This is a work-in-progress recreation of our server's configuration in the form of a literate Org file, plus a makefile that installs it for you.

To use it, you can run make && doas make install on an existing Alpine system that has (GNU) Emacs installed, or, you can run make distrib.tar.xz on some other system with Emacs, then move the file distrib.tar.xz to an Alpine system, unpack it over there, and run doas make install, which doesn't require Emacs to be available on the target system.

Package management

apk repositories

We're using the default CDN mirror (change this if you want a different one):

http://dl-cdn.alpinelinux.org/alpine

The standard main and community repos for the latest stable release:

<<apk-mirror>>/latest-stable/main
<<apk-mirror>>/latest-stable/community

Plus, extra ones for community and testing on the edge branch, to allow installing more software and newer versions of certain packages:

@community-edge <<apk-mirror>>/edge/community
@testing <<apk-mirror>>/edge/testing

System utilities

cron daemon

We're just using the busybox cron daemon, it gets the job done.

rc-update add crond

By default, the system comes with a crontab that executes scripts under /etc/periodic/<interval> every so often.

Networking

tinc VPN

TODO

DNS

We run a local DNS server, which uses unbound, therefore install and enable unbound:

unbound
unbound-doc

rc-update add unbound

Point the system resolver at the unbound server (in resolvconf.conf):

name_servers=127.0.0.1

Authoritative zone for internal VPN addresses

Since we use tinc mesh VPN, all of our machines have internal IP addresses, and it's nice have them be resolvable by their hostnames.

So there is this zonefile:

$ORIGIN infra.xn--80andq.net.
$TTL 3600

@ IN SOA celestine.infra.xn--80andq.net. contact.xn--80andq.net. 2026072202 10800 3600 604800 3600

amber.infra.xn--80andq.net. IN AAAA fd8c:4ea1:9a24:1::4
amber.infra.xn--80andq.net. IN A 10.101.1.4
neptunite.infra.xn--80andq.net. IN AAAA fd8c:4ea1:9a24:1::5
neptunite.infra.xn--80andq.net. IN A 10.101.1.5
selenite.infra.xn--80andq.net. IN AAAA fd8c:4ea1:9a24:1::2
selenite.infra.xn--80andq.net. IN A 10.101.1.2
celestine.infra.xn--80andq.net. IN AAAA fd8c:4ea1:9a24:1::1
celestine.infra.xn--80andq.net. IN A 10.101.1.1
ametrine.infra.xn--80andq.net. IN AAAA fd8c:4ea1:9a24:1::3
ametrine.infra.xn--80andq.net. IN A 10.101.1.3

unbound also needs to be told about it:

auth-zone:
  name: infra.xn--80andq.net.
  zonefile: /etc/unbound/zones/infra.zone

Finally, resolvconf can be told about it as a 'search domain' so it's possible to just write the short hostnames:

search_domains=infra.xn--80andq.net

More miscellaneous unbound config snippets

1. Be accessible on the appropriate interfaces

   Again, this is necessary because we want unbound to be visible to other devices in the tinc network.

   server:
     interface: winternet
     interface: lo
     access-control: 10.101.0.0/16 allow
     access-control: 127.0.0.1 allow

2. Recursively resolve upstream zones

   Here we're using the 9.9.9.9 public recursive DNS server.

   forward-zone:
     name: "."
     forward-addr: 9.9.9.9

3. Rehike

   TODO: move this section to the actual section for rehike, whenever we write that

   server:
     local-zone: "youtube.com." redirect
     local-data: "youtube.com. A 10.101.1.1"

TLS certificates

Let's Encrypt

Obviously we can't put the full and entire configuration here because it might let you impersonate us. But! Here are some parts:

We're using certbot because we're lazy, and also the PowerDNS plugin for it so that we can use it with servfail:

certbot
certbot-dns-pdns@testing

Then, after getting certificates for the first time (consult certbot docs on how to do that), this script in /etc/periodic/weekly makes sure they're renewed as needed, and informs us when it does so using sendmail-fancy:

#!/bin/bash
{
    printf "it's that time of the week again...\n\n"
    certbot renew
} | sendmail-fancy crond@celestine winter "certbot renew output"

Email

We use OpenSMTPD as an email server, since it's easy to configure. Plus the dkimsign filter for it, to allow signing outbound emails with our DKIM key.

opensmtpd
opensmtpd-doc
opensmtpd-filter-dkimsign
opensmtpd-filter-dkimsign-doc

TODO: smtpd config and dovecot config

sendmail-fancy

Super simple shell script that makes it easier to send emails programmatically:

#!/bin/bash

if [ $# -ne 3 ]; then
    echo "usage: $0 <sender> <recipient> <subject>" 1>&2
    exit 1
fi

{
    echo "Subject: $3"
    echo "To: $2"
    echo "From: $1"
    echo "Date: $(date -R)"
    echo
    cat
} | sendmail -t