@cryptotaxi247 / infra / commits / cb4cda28

dns: import nixos.org into dnscontrol

Martin Weinelt committed Mar 29, 2025 at 03:48 UTC cb4cda28824db9a5eeeaef238375f4ad3e09745d
7 files changed +217
.github/CODEOWNERS
+1
@@ -3,6 +3,7 @@
3 /.github/ @NixOS/infra-build
4 /build/ @NixOS/infra-build
5 /builders/ @NixOS/infra-build
6 +/dns/ @NixOS/infra-build
7 /lib/ @NixOS/infra-build
8 /macs/ @NixOS/infra-build
9 /metrics/ @NixOS/infra-build
dns/.envrc new
+2
@@ -0,0 +1,2 @@
1 +# shellcheck shell=bash
2 +use flake .#dnscontrol
dns/creds.json new
+7
@@ -0,0 +1,7 @@
1 +{
2 + "netlify": {
3 + "TYPE": "NETLIFY",
4 + "token": "$NETLIFY_TOKEN",
5 + "slug": "nixos"
6 + }
7 +}
dns/dnsconfig.js new
+9
@@ -0,0 +1,9 @@
1 +DEFAULTS(
2 + DefaultTTL("1h"),
3 + NAMESERVER_TTL("24h")
4 +);
5 +var REG_NONE = NewRegistrar("none");
6 +var DSP_NETLIFY = NewDnsProvider("netlify");
7 +
8 +require("nixos.org.js");
9 +
dns/flake-module.nix new
+11
@@ -0,0 +1,11 @@
1 +{
2 + perSystem =
3 + { pkgs, ... }:
4 + {
5 + devShells.dnscontrol = pkgs.mkShellNoCC {
6 + packages = [
7 + pkgs.dnscontrol
8 + ];
9 + };
10 + };
11 +}
dns/nixos.org.js new
+186
@@ -0,0 +1,186 @@
1 +D("nixos.org",
2 + REG_NONE,
3 + DnsProvider(DSP_NETLIFY),
4 +
5 + TXT("@", "apple-domain-verification=OvacO4lGB9A6dBFg"),
6 + TXT("@", "brevo-code:f580a125e215ecb440363a15cdf47a17"),
7 + TXT("@", "google-site-verification=Pm5opvmNjJOwdb7JnuVJ_eFBPaZYWNcAavY-08AJoGc"),
8 +
9 + // nixos.org mailing
10 + MX("@", 10, "mx1.improvmx.com."),
11 + MX("@", 10, "mx2.improvmx.com."),
12 + // TODO: Replace with the following MX records once we migrate away from ImprovMX
13 + //MX("@", "umbriel")
14 + SPF_BUILDER({
15 + label: "@",
16 + parts: [
17 + "v=spf1",
18 + // TODO: Remove once we migrate away from ImprovMX
19 + "include:spf.improvmx.com",
20 + "a:umbriel.nixos.org",
21 + "~all"
22 + ]
23 + }),
24 + DMARC_BUILDER({
25 + policy: "none",
26 + }),
27 + // TODO: Remove once we migrate away from ImprovMX
28 + CNAME("dkimprovmx1._domainkey", "dkimprovmx1.improvmx.com."),
29 + CNAME("dkimprovmx2._domainkey", "dkimprovmx2.improvmx.com."),
30 +
31 + // discourse
32 + A("discourse", "195.62.126.31"),
33 + AAAA("discourse", "2a02:248:101:62::146f"),
34 + MX("discourse", 10, "mail.nixosdiscourse.fcio.net."),
35 + DMARC_BUILDER({
36 + label: "discourse",
37 + policy: "none",
38 + }),
39 + SPF_BUILDER({
40 + label: "discourse",
41 + parts: [
42 + "v=spf1",
43 + "ip4:185.105.252.151",
44 + "ip6:2a02:248:101:62::1479",
45 + "~all"
46 + ]
47 + }),
48 + TXT("mail._domainkey.discourse", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDmxDhMfDl6lnueSRCjYiWIDeTAJXR9Yw0PfpBfG7GPUIkMyqy9jVGpb4ECVTt9S1zfpr4dbtCgir781oVwZiwGIWzC8y8XsD37wernQIPN4Yubnrnpw+6lill4uA/AuyU/ghbeZ5lW03pHD//2EW4YEu+Jw4aS4rF0Wtk+BlJRCwIDAQAB"),
49 +
50 + // fastly
51 + CNAME("_acme-challenge.channels", "9u55qij5w2odiwqxfi.fastly-validations.com."),
