.hÝdg"°Á,<ÉZc„1ú“EŃĽš•(ČÖ}ô›ĂâĎĄÄEÖ ®}tMŇü`H¸]w¸ŃWÁ?ú~(T]~'

nix/secrets/secrets.nix

@@ -28,6 +28,8 @@ in
   "pyroscope_s3_secret.age".publicKeys = [ vps3 ];
   "restic_backup.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ];
   "generic_backup_password.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ];
+  "knot_dns_rfc2136_key_config.age".publicKeys = [ dns1 dns2 ];
+  "knot_dns_rfc2136_key_envvar.age".publicKeys = [ vps1 vps2 vps3 vps4 vps5 ];
   "wg_private_dns1.age".publicKeys = [ dns1 ];
   "wg_private_dns2.age".publicKeys = [ dns2 ];
   "wg_private_vps1.age".publicKeys = [ vps1 ];

nix/secrets/wg_private_dns1.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 LZU5Eg o+MPatbYPM3sZq0MCqvvxlvKMQwlbajHURPQ+0g0qm8
-UUurAYkPWXCaow746EV4dAQ+qTJnHIehcorUmanBc+o
---- BV+bxd0OIc3J4uT39al2odyn8ScDpq58SiwnW5pvRj4
-òçT7W
 í|õfJÞÜ%"cõôäqÁ{TãP~f<>v,;Ñ:å…<C3A5>¾êŒ-ÓÏšÛ4þ€a† æ-¯uÌ\L
ƒ_-¼VHâøûš³½%
+-> ssh-ed25519 LZU5Eg 2I80UG4n18vxvqUJXwKeAPqelD83nX/n8XHi/XVq208
+mDoUzJu9KfUFyzJPoLPU+xhSbGesECEQZSSrc38HA54
+--- J9+vPA8z+/8jcO/V9iVZ3tWJF4TUe+nD6fmjH6f5dmc
+ŠsÄt´÷	v¶@<(xÃÞ÷Eh»µ]8eÔý-$<24>K00”T!Å“ÀŽŸÄ<¬"5SCÔ#ÆFÐÃZ³¼¾é©wabèû

nix/secrets/wg_private_vps1.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg yrPEC7nKTt4PKp+tbxOQhhSHkd3Y5U112Tr1Vj8NUjc
-ke3GsnxeaGLvKNknBY8SQZj6zOh2c+CiCf3sZXyapn8
---- 0VBTTW//qOcMYVLZ2jFekgouWeZx4h5JPW1H8Sa4bIs
-Ű˙	÷&4'_Xr#X<>ó^drľŻ	TY%u!.v)eY‹ŐŢ•ŃGŢż(AP·ˇcÜÍôwOśf"ŹĹŢő¤yÍmŕqŔ1Çe<C387>UŞ‹
+-> ssh-ed25519 qM6TYg VKztNtIZQAJuwFI/DeAmW4RyaoGxMGpYmBPJRJYLzww
+0zo3XFJ/tE5O+AFMhhJUP1iCpIgC/d1qr8qpJ1viPj0
+--- Wq8DPbQIPnB46bI0allcQdlFZIOGK8Bp1sAywezGVe8
+“`¤Ì8vM d<>(hy, V+=ÔQ×ÏXðå¸#A‚q½¸—>	ÙZ˜6®ƒ[AQŠé[é­ëf&°Øz­¨eu*v>d½·ÓÂzÄ 

nix/secrets/wg_private_vps2.age

@@ -1,8 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 91VHug cjq3el2rlJCWS3VwM5Dt22Ot/PoCdU5wJWTMosYQ6VE
-w/IyVNNAObRJxpV162CojPRE8yYbXJj1kaCBoPo3rNk
---- EDM/kgV9ewXhMvrQfHDtPLl7W46VCbZL5ciBO/B+Iu8
-cL>¡‡È&ð°Â²=°^³$Úüm TüãÃ4õ&
-ƧÀÀI–¢Ç)
-c
-¶LQiŠµá6ÓRÞÐòS•Üøÿ+T@ó0=ÉÉðö
+-> ssh-ed25519 91VHug YHHrtch+bKHxenRqMPSvqqby7odUGontauTfAfTAhlw
+VDY1jPyeClwpg7Tq604rU+Po+nue7cBRqhIEdc8iiAk
+--- mUabX/gruf9Erp4OeRmCEwd7KR2aTApviipXyCL1P+g
+“š¨	ˇťŚ‹ɤR<C2A4>-ĎGuÔÄű™:7€+"SŇ5ěÔSSÇ3\ÁRpMď?s0±Ś<C2B1>$ć’@ţ°±ń…řűÎČô€Ň$§…) ýí

