| 1 | D("nixos.org", |
| 2 | REG_NONE, |
| 3 | DnsProvider(DSP_GANDI), |
| 4 | |
| 5 | TXT("@", "apple-domain-verification=OvacO4lGB9A6dBFg"), |
| 6 | TXT("@", "brevo-code:f580a125e215ecb440363a15cdf47a17"), |
| 7 | TXT("@", "google-site-verification=Pm5opvmNjJOwdb7JnuVJ_eFBPaZYWNcAavY-08AJoGc"), |
| 8 | // bluesky account/domain binding |
| 9 | TXT("_atproto", "did=did:plc:bf43o4nxudgubwt4iljpayb7"), |
| 10 | |
| 11 | CAA_BUILDER({ |
| 12 | label: "@", |
| 13 | iodef: "mailto:infra+caa@nixos.org", |
| 14 | iodef_critical: true, |
| 15 | issue: ["letsencrypt.org"], |
| 16 | issue_critical: true, |
| 17 | issuewild: "none", |
| 18 | issuewild_critical: true, |
| 19 | }), |
| 20 | |
| 21 | // nixos.org mailing |
| 22 | MX("@", 10, "umbriel"), |
| 23 | SPF_BUILDER({ |
| 24 | label: "@", |
| 25 | parts: [ |
| 26 | "v=spf1", |
| 27 | "a:umbriel.nixos.org", |
| 28 | "-all" |
| 29 | ] |
| 30 | }), |
| 31 | DMARC_BUILDER({ |
| 32 | policy: "none", |
| 33 | }), |
| 34 | |
| 35 | // discourse |
| 36 | A("discourse", "195.62.126.31"), |
| 37 | AAAA("discourse", "2a02:248:101:62::146f"), |
| 38 | MX("discourse", 10, "mail.nixosdiscourse.fcio.net."), |
| 39 | DMARC_BUILDER({ |
| 40 | label: "discourse", |
| 41 | policy: "none", |
| 42 | }), |
| 43 | SPF_BUILDER({ |
| 44 | label: "discourse", |
| 45 | parts: [ |
| 46 | "v=spf1", |
| 47 | "ip4:185.105.252.151", |
| 48 | "ip6:2a02:248:101:62::1479", |
| 49 | "-all" |
| 50 | ] |
| 51 | }), |
| 52 | TXT("mail._domainkey.discourse", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDmxDhMfDl6lnueSRCjYiWIDeTAJXR9Yw0PfpBfG7GPUIkMyqy9jVGpb4ECVTt9S1zfpr4dbtCgir781oVwZiwGIWzC8y8XsD37wernQIPN4Yubnrnpw+6lill4uA/AuyU/ghbeZ5lW03pHD//2EW4YEu+Jw4aS4rF0Wtk+BlJRCwIDAQAB"), |
| 53 | |
| 54 | // fastly |
| 55 | CNAME("_acme-challenge.cache", "k2hql6g4rigivyu6nn.fastly-validations.com."), |
| 56 | CNAME("_acme-challenge.cache-staging", "kqwx9cvuf7lvjo8u9b.fastly-validations.com."), |
| 57 | CNAME("_acme-challenge.channels", "9u55qij5w2odiwqxfi.fastly-validations.com."), |
| 58 | CNAME("_acme-challenge.artifacts", "bsk6mjvi6b1r6wekb0.fastly-validations.com."), |
| 59 | CNAME("_acme-challenge.releases", "s731ezp9ameh5f349b.fastly-validations.com."), |
| 60 | CNAME("_acme-challenge.tarballs", "vnqm62k5sjx9jogeqg.fastly-validations.com."), |
| 61 | CNAME("cache", "dualstack.n.sni.global.fastly.net."), |
| 62 | CNAME("cache-staging", "dualstack.n.sni.global.fastly.net."), |
| 63 | CNAME("channels", "dualstack.n.sni.global.fastly.net."), |
| 64 | CNAME("artifacts", "dualstack.n.sni.global.fastly.net."), |
| 65 | CNAME("releases", "dualstack.n.sni.global.fastly.net."), |
| 66 | CNAME("tarballs", "dualstack.n.sni.global.fastly.net."), |
| 67 | |
| 68 | // hydra.nixos.org |
| 69 | A("haumea", "46.4.89.205"), |
| 70 | AAAA("haumea", "2a01:4f8:212:41c9::1"), |
| 71 | |
| 72 | A("mimas", "157.90.104.34"), |
| 73 | AAAA("mimas", "2a01:4f8:2220:11c8::1"), |
| 74 | CNAME("hydra", "mimas"), |
| 75 | CNAME("queue-runner.hydra", "mimas"), |
| 76 | |
| 77 | A("pluto", "37.27.99.100"), |
| 78 | AAAA("pluto", "2a01:4f9:3070:15e0::1"), |
| 79 | CNAME("alerts", "pluto"), |
| 80 | CNAME("grafana", "pluto"), |