52 + CNAME("_acme-challenge.releases", "s731ezp9ameh5f349b.fastly-validations.com."),
53 + CNAME("_acme-challenge.tarballs", "vnqm62k5sjx9jogeqg.fastly-validations.com."),
54 + CNAME("cache", "dualstack.v2.shared.global.fastly.net."),
55 + CNAME("cache-staging", "dualstack.v2.shared.global.fastly.net."),
56 + CNAME("channels", "dualstack.v2.shared.global.fastly.net."),
57 + CNAME("releases", "dualstack.v2.shared.global.fastly.net."),
58 + CNAME("tarballs", "dualstack.v2.shared.global.fastly.net."),
59 +
60 + // hydra.nixos.org
61 + A("haumea", "46.4.89.205"),
62 + AAAA("haumea", "2a01:4f8:212:41c9::1"),
63 +
64 + A("mimas", "157.90.104.34"),
65 + AAAA("mimas", "2a01:4f8:2220:11c8::1"),
66 + CNAME("hydra", "mimas"),
67 +
68 + A("pluto", "37.27.99.100"),
69 + AAAA("pluto", "2a01:4f9:3070:15e0::1"),
70 + CNAME("alerts", "pluto"),
71 + CNAME("grafana", "pluto"),
72 + CNAME("monitoring", "pluto"),
73 + CNAME("prometheus", "pluto"),
74 +
75 + // hydra builfarm
76 + AAAA("eager-heisenberg.mac", "2a01:4f8:d1:a027::2"),
77 + A("elated-minsky.builder", "167.235.95.99"),
78 +
79 + AAAA("elated-minsky.builder", "2a01:4f8:2220:1b03::1"),
80 +
81 + A("enormous-catfish.mac", "142.132.140.199"),
82 +
83 + A("goofy-hopcroft.builder", "135.181.225.104"),
84 + AAAA("goofy-hopcroft.builder", "2a01:4f9:3071:2d8b::1"),
85 +
86 + A("growing-jennet.mac", "23.88.76.75"),
87 +
88 + A("intense-heron.mac", "23.88.75.215"),
89 +
90 + AAAA("kind-lumiere.mac", "2a09:9340:808:60a::1"),
91 +
92 + A("maximum-snail.mac", "23.88.76.161"),
93 +
94 + A("sleepy-brown.builder", "162.55.130.51"),
95 + AAAA("sleepy-brown.builder", "2a01:4f8:271:5c14::1"),
96 +
97 + A("sweeping-filly.mac", "142.132.141.35"),
98 +
99 + // hydra staging area
100 + A("staging-hydra", "157.180.25.203"),
101 + AAAA("staging-hydra", "2a01:4f9:c012:d5d3::1"),
102 +
103 + // services infra
104 + A("caliban", "65.109.26.213"),
105 + AAAA("caliban", "2a01:4f9:5a:186c::2"),
106 + CNAME("chat", "caliban"),
107 + CNAME("live", "caliban"),
108 + CNAME("matrix", "caliban"),
109 + CNAME("survey", "caliban"),
110 + CNAME("vault", "caliban"),
111 + DMARC_BUILDER({
112 + label: "caliban",
113 + policy: "none"
114 + }),
115 + SPF_BUILDER({
116 + label: "caliban",
117 + parts: [
118 + "v=spf1",
119 + "ip4:65.109.26.213",
120 + "ip6:2a01:4f9:5a:186c::2",
121 + "~all"
122 + ]
123 + }),
124 + TXT("mail._domainkey.caliban", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDCLtvNH4Ly+9COXf7InptMvoA7I5O347D7+j+saECt7RRe8yNz4TmhJTyJik+bg7e3+l7EJM0vE6k7xtpGBXACY6CCmg/8EgUi6YnDd126ttJHWpoqO96w4SWX93G+ZnoSC8O5rTPqdaTTkntYDTrw5u5n+7RA8GarZadgmaEzwIDAQAB"),
125 +
126 + A("umbriel", "37.27.20.162"),
127 + AAAA("umbriel", "2a01:4f9:c011:8fb5::1"),
128 + // See `nixos.org.mail.key` in `non-critical-infra/modules/mailserver/default.nix`.
