migrated to linode dns
Ricard Illa
parent
443e5b2f77
commit
ca049cfd79
|
|
@ -1,216 +1,246 @@
|
||||||
// Important:
|
# todo:
|
||||||
// Due to API restrictions, SRV and Dynamic DNS Records can't be created with
|
# I am also creating the subdomain `wg.monotremata.xyz` manually
|
||||||
// terraform, so I need to use `MERGE` mode and set those manually on the
|
# I decided to manage that subdomain outside of terraform because it has a
|
||||||
// namecheap web UI
|
# dynamic IP that I update with a cron job
|
||||||
// https://registry.terraform.io/providers/namecheap/namecheap/latest/docs
|
|
||||||
//
|
|
||||||
// - SRV Record:
|
|
||||||
// service: _matrix
|
|
||||||
// protocol: _tcp
|
|
||||||
// priority: 0
|
|
||||||
// weight: 10
|
|
||||||
// port: 443
|
|
||||||
// target: matrix.monotremata.xyz
|
|
||||||
// TTL: 30 min
|
|
||||||
//
|
|
||||||
// - SRV Record:
|
|
||||||
// service: _xmpp-client
|
|
||||||
// protocol: _tcp
|
|
||||||
// priority: 5
|
|
||||||
// weight: 0
|
|
||||||
// port: 5222
|
|
||||||
// target: xmpp.monotremata.xyz
|
|
||||||
// TTL: 30 min
|
|
||||||
//
|
|
||||||
// - SRV Record:
|
|
||||||
// service: _xmpp-server
|
|
||||||
// protocol: _tcp
|
|
||||||
// priority: 5
|
|
||||||
// weight: 0
|
|
||||||
// port: 5269
|
|
||||||
// target: xmpp.monotremata.xyz
|
|
||||||
// TTL: 30 min
|
|
||||||
//
|
|
||||||
// - A + Dynamic DNS Record:
|
|
||||||
// host: wg
|
|
||||||
//
|
|
||||||
// I also enable DNSSEC from the web UI, because I can't do that with
|
|
||||||
// terraform...
|
|
||||||
|
|
||||||
|
locals {
|
||||||
|
domain = "monotremata.xyz"
|
||||||
|
|
||||||
|
// Alpine VPS hosted on Linode
|
||||||
variable "hosts" {
|
caladan = {
|
||||||
default = {
|
ipv4 = "139.162.137.29"
|
||||||
// Alpine VPS hosted on Linode
|
ipv6 = "2a01:7e01::f03c:92ff:fea2:5d7c"
|
||||||
caladan = {
|
// These are subdomains for services hosted on the host named `caladan`.
|
||||||
v4 = "139.162.137.29"
|
// Both A and AAAA records should be made for them pointing to caladan's ipv4
|
||||||
v6 = "2a01:7e01::f03c:92ff:fea2:5d7c"
|
// and ipv6 respectively
|
||||||
}
|
domains = toset([
|
||||||
// OpenBSD VPS hosted on Vultr
|
local.domain,
|
||||||
fugu = {
|
"git",
|
||||||
v4 = "217.69.5.52"
|
"gts",
|
||||||
v6 = "2001:19f0:6801:1d34:5400:03ff:fe18:7588"
|
"kb",
|
||||||
}
|
"keyoxide",
|
||||||
|
"matrix",
|
||||||
|
"mx2",
|
||||||
|
"pleroma",
|
||||||
|
"pg.caladan",
|
||||||
|
"xmpp",
|
||||||
|
"proxy.xmpp",
|
||||||
|
"upload.xmpp",
|
||||||
|
"groups.xmpp",
|
||||||
|
])
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// OpenBSD VPS hosted on Vultr
|
||||||
|
fugu = {
|
||||||
|
ipv4 = "217.69.5.52"
|
||||||
|
ipv6 = "2001:19f0:6801:1d34:5400:03ff:fe18:7588"
|
||||||
|
}
|
||||||
|
|
||||||
|
// ODROID-HC4 serving as a NAS
|
||||||
|
narwhal = {
|
||||||
|
// These are subdomains for services hosted on the host named `narwhal`.
|
||||||
|
// They are only accessible from my internal network and my internal DNS server
|
||||||
|
// takes care of that.
|
||||||
|
// But I set the public A record to caladan's ipv4 just for renewing their
|
||||||
|
// letsencrypt certificates. No need to set the AAAA record.
