forked from
lass.pds.lassul.us/superconfig
This repository has no description
8.1 kB
334 lines
1{
2 self,
3 config,
4 pkgs,
5 ...
6}:
7{
8 imports = [
9 ../../2configs
10 ../../2configs/retiolum.nix
11
12 self.inputs.stockholm.nixosModules.exim-smarthost
13 ];
14
15 krebs.build.host = config.krebs.hosts.ubik;
16 clan.password-store.targetDirectory = "/var/state/secrets";
17
18 krebs.sync-containers3.inContainer = {
19 enable = true;
20 pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBFGMjH0+Dco6DVFZbByENMci8CFTLXCL7j53yctPnM";
21 };
22
23 security.acme = {
24 acceptTerms = true;
25 defaults.email = "acme@lassul.us";
26 };
27 networking.firewall.allowedTCPPorts = [
28 80
29 443
30 ];
31
32 # nextcloud
33 services.nginx.virtualHosts."c.apanowicz.de" = {
34 enableACME = true;
35 forceSSL = true;
36 };
37 services.nextcloud = {
38 enable = true;
39 hostName = "c.apanowicz.de";
40 package = pkgs.nextcloud29;
41 config.adminpassFile = "/run/nextcloud.pw";
42 https = true;
43 maxUploadSize = "9001M";
44 };
45 clanCore.facts.services.nextcloud-pw = {
46 secret."nextcloud.pw" = { };
47 generator.script = ''
48 echo "$prompt_value" > "$secrets"/nextcloud.pw
49 '';
50 generator.prompt = ''
51 please enter the nextcloud admin password:
52 '';
53 };
54 systemd.services.nextcloud-setup.serviceConfig.ExecStartPre = [
55 "+${pkgs.writeDash "copy-pw" ''
56 ${pkgs.rsync}/bin/rsync \
57 --chown nextcloud:nextcloud \
58 --chmod 0700 \
59 ${config.clanCore.facts.services.nextcloud-pw.secret."nextcloud.pw".path} /run/nextcloud.pw
60 ''}"
61 ];
62
63 # mail
64 lass.usershadow.enable = true;
65 services.nginx.virtualHosts."mail.ubikmedia.eu" = {
66 enableACME = true;
67 forceSSL = true;
68 };
69 services.roundcube = {
70 enable = true;
71 hostName = "mail.ubikmedia.eu";
72 extraConfig = ''
73 $config['smtp_debug'] = true;
74 $config['smtp_host'] = "localhost:25";
75 '';
76 };
77 services.dovecot2 = {
78 enable = true;
79 showPAMFailure = true;
80 mailLocation = "maildir:~/Mail";
81 sslServerCert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
82 sslServerKey = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
83 };
84 krebs.exim-smarthost = {
85 ssl_cert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
86 ssl_key = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
87 authenticators.PLAIN = ''
88 driver = plaintext
89 public_name = PLAIN
90 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
91 '';
92 authenticators.LOGIN = ''
93 driver = plaintext
94 public_name = LOGIN
95 server_prompts = "Username:: : Password::"
96 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
97 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
98 '';
99 internet-aliases = [
100 {
101 from = "dma@ubikmedia.de";
102 to = "domsen";
103 }
104 {
105 from = "dma@ubikmedia.eu";
106 to = "domsen";
107 }
108 {
109 from = "hallo@apanowicz.de";
110 to = "domsen";
111 }
112 {
113 from = "bruno@apanowicz.de";
114 to = "bruno";
115 }
116 {
117 from = "mail@jla-trading.com";
118 to = "jla-trading";
119 }
120 {
121 from = "jms@ubikmedia.eu";
122 to = "jms";
123 }
124 {
125 from = "ms@ubikmedia.eu";
126 to = "ms";
127 }
128 {
129 from = "ubik@ubikmedia.eu";
130 to = "domsen, jms, ms";
131 }
132 {
133 from = "kontakt@alewis.de";
134 to = "klabusterbeere";
135 }
136 {
137 from = "hallo@jarugadesign.de";
138 to = "kasia";
139 }
140 {
141 from = "noreply@beeshmooth.ch";
142 to = "besmooth@gmx.ch";
143 }
144
145 {
146 from = "testuser@ubikmedia.eu";
147 to = "testuser";
148 }
149 ];
150 sender_domains = [
151 "jla-trading.com"
152 "ubikmedia.eu"
153 "ubikmedia.de"
154 "apanowicz.de"
155 "alewis.de"
156 "jarugadesign.de"
157 "beesmooth.ch"
158 "event-extra.de"
159 ];
160 dkim = [
161 { domain = "ubikmedia.eu"; }
162 { domain = "apanowicz.de"; }
163 { domain = "beesmooth.ch"; }
164 ];
165 };
166
167 # users
168 users.groups.xanf = { };
169 users.users.UBIK-SFTP = {
170 uid = pkgs.stockholm.lib.genid_uint31 "UBIK-SFTP";
171 home = "/home/UBIK-SFTP";
