refactored system
This commit is contained in:
parent
6a62e2f23f
commit
386d889455
55 changed files with 336 additions and 580 deletions
|
|
@ -1,64 +1,16 @@
|
|||
{ config, pkgs, ... }:
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
imports = [
|
||||
./nginx.nix
|
||||
./letsencrypt.nix
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
virtualHosts = {
|
||||
|
||||
"${config.networking.domain}" = {
|
||||
onlySSL = true;
|
||||
useACMEHost = config.networking.domain;
|
||||
locations."/" = {
|
||||
return = "200 'This domain used for e-mail hosting only.'";
|
||||
extraConfig = ''
|
||||
add_header Content-Type text/plain;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
"${config.networking.fqdn}-80" = {
|
||||
serverAliases = [
|
||||
"*.ktiu.net"
|
||||
"*.t9e.me"
|
||||
];
|
||||
locations."/.well-known/acme-challenge" = {
|
||||
root = "/var/lib/acme/.challenges";
|
||||
};
|
||||
locations."/" = {
|
||||
return = "301 https://$host$request_uri";
|
||||
};
|
||||
};
|
||||
|
||||
"${config.networking.fqdn}" = {
|
||||
onlySSL = true;
|
||||
useACMEHost = config.networking.domain;
|
||||
locations."/" = {
|
||||
return = "404";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
|
||||
acceptTerms = true;
|
||||
defaults.email = "till@ktiu.net";
|
||||
|
||||
certs."${config.networking.domain}" = {
|
||||
domain = config.networking.domain;
|
||||
webroot = "/var/lib/acme/.challenges";
|
||||
group = config.services.nginx.group;
|
||||
extraDomainNames = [ config.networking.fqdn ];
|
||||
};
|
||||
};
|
||||
./forgejo.nix
|
||||
./outline.nix
|
||||
./radicale.nix
|
||||
|
||||
# ./ksh.nix
|
||||
./ksh-map.nix
|
||||
./oopsidenfiy.nix
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,23 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
services.jenkins = {
|
||||
enable = true;
|
||||
port = 7401;
|
||||
};
|
||||
|
||||
security.acme.certs."${config.networking.domain}".extraDomainNames = [
|
||||
"jenkins.${config.networking.domain}"
|
||||
];
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"jenkins.${config.networking.domain}" = {
|
||||
onlySSL = true;
|
||||
useACMEHost = config.networking.domain;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${toString config.services.jenkins.port}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -11,7 +11,7 @@
|
|||
serverAliases = [
|
||||
"www.kein-schlussstrich-hessen.de"
|
||||
"www.kein-schlussstrich-hessen.org"
|
||||
]
|
||||
];
|
||||
globalRedirect = "kein-schlussstrich-hessen.org";
|
||||
enableACME = true;
|
||||
};
|
||||
29
system/web-server/letsencrypt.nix
Normal file
29
system/web-server/letsencrypt.nix
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
{ config, ... }:
|
||||
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "till@ktiu.net";
|
||||
certs."${config.networking.domain}" = {
|
||||
domain = config.networking.domain;
|
||||
webroot = "/var/lib/acme/.challenges";
|
||||
group = config.services.nginx.group;
|
||||
extraDomainNames = [ config.networking.fqdn ];
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"${config.networking.fqdn}-80" = {
|
||||
serverAliases = [
|
||||
"*.ktiu.net"
|
||||
"*.t9e.me"
|
||||
];
|
||||
locations."/.well-known/acme-challenge" = {
|
||||
root = "/var/lib/acme/.challenges";
|
||||
};
|
||||
locations."/" = {
|
||||
return = "301 https://$host$request_uri";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./postfix.nix