nix/secrets/wg_private_vps3.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 XzACZQ lm64+fQEWa9hF98cV/x1U3Mz+6zuM23dAV3XkwE7iz4
-7Rgqd13DThp/JLryCe5xTdXwDujaTj4viR2CBTdXYLs
---- pwebssA2O2VjzPFRAQ0/65+qiiF/MijCIIXexwH5mgk
-\ ‹fóËæÅv×̤ä[§ýÚŸÆIŒ´†[—5á÷*×·90²'ý4Âôî+áV<C3A1>;L›‹~jÌÂà¦
‹úœ†;ÝÒSÁª2y·b
+-> ssh-ed25519 XzACZQ YPlkpgsyOotrVR/rKOrNqPSBcLYF2U+aZWtPzB8RsEs
+zJkNWK8QjKC/DfvjrU8Js1p1ajm1fnrdcNr5g4+rTS4
+--- 7xKrN9yAcMbmvdQwchhkaT8CZTGguUTDPZ2LKxSxppY
+¡éñq›C”µk˜P»eŠëè@}p¡2qÏU¨n!•WÁï<C381>¹íßáØ‚käöžZ襟3Ò÷ޞеù.ê€<ÊðãQr<51>î&˜à…0¨Á

nix/secrets/wg_private_vps4.age

@@ -1,7 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 51bcvA mVJPirZJQxHgpX6CkMckYTpJk6HYN7CZYlUPPF1mYDM
-XVZqovyalftEtV//FQM11Za+YAEMAuBTypcPQz1+G3E
---- 7QAtADWyWr8SY3jLLzKxPsedOLyasfLs4lK3nmhkOi0
-]J„éÄÑäXt‘E¬šŽæ)<29>þ–ÿhS
<01>ö¾º»ÈF·
-ïÈÓ×þ¤$’Ò2"ðTö‚¾aû`’†Ä®ùÒ{ŸŽ<>:=
-
+-> ssh-ed25519 51bcvA kyLCrT3jFu1BszuLMnyP0ej1kL5OvnAu/R6vR+PtYWU
+n70Krz1NA1BHhMrJQprm+LBBhY8AeQwI1PvHbF628OE
+--- VbdM9HH1CM+4f6z/5oSId9DW6Gi1+q3IuCE6qPKg1mM
+Ą@T˝YÔ(ÇčQŁLYŹŮGHGnk†¤	,®]&§ď
%UfÇĺMő±W“´qx”őźJkÚ_k¨ëh(yŚk|<04>»
*=ŇIk
Ź

nix/secrets/wg_private_vps5.age

@@ -1,5 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 vT7ExA G9mqOZiAvq+ot4OUevoxvNPIkgWgS8KqMY76uGsxeGs
-AMEwoZoFc+axirDc5q+FM3e76IedkxblC3vVqUjmPL8
---- oXGSsFKfJRPvcU1X3zHN7M6vd0IxBpNowyh4sPesq3A
-¢¡i3<><18>¥Ÿûôc—ÿòØMÄTN0—‰}r"Зs˜Œ§ö~þ<>OrP˜®ÃîFP`Q•˜¯<º%å:7ø3ç‚
+-> ssh-ed25519 vT7ExA 2giKg2lnsURC0VqDT8Ibfn9jvkIJUOwIZkRN0Px8OSo
+g3ZQzVSDVUl/BX3tAktgkFk5lVKgplZa+vtLYSd+RW8
+--- 9ZTtNf9EG2B6oDyWYST8QiNGQHdYgQ5PoHzEHwW2eY8
+ÝÐœ?Ÿ<>Mâ-<2D>À€b÷>[Á;°^]·v|¤.
+<EFBFBD>Iüòyˆ
lþM’<>¹s|ÂN5úUÑój
+ƒä:¬á€ìʦý¤›ò<E280BA>ET½

nix/secrets/widetom_bot_token.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 qM6TYg oaTrhtYhEl2Za2fhNt0BgnjXPCkzo1Or9jsLLCnJhzA
-Wk99OfMEXXG+cV1LEvC9wf0GeVgT1Z2GA0AtLYCRKD4
---- 4U4dwN+tJ2LFpIjxEaoZ6HHV5QQU4kr0r0pDXKKcTgE
-NäÖ]èn<C3A8>Ý?óã€àð‚ý¹!ý|!ƒ³:Öú»ÐÁMlØ*Èý
Ü'÷×?E ØùôM@Ér_iÎvo:Niõlk<13>¾8S(ÿ:øÖŠÇR/0^xiÛ[x‹Cå
+-> ssh-ed25519 qM6TYg Xds9FlVzv4E6ZFFTH6zZwG8ewomPq5R3S3/8jDN7zw0
+l1EWvQR0RK865mVQVuCFuo+02HTzrHHlsY9r+E2/Nfc
+--- n9KSdsLECG7uH0yD5GsWC/1mTDMXi/JLDJ++oUycTEs
+ÉL«wÐÜð-§b—}ó¶T6ÁúkíÀX›SŒÒ¢óF3¾q4Ÿèy·¬hzÒ?hSÖ8<C396>Ïb=ƒ1)ÑP*{˜Ëº
S>Ø(æ<>Vë+<2B>1yð#*ÂiêBS