| 81 | CNAME("monitoring", "pluto"), |
| 82 | CNAME("prometheus", "pluto"), |
| 83 | |
| 84 | A("titan", "159.69.62.224"), |
| 85 | AAAA("titan", "2a01:4f8:231:e53::1"), |
| 86 | |
| 87 | // hydra builfarm |
| 88 | AAAA("eager-heisenberg.mac", "2a01:4f8:d1:a027::2"), |
| 89 | A("elated-minsky.builder", "167.235.95.99"), |
| 90 | |
| 91 | AAAA("elated-minsky.builder", "2a01:4f8:2220:1b03::1"), |
| 92 | |
| 93 | A("enormous-catfish.mac", "142.132.140.199"), |
| 94 | |
| 95 | A("goofy-hopcroft.builder", "135.181.225.104"), |
| 96 | AAAA("goofy-hopcroft.builder", "2a01:4f9:3071:2d8b::1"), |
| 97 | |
| 98 | A("growing-jennet.mac", "23.88.76.75"), |
| 99 | |
| 100 | A("hopeful-rivest.builder", "135.181.230.86"), |
| 101 | AAAA("hopeful-rivest.builder", "2a01:4f9:3080:388f::1"), |
| 102 | |
| 103 | A("intense-heron.mac", "23.88.75.215"), |
| 104 | |
| 105 | AAAA("kind-lumiere.mac", "2a09:9340:808:60a::1"), |
| 106 | |
| 107 | A("maximum-snail.mac", "23.88.76.161"), |
| 108 | |
| 109 | A("sleepy-brown.builder", "162.55.130.51"), |
| 110 | AAAA("sleepy-brown.builder", "2a01:4f8:271:5c14::1"), |
| 111 | |
| 112 | A("sweeping-filly.mac", "142.132.141.35"), |
| 113 | |
| 114 | AAAA("norwegian-blue.mac", "2a06:3a80:0:41::9"), |
| 115 | |
| 116 | // hydra staging area |
| 117 | A("staging-hydra", "130.236.254.207"), |
| 118 | AAAA("staging-hydra", "2001:6b0:17:f0a0::cf"), |
| 119 | CNAME("queue-runner.staging-hydra", "staging-hydra"), |
| 120 | |
| 121 | // services infra |
| 122 | A("caliban", "65.109.26.213"), |
| 123 | AAAA("caliban", "2a01:4f9:5a:186c::2"), |
| 124 | CNAME("chat", "caliban"), |
| 125 | CNAME("docuseal", "caliban"), |
| 126 | CNAME("live", "caliban"), |
| 127 | CNAME("matrix", "caliban"), |
| 128 | CNAME("nixpkgs-swh", "caliban"), |
| 129 | CNAME("survey", "caliban"), |
| 130 | CNAME("vault", "caliban"), |
| 131 | DMARC_BUILDER({ |
| 132 | label: "caliban", |
| 133 | policy: "none" |
| 134 | }), |
| 135 | SPF_BUILDER({ |
| 136 | label: "caliban", |
| 137 | parts: [ |
| 138 | "v=spf1", |
| 139 | "ip4:65.109.26.213", |
| 140 | "ip6:2a01:4f9:5a:186c::2", |
| 141 | "-all" |
| 142 | ] |
| 143 | }), |
| 144 | TXT("mail._domainkey.caliban", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDCLtvNH4Ly+9COXf7InptMvoA7I5O347D7+j+saECt7RRe8yNz4TmhJTyJik+bg7e3+l7EJM0vE6k7xtpGBXACY6CCmg/8EgUi6YnDd126ttJHWpoqO96w4SWX93G+ZnoSC8O5rTPqdaTTkntYDTrw5u5n+7RA8GarZadgmaEzwIDAQAB"), |
| 145 | |
| 146 | A("umbriel", "37.27.20.162"), |
| 147 | AAAA("umbriel", "2a01:4f9:c011:8fb5::1"), |
| 148 | // See `nixos.org.mail.key` in `non-critical-infra/modules/mailserver/default.nix`. |
| 149 | TXT("mail._domainkey", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcgNq4+Y23GxN8Mdza437tL5DuJJZU1y6VzTCwSi6cBNLyBDci2cmqXx/gm1sA3yv7+h+8/OyJpEgcbCIW/Ygs1XLuECqvXVX8MU6Djn4KY+d2sU1tlUdqvNM86puoneQtjEv9rDsjf3HGqaeOcjetFnQW7H+qcNcaEShxyKztzQIDAQAB"), |
| 150 | DKIM_BUILDER({ |
| 151 | selector: "r202605", |
| 152 | keytype: "rsa", |
| 153 | pubkey: "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsMhbyIflWa1rx2eaK23vdo1HxQU+CVT8bKfBaRXFIXk51ihrzutyAN0CH8aXUHoiR3MAeDVHE8ftXXh6exrZut9aXZSvBFQBziWJRvVOM9V6oIQqIFSWeac/4rkoWIpvwwaJpc0YBTxosRjnD0C0J9lFWDpuHd6vpXxdZg/YgM7EADP5A4Dlnv3GHxmDvtRK90M20XVBNiCiYVF+9hgncjIhY5B3Nc8n2vZr01aKNPNkYU5CYc7hlmQHyZQqhg1SjmWUex9Uf85WyEGgT4yJV1b0X11tYQHD0h072uNAxpz8dYgII5J46OteQmOmwGh2WqLOa0Vwt5LtAdwIN7BtDQIDAQAB" |