|
||||
./dkim.nix
|
||||
./dovecot.nix
|
||||
./roundcube.nix
|
||||
];
|
||||
|
||||
security.acme.certs."${config.networking.domain}".reloadServices = [
|
||||
"nginx"
|
||||
"dovecot2"
|
||||
"postfix"
|
||||
];
|
||||
}
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
services.opendkim = {
|
||||
enable = true;
|
||||
domains = "csl:ktiu.net,t9e.me";
|
||||
selector = "202412";
|
||||
settings.UMask = "007";
|
||||
};
|
||||
|
||||
users.users.postfix.extraGroups = [ "opendkim" ];
|
||||
|
||||
services.postfix.config.smtpd_milters = [ "unix:/run/opendkim/opendkim.sock" ];
|
||||
}
|
||||
|
|
@ -1,65 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
993 # IMAP
|
||||
];
|
||||
|
||||
security.acme.certs."${config.networking.fqdn}-dovecot" = {
|
||||
domain = config.networking.fqdn;
|
||||
webroot = "/var/lib/acme/.challenges";
|
||||
group = config.services.dovecot2.group;
|
||||
};
|
||||
|
||||
users.groups."vmail" = {};
|
||||
users.users."vmail" = {
|
||||
group = "vmail";
|
||||
isSystemUser = true;
|
||||
};
|
||||
|
||||
services.dovecot2 = {
|
||||
enable = true;
|
||||
sslServerKey = config.security.acme.certs."${config.networking.fqdn}-dovecot".directory + "/key.pem";
|
||||
sslServerCert = config.security.acme.certs."${config.networking.fqdn}-dovecot".directory + "/cert.pem";
|
||||
mailboxes = {
|
||||
Junk = { specialUse = "Junk"; auto = "subscribe"; };
|
||||
Sent = { specialUse = "Sent"; auto = "subscribe"; };
|
||||
Drafts = { specialUse = "Drafts"; auto = "subscribe"; };
|
||||
Trash = { specialUse = "Trash"; auto = "subscribe"; };
|
||||
Archive = { specialUse = "Archive"; auto = "subscribe"; };
|
||||
};
|
||||
mailUser = "vmail";
|
||||
mailGroup = "vmail";
|
||||
enablePAM = false;
|
||||
enableLmtp = true;
|
||||
mailLocation = "maildir:/var/spool/mail/vmail/mailboxes/%u";
|
||||
extraConfig = ''
|
||||
ssl = required
|
||||
service auth {
|
||||
unix_listener auth {
|
||||
mode = 0660
|
||||
user = postfix
|
||||
group = postfix
|
||||
}
|
||||
}
|
||||
mail_home = /var/spool/mail/vmail/users/%u
|
||||
passdb {
|
||||
driver = passwd-file
|
||||
args = /var/custom-access/dovecot.passwd
|
||||
}
|
||||
userdb {
|
||||
driver = passwd-file
|
||||
args = /var/custom-access/dovecot.passwd
|
||||
default_fields = uid=vmail gid=vmail home=/var/spool/mail/vmail/users/%u
|
||||
}
|
||||
service lmtp {
|
||||
unix_listener lmtp {
|
||||
group = postfix
|
||||
mode = 0600
|
||||
user = postfix
|
||||
}
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -1,93 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
let
|
||||
|
||||
submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''
|
||||
/^Received:/ ignore
|
||||
/^X-Originating-IP:/ ignore
|
||||
/^X-Mailer:/ ignore
|
||||
/^User-Agent:/ ignore
|
||||
/^X-Enigmail:/ ignore
|
||||
/^Message-ID:\s+<(.*?)@.*?>/ replace Message-ID: <$1@ktiu.net>
|
||||
'';
|
||||
|
||||
in {
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
25 # SMTP
|
||||
587 # SMTP w/ TLS
|
||||
];
|
||||
|
||||
security.acme.certs."${config.networking.fqdn}-postfix" = {
|
||||
domain = config.networking.fqdn;
|
||||
webroot = "/var/lib/acme/.challenges";
|
||||
group = config.services.postfix.group;
|
||||
};
|
||||
|
||||
services.postfix = {
|
||||
enable = true;
|
||||
virtual = ''
|
||||
@ktiu.net till.straube@t9e.me
|
||||
@t9e.me till.straube@t9e.me
|
||||
'';
|
||||
|
||||
mapFiles.virtual-mailboxes = pkgs.writeText "postfix-virtual-mailboxes" ''
|
||||
@ktiu.net anything
|
||||
@t9e.me anything
|
||||
'';
|
||||
|
||||
mapFiles.reject-recipients = pkgs.writeText "postfix-reject-recipients" ''
|
||||
123rf@ktiu.net REJECT
|
||||
jcb-co.jp-ktiu@ktiu.net REJECT
|
||||
info@ktiu.net REJECT
|
||||
'';
|
||||
|
||||
|
||||
enableSubmission = true;
|
||||
|
||||
submissionOptions = {
|
||||
milter_macro_daemon_name = "ORIGINATING";
|
||||
cleanup_service_name = "submission-header-cleanup";
|
||||
smtpd_tls_security_level = "encrypt";
|
||||
smtpd_sasl_auth_enable = "yes";
|
||||
smtpd_sasl_type = "dovecot";
|
||||
smtpd_sasl_path = "/var/run/dovecot2/auth";
|
||||
smtpd_sasl_security_options = "noanonymous";
|
||||
smtpd_client_restrictions = "permit_mynetworks,permit_sasl_authenticated,reject";
|
||||
smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
|
||||
};
|
||||
settings = {
|
||||
|
||||
main = {
|
||||
virtual_mailbox_domains = [ "t9e.me" "ktiu.net" ];
|
||||
virtual_mailbox_maps = "hash:/etc/postfix/virtual-mailboxes";
|
||||
virtual_transport = "lmtp:unix:/var/run/dovecot2/lmtp";
|
||||
smtpd_tls_security_level = "may";
|
||||
mydomain = config.networking.domain;
|
||||
myhostname = config.networking.fqdn;
|
||||
mynetworks = [
|
||||
"127.0.0.0/8"
|
||||
"[::ffff:127.0.0.0]/104"
|
||||
"[::1]/128"
|
||||
];
|
||||
smtpd_tls_chain_files = [
|
||||
"${config.security.acme.certs."${config.networking.fqdn}-postfix".directory + "/key.pem"}"
|
||||
"${config.security.acme.certs."${config.networking.fqdn}-postfix".directory + "/cert.pem"}"
|
||||
];
|
||||
smtpd_recipient_restrictions = "check_recipient_access hash:/etc/postfix/reject-recipients";
|
||||
};
|
||||
|
||||
master = {
|
||||
"submission-header-cleanup" = {
|
||||
type = "unix";
|
||||
private = false;
|
||||
chroot = false;
|
||||
maxproc = 0;
|
||||
command = "cleanup";
|
||||
args = ["-o" "header_checks=pcre:${submissionHeaderCleanupRules}"];
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
services.roundcube = {
|
||||
enable = true;
|
||||
hostName = "webmail.ktiu.net";
|
||||
extraConfig = ''
|
||||
$config['smtp_host'] = 'tls://%h';
|
||||
$config['smtp_conn_options'] = [
|
||||
'ssl' => [
|
||||
'verify_peer' => false,
|
||||
'verify_peer_name' => false,
|
||||
],
|
||||
];
|
||||
'';
|
||||
};
|
||||
}
|
||||
34
system/web-server/nginx.nix
Normal file
34
system/web-server/nginx.nix
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
{ config, ... }:
|
||||
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
virtualHosts = {
|
||||
|
||||
"${config.networking.domain}" = {
|
||||
onlySSL = true;
|
||||
useACMEHost = config.networking.domain;
|
||||
locations."/" = {
|
||||
return = "200 'This domain used for e-mail hosting only.'";
|
||||
extraConfig = ''
|
||||
add_header Content-Type text/plain;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
"${config.networking.fqdn}" = {
|
||||
onlySSL = true;
|
||||
useACMEHost = config.networking.domain;
|
||||
locations."/" = {
|
||||
return = "404";
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,6 +1,7 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
# imports = [ ./dex.nix ];
|
||||
|
||||
# environment.systemPackages = with pkgs; [
|
||||
# openssl
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue