forked from
lass.pds.lassul.us/superconfig
This repository has no description
7.8 kB
286 lines
1{ self, config, pkgs, ... }:
2{
3 imports = [
4 ../../2configs
5 ../../2configs/retiolum.nix
6
7 self.inputs.stockholm.nixosModules.exim-smarthost
8 ];
9
10 krebs.build.host = config.krebs.hosts.ubik;
11 clan.password-store.targetDirectory = "/var/state/secrets";
12
13 krebs.sync-containers3.inContainer = {
14 enable = true;
15 pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBFGMjH0+Dco6DVFZbByENMci8CFTLXCL7j53yctPnM";
16 };
17
18 security.acme = {
19 acceptTerms = true;
20 defaults.email = "acme@lassul.us";
21 };
22 networking.firewall.allowedTCPPorts = [ 80 443 ];
23
24 # nextcloud
25 services.nginx.virtualHosts."c.apanowicz.de" = {
26 enableACME = true;
27 forceSSL = true;
28 };
29 services.nextcloud = {
30 enable = true;
31 hostName = "c.apanowicz.de";
32 package = pkgs.nextcloud28;
33 config.adminpassFile = "/run/nextcloud.pw";
34 https = true;
35 maxUploadSize = "9001M";
36 };
37 clanCore.facts.services.nextcloud-pw = {
38 secret."nextcloud.pw" = { };
39 generator.script = ''
40 echo "$prompt_value" > "$secrets"/nextcloud.pw
41 '';
42 generator.prompt = ''
43 please enter the nextcloud admin password:
44 '';
45 };
46 systemd.services.nextcloud-setup.serviceConfig.ExecStartPre = [
47 "+${pkgs.writeDash "copy-pw" ''
48 ${pkgs.rsync}/bin/rsync \
49 --chown nextcloud:nextcloud \
50 --chmod 0700 \
51 ${config.clanCore.facts.services.nextcloud-pw.secret."nextcloud.pw".path} /run/nextcloud.pw
52 ''}"
53 ];
54
55 # mail
56 lass.usershadow.enable = true;
57 services.nginx.virtualHosts."mail.ubikmedia.eu" = {
58 enableACME = true;
59 forceSSL = true;
60 };
61 services.roundcube = {
62 enable = true;
63 hostName = "mail.ubikmedia.eu";
64 extraConfig = ''
65 $config['smtp_debug'] = true;
66 $config['smtp_host'] = "localhost:25";
67 '';
68 };
69 services.dovecot2 = {
70 enable = true;
71 showPAMFailure = true;
72 mailLocation = "maildir:~/Mail";
73 sslServerCert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
74 sslServerKey = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
75 };
76 krebs.exim-smarthost = {
77 ssl_cert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
78 ssl_key = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
79 authenticators.PLAIN = ''
80 driver = plaintext
81 public_name = PLAIN
82 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
83 '';
84 authenticators.LOGIN = ''
85 driver = plaintext
86 public_name = LOGIN
87 server_prompts = "Username:: : Password::"
88 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
89 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
90 '';
91 internet-aliases = [
92 { from = "dma@ubikmedia.de"; to = "domsen"; }
93 { from = "dma@ubikmedia.eu"; to = "domsen"; }
94 { from = "hallo@apanowicz.de"; to = "domsen"; }
95 { from = "bruno@apanowicz.de"; to = "bruno"; }
96 { from = "mail@jla-trading.com"; to = "jla-trading"; }
97 { from = "jms@ubikmedia.eu"; to = "jms"; }
98 { from = "ms@ubikmedia.eu"; to = "ms"; }
99 { from = "ubik@ubikmedia.eu"; to = "domsen, jms, ms"; }
100 { from = "kontakt@alewis.de"; to ="klabusterbeere"; }
101 { from = "hallo@jarugadesign.de"; to ="kasia"; }
102 { from = "noreply@beeshmooth.ch"; to ="besmooth@gmx.ch"; }
103
104 { from = "testuser@ubikmedia.eu"; to = "testuser"; }
105 ];
106 sender_domains = [
107 "jla-trading.com"
108 "ubikmedia.eu"
109 "ubikmedia.de"
110 "apanowicz.de"
111 "alewis.de"
112 "jarugadesign.de"
113 "beesmooth.ch"
114 "event-extra.de"
115 ];
116 dkim = [
117 { domain = "ubikmedia.eu"; }
118 { domain = "apanowicz.de"; }
119 { domain = "beesmooth.ch"; }
120 ];
121 };
122
123 # users
124 users.groups.xanf = {};
125 users.users.UBIK-SFTP = {
126 uid = pkgs.stockholm.lib.genid_uint31 "UBIK-SFTP";
127 home = "/home/UBIK-SFTP";
128 useDefaultShell = true;
129 createHome = true;
130 isNormalUser = true;