129 + TXT("mail._domainkey", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcgNq4+Y23GxN8Mdza437tL5DuJJZU1y6VzTCwSi6cBNLyBDci2cmqXx/gm1sA3yv7+h+8/OyJpEgcbCIW/Ygs1XLuECqvXVX8MU6Djn4KY+d2sU1tlUdqvNM86puoneQtjEv9rDsjf3HGqaeOcjetFnQW7H+qcNcaEShxyKztzQIDAQAB"),
130 +
131 + // ngi
132 + CNAME("cache.ngi0", "d2tu257wv37zz1.cloudfront.net."),
133 + CNAME("_293364b7f7ebb076ac287cd132f8b316.cache.ngi0", "_6a75cfb0c20f4eaac96b72afaffb489b.auiqqraehs.acm-validations.aws."),
134 +
135 + A("makemake.ngi", "116.202.113.248"),
136 + AAAA("makemake.ngi", "2a01:4f8:231:4187::"),
137 + CNAME("buildbot.ngi", "makemake.ngi.nixos.org."),
138 + CNAME("hydra.ngi0", "makemake.ngi.nixos.org."),
139 + CNAME("summer", "makemake.ngi.nixos.org."),
140 +
141 + A("tracker.security", "188.245.41.195"),
142 + AAAA("tracker.security", "2a01:4f8:1c1b:b87b::1"),
143 +
144 + // merge-bot
145 + A("nixpkgs-merge-bot", "37.27.11.42"),
146 + AAAA("nixpkgs-merge-bot", "2a01:4f9:c012:7615::1"),
147 + A("nixpkgs-merge-bot-staging", "37.27.197.11"),
148 + AAAA("nixpkgs-merge-bot-staging", "2a01:4f9:c010:dd30::1"),
149 +
150 + // wiki
151 + A("wiki", "65.21.240.250"),
152 + AAAA("wiki", "2a01:4f9:c012:8178::"),
153 + DMARC_BUILDER({
154 + label: "wiki",
155 + policy: "none"
156 + }),
157 + SPF_BUILDER({
158 + label: "wiki",
159 + parts: [
160 + "v=spf1",
161 + "ip4:65.21.240.250",
162 + "ip6:2a01:4f9:c012:8178::",
163 + "~all"
164 + ]
165 + }),
166 + TXT("mail._domainkey.wiki", "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDa+KjIljYr3q5MWWK7sEYzjR8OcA32zBh9BCPo6/HlY1q2ODTYsmE/FDZWpYMzM5z+ddnuGYdXia322XnZaNpZNoq1TbGYuQ5DsgAEK09CGoLuzONg3PSXTrkG7E2Sd6wstwHGJ5FHxSLKtNoWkknt9F5XAFZgXapO0w54p+BWvwIDAQAB"),
167 +
168 + // cloudflare pages
169 + CNAME("20th", "20th-nix.pages.dev."),
170 +
171 + // github org/domain binding
172 + TXT("_github-challenge-nixos", "9e10a04a4b"),
173 +
174 + // github pages
175 + CNAME("mobile", "nixos.github.io."),
176 + CNAME("ngi", "ngi-nix.github.io."),
177 + CNAME("reproducible", "nixos.github.io."),
178 +
179 + TXT("_github-pages-challenge-ngi-nix.ngi", "4e8bffbb7ced2aec7be1f8cf3561d6"),
180 + TXT("_github-pages-challenge-nixos", "f3a423ba6916e972cfb1e74f82f601"),
181 +
182 + // netlify pages
183 + CNAME("planet", "nixos-planet.netlify.app."),
184 + CNAME("status", "nixos-status.netlify.app."),
185 + CNAME("weekly", "nixos-weekly.netlify.com."),
186 +);
flake.nix
+1
@@ -78,6 +78,7 @@
78 imports = [
79 ./build/flake-module.nix
80 ./builders/flake-module.nix
81 + ./dns/flake-module.nix
82 ./formatter/flake-module.nix
83 ./checks/flake-module.nix
84 ./terraform/flake-module.nix