| 154 | }), |
| 155 | DKIM_BUILDER({ |
| 156 | selector: "e202605", |
| 157 | keytype: "ed25519", |
| 158 | pubkey: "SEawMqEG+q0WauDF9Noe3xSqVuBZqmEBgmStaxpNFHE=" |
| 159 | }), |
| 160 | CNAME("freescout", "umbriel.nixos.org."), |
| 161 | |
| 162 | // ngi |
| 163 | A("makemake.ngi", "116.202.113.248"), |
| 164 | AAAA("makemake.ngi", "2a01:4f8:231:4187::"), |
| 165 | CNAME("buildbot.ngi", "makemake.ngi.nixos.org."), |
| 166 | CNAME("cryptpad.ngi", "makemake.ngi.nixos.org."), |
| 167 | CNAME("cryptpad-sandbox.ngi", "makemake.ngi.nixos.org."), |
| 168 | CNAME("summer", "makemake.ngi.nixos.org."), |
| 169 | |
| 170 | A("tracker-staging.security", "188.245.41.195"), |
| 171 | AAAA("tracker-staging.security", "2a01:4f8:1c1b:b87b::1"), |
| 172 | |
| 173 | A("tracker.security", "91.99.31.214"), |
| 174 | AAAA("tracker.security", "2a01:4f8:1c1b:6921::1"), |
| 175 | |
| 176 | // wiki |
| 177 | A("wiki", "65.21.240.250"), |
| 178 | AAAA("wiki", "2a01:4f9:c012:8178::"), |
| 179 | // Direct access to wiki server in Helsinki (for deployments) |
| 180 | A("he1.wiki", "65.21.240.250"), |
| 181 | AAAA("he1.wiki", "2a01:4f9:c012:8178::"), |
| 182 | DMARC_BUILDER({ |
| 183 | label: "wiki", |
| 184 | policy: "none" |
| 185 | }), |
| 186 | SPF_BUILDER({ |
| 187 | label: "wiki", |
| 188 | parts: [ |
| 189 | "v=spf1", |
| 190 | "ip4:65.21.240.250", |
| 191 | "ip6:2a01:4f9:c012:8178::", |
| 192 | "-all" |
| 193 | ] |
| 194 | }), |
| 195 | TXT("mail._domainkey.wiki", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDa+KjIljYr3q5MWWK7sEYzjR8OcA32zBh9BCPo6/HlY1q2ODTYsmE/FDZWpYMzM5z+ddnuGYdXia322XnZaNpZNoq1TbGYuQ5DsgAEK09CGoLuzONg3PSXTrkG7E2Sd6wstwHGJ5FHxSLKtNoWkknt9F5XAFZgXapO0w54p+BWvwIDAQAB"), |
| 196 | |
| 197 | // test.wiki subdomain with Fastly |
| 198 | CNAME("test.wiki", "dualstack.n.sni.global.fastly.net."), |
| 199 | CNAME("_acme-challenge.test.wiki", "zsz0meyel8hxoy9dtb.fastly-validations.com."), |
| 200 | |
| 201 | // github org/domain binding |
| 202 | TXT("_github-challenge-nixos", "9e10a04a4b"), |
| 203 | |
| 204 | // github pages |
| 205 | CNAME("mobile", "nixos.github.io."), |
| 206 | CNAME("ngi", "ngi-nix.github.io."), |
| 207 | CNAME("reproducible", "nixos.github.io."), |
| 208 | |
| 209 | TXT("_github-pages-challenge-ngi-nix.ngi", "4e8bffbb7ced2aec7be1f8cf3561d6"), |
| 210 | TXT("_github-pages-challenge-nixos", "f3a423ba6916e972cfb1e74f82f601"), |
| 211 | |
| 212 | // netlify pages |
| 213 | A("@", "75.2.60.5"), |
| 214 | A("@", "99.83.231.61"), |
| 215 | CNAME("brand", "nixos-brand.netlify.app."), |
| 216 | CNAME("common-styles", "nixos-common-styles.netlify.app."), |
| 217 | CNAME("docs", "nixos-docs.netlify.app."), |
| 218 | CNAME("planet", "nixos-planet.netlify.app."), |
| 219 | CNAME("search", "nixos-search.netlify.app."), |
| 220 | CNAME("status", "nixos-status.netlify.app."), |
| 221 | CNAME("weekly", "nixos-weekly.netlify.com."), |
| 222 | CNAME("www", "nixos-homepage.netlify.app."), |
| 223 | ); |