172 useDefaultShell = true;
173 createHome = true;
174 isNormalUser = true;
175 };
176
177 users.users.xanf = {
178 uid = pkgs.stockholm.lib.genid_uint31 "xanf";
179 group = "xanf";
180 home = "/home/xanf";
181 useDefaultShell = true;
182 createHome = false; # creathome forces permissions
183 isNormalUser = true;
184 };
185
186 users.users.domsen = {
187 uid = pkgs.stockholm.lib.genid_uint31 "domsen";
188 description = "maintenance acc for domsen";
189 home = "/home/domsen";
190 useDefaultShell = true;
191 extraGroups = [
192 "syncthing"
193 "download"
194 "xanf"
195 ];
196 createHome = true;
197 isNormalUser = true;
198 };
199
200 users.users.bruno = {
201 uid = pkgs.stockholm.lib.genid_uint31 "bruno";
202 home = "/home/bruno";
203 useDefaultShell = true;
204 createHome = true;
205 isNormalUser = true;
206 };
207
208 users.users.jla-trading = {
209 uid = pkgs.stockholm.lib.genid_uint31 "jla-trading";
210 home = "/home/jla-trading";
211 useDefaultShell = true;
212 createHome = true;
213 isNormalUser = true;
214 };
215
216 users.users.jms = {
217 uid = pkgs.stockholm.lib.genid_uint31 "jms";
218 home = "/home/jms";
219 useDefaultShell = true;
220 createHome = true;
221 isNormalUser = true;
222 };
223
224 users.users.ms = {
225 uid = pkgs.stockholm.lib.genid_uint31 "ms";
226 home = "/home/ms";
227 useDefaultShell = true;
228 createHome = true;
229 isNormalUser = true;
230 };
231
232 users.users.testuser = {
233 uid = pkgs.stockholm.lib.genid_uint31 "testuser";
234 home = "/home/testuser";
235 useDefaultShell = true;
236 createHome = true;
237 isNormalUser = true;
238 };
239
240 users.users.bui = {
241 uid = pkgs.stockholm.lib.genid_uint31 "bui";
242 home = "/home/bui";
243 useDefaultShell = true;
244 createHome = true;
245 isNormalUser = true;
246 };
247
248 users.users.klabusterbeere = {
249 uid = pkgs.stockholm.lib.genid_uint31 "klabusterbeere";
250 home = "/home/klabusterbeere";
251 useDefaultShell = true;
252 createHome = true;
253 isNormalUser = true;
254 };
255
256 users.users.kasia = {
257 uid = pkgs.stockholm.lib.genid_uint31 "kasia";
258 home = "/home/kasia";
259 useDefaultShell = true;
260 createHome = true;
261 isNormalUser = true;
262 };
263
264 users.users.XANF_TEAM = {
265 uid = pkgs.stockholm.lib.genid_uint31 "XANF_TEAM";
266 group = "xanf";
267 home = "/home/XANF_TEAM";
268 useDefaultShell = true;
269 createHome = true;
270 isNormalUser = true;
271 };
272
273 users.users.dif = {
274 uid = pkgs.stockholm.lib.genid_uint31 "dif";
275 home = "/home/dif";
276 useDefaultShell = true;
277 extraGroups = [ "xanf" ];
278 createHome = true;
279 isNormalUser = true;
280 };
281
282 users.users.lavafilms = {
283 uid = pkgs.stockholm.lib.genid_uint31 "lavafilms";
284 home = "/home/lavafilms";
285 useDefaultShell = true;
286 extraGroups = [ "xanf" ];
287 createHome = true;
288 isNormalUser = true;
289 };
290
291 users.users.movematchers = {
292 uid = pkgs.stockholm.lib.genid_uint31 "movematchers";
293 home = "/home/movematchers";
294 useDefaultShell = true;
295 extraGroups = [ "xanf" ];
296 createHome = true;
297 isNormalUser = true;
298 };
299
300 users.users.blackphoton = {
301 uid = pkgs.stockholm.lib.genid_uint31 "blackphoton";
302 home = "/home/blackphoton";
303 useDefaultShell = true;
304 extraGroups = [ "xanf" ];
305 createHome = true;
306 isNormalUser = true;
307 };
308
309 users.users.line = {
310 uid = pkgs.stockholm.lib.genid_uint31 "line";
311 home = "/home/line";
312 useDefaultShell = true;
313 # extraGroups = [ "xanf" ];
314 createHome = true;
315 isNormalUser = true;
316 };
317
318 users.users.avada = {
319 uid = pkgs.stockholm.lib.genid_uint31 "avada";
320 home = "/home/avada";
321 useDefaultShell = true;
322 createHome = true;
323 isNormalUser = true;
324 };
325
326 users.users.familienrat = {
327 uid = pkgs.stockholm.lib.genid_uint31 "familienrat";
328 home = "/home/familienrat";
329 useDefaultShell = true;
330 createHome = true;
331 isNormalUser = true;
332 };
333
334}