|
||||||
|
domains = toset([
|
||||||
|
"authelia",
|
||||||
|
"calibre",
|
||||||
|
"dav",
|
||||||
|
"esphome",
|
||||||
|
"git.narwhal",
|
||||||
|
"gotify",
|
||||||
|
"grafana",
|
||||||
|
"hass",
|
||||||
|
"homer",
|
||||||
|
"influxdb",
|
||||||
|
"jellyfin",
|
||||||
|
"kodi",
|
||||||
|
"mirrors",
|
||||||
|
"mpd",
|
||||||
|
"music",
|
||||||
|
"nextcloud",
|
||||||
|
"nodered",
|
||||||
|
"openbooks",
|
||||||
|
"pg",
|
||||||
|
"pgadmin",
|
||||||
|
"rainloop",
|
||||||
|
"registry",
|
||||||
|
"rss-bridge",
|
||||||
|
"syncthing",
|
||||||
|
"transmission",
|
||||||
|
"wallabag",
|
||||||
|
"woodpecker",
|
||||||
|
])
|
||||||
|
}
|
||||||
|
|
||||||
|
// Raspberry Pi 4 serving as a media center
|
||||||
|
sloth = {
|
||||||
|
// These are subdomains for services hosted on the host named `sloth`.
|
||||||
|
// They are only accessible from my internal network and my internal DNS server
|
||||||
|
// takes care of that.
|
||||||
|
// But I set the public A record to caladan's ipv4 just for renewing their
|
||||||
|
// letsencrypt certificates. No need to set the AAAA record.
|
||||||
|
domains = toset([
|
||||||
|
"kodi",
|
||||||
|
"mympd",
|
||||||
|
"snapweb",
|
||||||
|
])
|
||||||
|
}
|
||||||
|
|
||||||
|
dkim_pub_key = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3dRTQXNdRNKjM/hnTIQ9d6h4qr7hDkoo3D8ySrV4tEcOC9cCD5fWiUzc560GuWPW5nm/VCDt6gHTGbkwsU/ULO+mjKJtvhZtEJnO4WqVG9Hr2whypODkGM9FSwh0yaWV96OJd51upsNRD/S5fKDMRcl09aBYe2rsn/877re/M0wIDAQAB"
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// These are subdomains for services hosted on the host named `caladan`.
|
resource "namecheap_domain_records" "namecheap-monotremata-xyz" {
|
||||||
// Both A and AAAA records should be made for them pointing to caladan's ipv4
|
domain = "monotremata.xyz"
|
||||||
// and ipv6 respectively
|
mode = "OVERWRITE"
|
||||||
variable "caladan-subdomains" {
|
nameservers = [
|
||||||
type = set(string)
|
"ns1.linode.com",
|
||||||
default = [
|
"ns2.linode.com",
|
||||||
"@",
|
"ns3.linode.com",
|
||||||
"git",
|
"ns4.linode.com",
|
||||||
"gts",
|
"ns5.linode.com"
|
||||||
"kb",
|
|
||||||
"keyoxide",
|
|
||||||
"matrix",
|
|
||||||
"mx2",
|
|
||||||
"pleroma",
|
|
||||||
"pg.caladan",
|
|
||||||
"xmpp",
|
|
||||||
"proxy.xmpp",
|
|
||||||
"upload.xmpp",
|
|
||||||
"groups.xmpp",
|
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
// These are subdomains for services hosted on the host named `narwhal`.
|
resource "linode_domain" "monotremata_xyz" {
|
||||||
// They are only accessible from my internal network and my internal DNS server
|
type = "master"
|
||||||
// takes care of that.
|
domain = local.domain
|
||||||
// But I set the public A record to caladan's ipv4 just for renewing their
|
soa_email = format("admin@%s", local.domain)
|
||||||
// letsencrypt certificates. No need to set the AAAA record.
