1 files changed, 64 insertions, 2 deletions

diff --git a/system/linde.nix b/system/linde.nix
index e3cc8ad0..c0af9144 100644
--- a/system/linde.nix
+++ b/system/linde.nix
@@ -13,8 +13,10 @@ let
   net-gw = "172.31.1.1";
   net-ip6 = "2a01:4f8:c012:23a4::1";
   net-rdnsip = "2a01:4f8:c012:23a4::53";
+  net-acmeip = "2a01:4f8:c012:23a4::715";
   net-mask6 = "64";
   net-gw6 = "fe80::1";
+  domain = "alanpearce.eu";
   ts-domain = "hydra-pinecone.ts.net";
   golink = (builtins.getFlake (toString <golink>)).nixosModules.default;
 in
@@ -156,6 +158,7 @@ in
 
   networking = {
     hostName = hostname;
+    inherit domain;
     useDHCP = false;
     dhcpcd.enable = false;
     nameservers = [
@@ -168,6 +171,7 @@ in
       ${net-ip4} = [ "${hostname}.alanpearce.eu" hostname ];
       ${net-ip6} = [ "${hostname}.alanpearce.eu" hostname ];
       ${net-rdnsip} = [ "dns" ];
+      ${net-acmeip} = [ "acme" ];
     };
     firewall = {
       enable = true;
@@ -225,6 +229,7 @@ in
         address = [
           "${net-ip6}/${net-mask6}"
           "${net-rdnsip}/${net-mask6}"
+          "${net-acmeip}/${net-mask6}"
         ];
         addresses = [{
           Address = "${net-ip4}/${net-mask4}";
@@ -353,6 +358,8 @@ in
     settings = {
       tls = "proxy";
       websocket = true;
+      automigrate = true;
+      smtp = "smtp://localhost:25";
     };
   };
 
@@ -457,6 +464,24 @@ in
     };
   };
 
+  services.postfix =
+    let
+      localUser = "alan";
+      forwardingAddress = "alan@alanpearce.eu";
+    in
+    {
+      enable = true;
+      destination = [ ];
+      domain = config.networking.domain;
+      virtual = ''
+        @${config.networking.hostName}.${config.networking.domain} ${localUser}
+        ${localUser} ${forwardingAddress}
+      '';
+      config = {
+        inet_interfaces = "loopback-only";
+      };
+    };
+
   services.kresd = {
     enable = true;
     # package = pkgs.knot-resolver.override { extraFeatures = true; };
@@ -592,11 +617,37 @@ in
     };
   };
 
+  services.acme-dns = {
+    enable = true;
+    settings =
+      let
+        me = "acme.${domain}";
+      in
+      {
+        general = {
+          listen = "[${net-acmeip}]:53";
+          protocol = "both6";
+          domain = me;
+          nsname = me;
+          nsadmin = builtins.replaceStrings [ "@" ] [ "." ] config.security.acme.defaults.email;
+          records = [
+            "${me}. AAAA ${net-acmeip}"
+            "${me}. NS ${me}."
+          ];
+        };
+        api = {
+          ip = "[${net-acmeip}]";
+          tls = "letsencrypt";
+          port = 443;
+          notification-email = config.security.acme.defaults.email;
+        };
+      };
+  };
+
   security.acme = {
     defaults = {
       email = "alan@alanpearce.eu";
-      dnsProvider = "pdns";
-      dnsResolver = "1.1.1.1:53";
+      dnsProvider = "acme-dns";
       credentialsFile = config.age.secrets.acme.path;
       reloadServices = [ "caddy" ];
       validMinDays = 32;
@@ -731,6 +782,7 @@ in
             ns = config.services.nix-serve;
           in
           {
+            useACMEHost = "alanpearce.eu";
             extraConfig = ''
               reverse_proxy ${ns.bindAddress}:${toString ns.port}
             '';
@@ -740,6 +792,7 @@ in
             srv = config.services.laminar;
           in
           {
+            useACMEHost = "alanpearce.eu";
             extraConfig = ''
               reverse_proxy ${srv.settings.bindHTTP}
             '';
@@ -755,6 +808,15 @@ in
               reverse_proxy ${srv.listenAddress}:${toString srv.port}
             '';
           };
+        "go.alanpearce.eu" = {
+          useACMEHost = "alanpearce.eu";
+          extraConfig = ''
+            encode zstd gzip
+            ${security-headers {}}
+            root * /srv/http/go
+            file_server
+          '';
+        };
       };
   };
   systemd.services.caddy.serviceConfig = {