131 };
132
133 users.users.xanf = {
134 uid = pkgs.stockholm.lib.genid_uint31 "xanf";
135 group = "xanf";
136 home = "/home/xanf";
137 useDefaultShell = true;
138 createHome = false; # creathome forces permissions
139 isNormalUser = true;
140 };
141
142 users.users.domsen = {
143 uid = pkgs.stockholm.lib.genid_uint31 "domsen";
144 description = "maintenance acc for domsen";
145 home = "/home/domsen";
146 useDefaultShell = true;
147 extraGroups = [ "syncthing" "download" "xanf" ];
148 createHome = true;
149 isNormalUser = true;
150 };
151
152 users.users.bruno = {
153 uid = pkgs.stockholm.lib.genid_uint31 "bruno";
154 home = "/home/bruno";
155 useDefaultShell = true;
156 createHome = true;
157 isNormalUser = true;
158 };
159
160 users.users.jla-trading = {
161 uid = pkgs.stockholm.lib.genid_uint31 "jla-trading";
162 home = "/home/jla-trading";
163 useDefaultShell = true;
164 createHome = true;
165 isNormalUser = true;
166 };
167
168 users.users.jms = {
169 uid = pkgs.stockholm.lib.genid_uint31 "jms";
170 home = "/home/jms";
171 useDefaultShell = true;
172 createHome = true;
173 isNormalUser = true;
174 };
175
176 users.users.ms = {
177 uid = pkgs.stockholm.lib.genid_uint31 "ms";
178 home = "/home/ms";
179 useDefaultShell = true;
180 createHome = true;
181 isNormalUser = true;
182 };
183
184 users.users.testuser = {
185 uid = pkgs.stockholm.lib.genid_uint31 "testuser";
186 home = "/home/testuser";
187 useDefaultShell = true;
188 createHome = true;
189 isNormalUser = true;
190 };
191
192 users.users.bui = {
193 uid = pkgs.stockholm.lib.genid_uint31 "bui";
194 home = "/home/bui";
195 useDefaultShell = true;
196 createHome = true;
197 isNormalUser = true;
198 };
199
200 users.users.klabusterbeere = {
201 uid = pkgs.stockholm.lib.genid_uint31 "klabusterbeere";
202 home = "/home/klabusterbeere";
203 useDefaultShell = true;
204 createHome = true;
205 isNormalUser = true;
206 };
207
208 users.users.kasia = {
209 uid = pkgs.stockholm.lib.genid_uint31 "kasia";
210 home = "/home/kasia";
211 useDefaultShell = true;
212 createHome = true;
213 isNormalUser = true;
214 };
215
216 users.users.XANF_TEAM = {
217 uid = pkgs.stockholm.lib.genid_uint31 "XANF_TEAM";
218 group = "xanf";
219 home = "/home/XANF_TEAM";
220 useDefaultShell = true;
221 createHome = true;
222 isNormalUser = true;
223 };
224
225 users.users.dif = {
226 uid = pkgs.stockholm.lib.genid_uint31 "dif";
227 home = "/home/dif";
228 useDefaultShell = true;
229 extraGroups = [ "xanf" ];
230 createHome = true;
231 isNormalUser = true;
232 };
233
234 users.users.lavafilms = {
235 uid = pkgs.stockholm.lib.genid_uint31 "lavafilms";
236 home = "/home/lavafilms";
237 useDefaultShell = true;
238 extraGroups = [ "xanf" ];
239 createHome = true;
240 isNormalUser = true;
241 };
242
243 users.users.movematchers = {
244 uid = pkgs.stockholm.lib.genid_uint31 "movematchers";
245 home = "/home/movematchers";
246 useDefaultShell = true;
247 extraGroups = [ "xanf" ];
248 createHome = true;
249 isNormalUser = true;
250 };
251
252 users.users.blackphoton = {
253 uid = pkgs.stockholm.lib.genid_uint31 "blackphoton";
254 home = "/home/blackphoton";
255 useDefaultShell = true;
256 extraGroups = [ "xanf" ];
257 createHome = true;
258 isNormalUser = true;
259 };
260
261 users.users.line = {
262 uid = pkgs.stockholm.lib.genid_uint31 "line";
263 home = "/home/line";
264 useDefaultShell = true;
265 # extraGroups = [ "xanf" ];
266 createHome = true;
267 isNormalUser = true;
268 };
269
270 users.users.avada = {
271 uid = pkgs.stockholm.lib.genid_uint31 "avada";
272 home = "/home/avada";
273 useDefaultShell = true;
274 createHome = true;
275 isNormalUser = true;
276 };
277
278 users.users.familienrat = {
279 uid = pkgs.stockholm.lib.genid_uint31 "familienrat";
280 home = "/home/familienrat";
281 useDefaultShell = true;
282 createHome = true;
283 isNormalUser = true;
284 };
285
286}