|
|
||||||
variable "narwhal-subdomains" {
|
|
||||||
type = set(string)
|
|
||||||
default = [
|
|
||||||
"authelia",
|
|
||||||
"calibre",
|
|
||||||
"dav",
|
|
||||||
"esphome",
|
|
||||||
"git.narwhal",
|
|
||||||
"gotify",
|
|
||||||
"grafana",
|
|
||||||
"hass",
|
|
||||||
"homer",
|
|
||||||
"influxdb",
|
|
||||||
"jellyfin",
|
|
||||||
"kodi",
|
|
||||||
"mirrors",
|
|
||||||
"mpd",
|
|
||||||
"music",
|
|
||||||
"nextcloud",
|
|
||||||
"nodered",
|
|
||||||
"openbooks",
|
|
||||||
"pg",
|
|
||||||
"pgadmin",
|
|
||||||
"rainloop",
|
|
||||||
"registry",
|
|
||||||
"rss-bridge",
|
|
||||||
"syncthing",
|
|
||||||
"transmission",
|
|
||||||
"wallabag",
|
|
||||||
"woodpecker",
|
|
||||||
]
|
|
||||||
}
|
}
|
||||||
|
|
||||||
// These are subdomains for services hosted on the host named `sloth`.
|
resource "linode_domain_record" "caladan_a" {
|
||||||
// They are only accessible from my internal network and my internal DNS server
|
domain_id = linode_domain.monotremata_xyz.id
|
||||||
// takes care of that.
|
name = each.key
|
||||||
// But I set the public A record to caladan's ipv4 just for renewing their
|
record_type = "A"
|
||||||
// letsencrypt certificates. No need to set the AAAA record.
|
target = local.caladan.ipv4
|
||||||
variable "sloth-subdomains" {
|
for_each = local.caladan.domains
|
||||||
type = set(string)
|
|
||||||
default = [
|
|
||||||
"kodi",
|
|
||||||
"mympd",
|
|
||||||
"snapweb",
|
|
||||||
]
|
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "namecheap_domain_records" "monotremata-xyz" {
|
resource "linode_domain_record" "caladan_aaaa" {
|
||||||
domain = "monotremata.xyz"
|
domain_id = linode_domain.monotremata_xyz.id
|
||||||
mode = "MERGE"
|
name = each.key
|
||||||
email_type = "MX"
|
record_type = "AAAA"
|
||||||
|
target = local.caladan.ipv6
|
||||||
dynamic "record" {
|
for_each = local.caladan.domains
|
||||||
for_each = var.caladan-subdomains
|
}
|
||||||
content {
|
|
||||||
hostname = record.value
|
resource "linode_domain_record" "narwhal_a" {
|
||||||
type = "A"
|
domain_id = linode_domain.monotremata_xyz.id
|
||||||
address = var.hosts.caladan.v4
|
name = each.key
|
||||||
}
|
record_type = "A"
|
||||||
}
|
target = local.caladan.ipv4
|
||||||
|
for_each = local.narwhal.domains
|
||||||
dynamic "record" {
|
}
|
||||||
for_each = var.narwhal-subdomains
|
|
||||||
content {
|
resource "linode_domain_record" "sloth_a" {
|
||||||
hostname = record.value
|
domain_id = linode_domain.monotremata_xyz.id
|
||||||
type = "A"
|
name = each.key
|
||||||
address = var.hosts.caladan.v4
|
record_type = "A"
|
||||||
}
|
target = local.caladan.ipv4
|
||||||
}
|
for_each = local.sloth.domains
|
||||||
|
}
|
||||||
dynamic "record" {
|
|
||||||
for_each = var.sloth-subdomains
|
resource "linode_domain_record" "mx" {
|
||||||
content {
|
domain_id = linode_domain.monotremata_xyz.id
|
||||||
hostname = record.value
|
name = each.value.name
|
||||||
type = "A"
|
target = each.value.target
|
||||||
address = var.hosts.caladan.v4
|
record_type = each.key
|
||||||
}
|
priority = each.value.priority
|
||||||
}
|
for_each = {
|
||||||
|
A = {
|
||||||
dynamic "record" {
|
name = "mail"
|
||||||
for_each = var.caladan-subdomains
|
target = local.fugu.ipv4
|
||||||
content {
|
priority = null
|
||||||
hostname = record.value
|
}
|
||||||
type = "AAAA"
|
AAAA = {
|
||||||
address = var.hosts.caladan.v6
|
name = "mail"
|
||||||
}
|
target = local.fugu.ipv6
|
||||||
}
|
priority = null
|
||||||
|
}
|
||||||
record {
|
MX = {
|
||||||
hostname = "mail"
|
name = local.domain,
|
||||||
type = "A"
|
target = format("mail.%s", local.domain)
|
||||||
address = var.hosts.fugu.v4
|
priority = 0
|
||||||
}
|
}
|
||||||
|
}
|
||||||
record {
|
}
|
||||||
hostname = "mail"
|
|
||||||
type = "AAAA"
|
resource "linode_domain_record" "mx2" {
|
||||||
address = var.hosts.fugu.v6
|
domain_id = linode_domain.monotremata_xyz.id
|
||||||
}
|
name = each.value.name
|
||||||
|
target = each.value.target
|
||||||
record {
|
record_type = each.key
|
||||||
hostname = "@"
|
priority = each.value.priority
|
||||||
type = "MX"
|
for_each = {
|
||||||
address = "mail.monotremata.xyz"
|
A = {
|
||||||
mx_pref = 0
|
name = "mx2"
|
||||||
}
|
target = local.caladan.ipv4
|
||||||
|
priority = null
|
||||||
record {
|
}
|
||||||
hostname = "@"
|
AAAA = {
|
||||||
type = "MX"
|
name = "mx2"
|
||||||
address = "mx2.monotremata.xyz"
|
target = local.caladan.ipv6
|
||||||
mx_pref = 5
|
priority = null
|
||||||
}
|
}
|
||||||
|
MX = {
|
||||||
record {
|
name = local.domain
|
||||||
hostname = "@"
|
target = format("mx2.%s", local.domain)
|
||||||
type = "TXT"
|
priority = 5
|
||||||
address = "v=spf1 mx -all"
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
record {
|
|
||||||
hostname = "_dmarc"
|
resource "linode_domain_record" "mail_txt" {
|
||||||
type = "TXT"
|
domain_id = linode_domain.monotremata_xyz.id
|
||||||
address = "v=DMARC1;p=quarantine;pct=100;rua=mailto:postmaster@monotremata.xyz;;"
|
record_type = "TXT"
|
||||||
}
|
name = each.value.name
|
||||||
|
target = each.value.target
|
||||||
record {
|
for_each = {
|
||||||
hostname = "20201210._domainkey"
|
spf = {
|
||||||
type = "TXT"
|
name = local.domain
|
||||||
address = "v=DKIM1;k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3dRTQXNdRNKjM/hnTIQ9d6h4qr7hDkoo3D8ySrV4tEcOC9cCD5fWiUzc560GuWPW5nm/VCDt6gHTGbkwsU/ULO+mjKJtvhZtEJnO4WqVG9Hr2whypODkGM9FSwh0yaWV96OJd51upsNRD/S5fKDMRcl09aBYe2rsn/877re/M0wIDAQAB;"
|
target = "v=spf1 mx -all"
|
||||||
}
|
}
|
||||||
|
dmarc = {
|
||||||
|
name = "_dmarc"
|
||||||
|
target = format("v=DMARC1;p=quarantine;pct=100;rua=mailto:postmaster@%s;;", local.domain)
|
||||||
|
}
|
||||||
|
dkim = {
|
||||||
|
name = "20201210._domainkey"
|
||||||
|
target = format("v=DKIM1;k=rsa;p=%s;", local.dkim_pub_key)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "linode_domain_record" "matrix_srv" {
|
||||||
|
domain_id = linode_domain.monotremata_xyz.id
|
||||||
|
record_type = "SRV"
|
||||||
|
service = "matrix"
|
||||||
|
protocol = "tcp"
|
||||||
|
priority = 0
|
||||||
|
weight = 10
|
||||||
|
port = 443
|
||||||
|
target = format("matrix.%s", local.domain)
|
||||||
|
ttl_sec = 1800 // 30 min
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "linode_domain_record" "xmpp_srv" {
|
||||||
|
domain_id = linode_domain.monotremata_xyz.id
|
||||||
|
record_type = "SRV"
|
||||||
|
service = each.key
|
||||||
|
protocol = "tcp"
|
||||||
|
port = each.value.port
|
||||||
|
priority = 5
|
||||||
|
weight = 0
|
||||||
|
target = format("xmpp.%s", local.domain)
|
||||||
|
ttl_sec = 1800 // 30 min
|
||||||
|
for_each = {
|
||||||
|
xmpp-client = {
|
||||||
|
port = 5222
|
||||||
|
}
|
||||||
|
xmpp-server = {
|
||||||
|
port = 5269
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue