forked from
lass.pds.lassul.us/superconfig
This repository has no description
8.2 kB
368 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9
10 to = lib.concatStringsSep "," [
11 "lass@green.r"
12 "bot"
13 ];
14
15 mails = [
16 "postmaster@lassul.us"
17 "lassulus@lassul.us"
18 "test@lassul.us"
19 "outlook@lassul.us"
20 "steuer@aidsballs.de"
21 "lass@aidsballs.de"
22 "finanzamt@lassul.us"
23 "netzclub@lassul.us"
24 "nebenan@lassul.us"
25 "feed@lassul.us"
26 "art@lassul.us"
27 "irgendwas@lassul.us"
28 "polo@lassul.us"
29 "shack@lassul.us"
30 "nix@lassul.us"
31 "c-base@lassul.us"
32 "paypal@lassul.us"
33 "patreon@lassul.us"
34 "steam@lassul.us"
35 "securityfocus@lassul.us"
36 "radio@lassul.us"
37 "btce@lassul.us"
38 "raf@lassul.us"
39 "apple@lassul.us"
40 "coinbase@lassul.us"
41 "tomtop@lassul.us"
42 "aliexpress@lassul.us"
43 "business@lassul.us"
44 "payeer@lassul.us"
45 "github@lassul.us"
46 "bitwala@lassul.us"
47 "bitstamp@lassul.us"
48 "bitcoin.de@lassul.us"
49 "ableton@lassul.us"
50 "dhl@lassul.us"
51 "sipgate@lassul.us"
52 "coinexchange@lassul.us"
53 "verwaltung@lassul.us"
54 "gearbest@lassul.us"
55 "binance@lassul.us"
56 "bitfinex@lassul.us"
57 "alternate@lassul.us"
58 "redacted@lassul.us"
59 "mytaxi@lassul.us"
60 "pizza@lassul.us"
61 "robinhood@lassul.us"
62 "drivenow@lassul.us"
63 "aws@lassul.us"
64 "reddit@lassul.us"
65 "banggood@lassul.us"
66 "immoscout@lassul.us"
67 "gmail@lassul.us"
68 "amazon@lassul.us"
69 "humblebundle@lassul.us"
70 "meetup@lassul.us"
71 "gebfrei@lassul.us"
72 "github@lassul.us"
73 "ovh@lassul.us"
74 "hetzner@lassul.us"
75 "allygator@lassul.us"
76 "immoscout@lassul.us"
77 "elitedangerous@lassul.us"
78 "boardgamegeek@lassul.us"
79 "qwertee@lassul.us"
80 "zazzle@lassul.us"
81 "hackbeach@lassul.us"
82 "transferwise@lassul.us"
83 "cis@lassul.us"
84 "afra@lassul.us"
85 "ksp@lassul.us"
86 "ccc@lassul.us"
87 "neocron@lassul.us"
88 "osmocom@lassul.us"
89 "lesswrong@lassul.us"
90 "nordvpn@lassul.us"
91 "csv-direct@lassul.us"
92 "nintendo@lassul.us"
93 "overleaf@lassul.us"
94 "box@lassul.us"
95 "paloalto@lassul.us"
96 "subtitles@lassul.us"
97 "lobsters@lassul.us"
98 "fysitech@lassul.us"
99 "threema@lassul.us"
100 "ubisoft@lassul.us"
101 "kottezeller@lassul.us"
102 "pie@lassul.us"
103 "vebit@lassul.us"
104 "vcvrack@lassul.us"
105 "epic@lassul.us"
106 "microsoft@lassul.us"
107 "stickers@lassul.us"
108 "nextbike@lassul.us"
109 "mytello@lassul.us"
110 "camp@lassul.us"
111 "urlwatch@lassul.us"
112 "lidl@lassul.us"
113 "geizhals@lassul.us"
114 "auschein@lassul.us"
115 "tleech@lassul.us"
116 "durstexpress@lassul.us"
117 "acme@lassul.us"
118 "antstore@lassul.us"
119 "openweather@lassul.us"
120 "lobsters@lassul.us"
121 "rewe@lassul.us"
122 "spotify@lassul.us"
123 "mojang@lassul.us"
124 # "telekom@lassul.us"
125 "doctolib@lassul.us"
126 "dragonbox@lassul.us"
127 "scalable@lassul.us"
128 "remarkable@lassul.us"
129 "lenovo@lassul.us"
130 "lapstars@lassul.us"
131 "simplywall@lassul.us"
132 "vytal@lassul.us"
133 "haftpflicht@lassul.us"
134 "dji@lassul.us"
135 "sparkasse@lassul.us"
136 "ikea@lassul.us"
137 "blizzard@lassul.us"
138 "azure@lassul.us"
139 "engadin@lassul.us"
140 "jameda@lassul.us"
141 "flaschenpost@lassul.us"
142 "irc@lassul.us"
143 "dlive*@lassul.us"
144 "bunq@lassul.us"
145 "telegram@lassul.us"
146 "ryanair@lassul.us"
147 "phone@lassul.us"
148 "bitmex@lassul.us"
149 "matrix@lassul.us"
150 "itch@lassul.us"
151 "revolut@lassul.us"
152 "coronatest@lassul.us"
153 "dcso@lassul.us"
154 "easyjet@lassul.us"
155 "flipper@lassul.us"
156 "figma@lassul.us"
157 "psiram@lassul.us"
158 "wahl@lassul.us"
159 "instagram@lassul.us"
160 "poinbit@lassul.us"
161 "vvs@lassul.us"
162 "juicy@lassul.us"
163 "auth0@lassul.us"
164 "opodo@lassul.us"
165 "mytrip@lassul.us"
166 "kraken@lassul.us"
167 "swisspass@lassul.us"
168 "heise@lassul.us"
169 "dplf@lassul.us"
170 "rc3@lassul.us"
171 "booking@lassul.us"
172 "mozilla@lassul.us"
173 "bolt@lassul.us"
174 "wolt@lassul.us"
175 "independesk@lassul.us"
176 "oracle@lassul.us"
177 "dev@lassul.us"
178 "nebula@lassul.us"
179 "golem@lassul.us"
180 "planet@lassul.us"
181 "zerotier@lassul.us"
182 "coqui@lassul.us"
183 "numtide@lassul.us"
184 "linkedin@lassul.us"
185 "kaggle@lassul.us"
186 "lastfm@lassul.us"
187 "obi@lassul.us"
188 "aok@lassul.us"
189 "sevdesk@lassul.us"
190 "penta@lassul.us"
191 "solarisbank@lassul.us"
192 "tinder@lassul.us"
193 "vodafone@lassul.us"
194 "42keebs@lassul.us"
195 "pcb@lassul.us"
196 "splitkb@lassul.us"
197 "brackethq@lassul.us"
198 "fosdem@lassul.us"
199 "nreal@lassul.us"
200 "packaging@lassul.us"
201 "ebay@lassul.us"
202 "fusion@lassul.us"
203 "uber@lassul.us"
204 "consulting@lassul.us"
205 "steuer@lassul.us"
206 "versicherung@lassul.us"
207 "satellite@lassul.us"
208 "doodle@lassul.us"
209 "epost@lassul.us"
210 "gog@lassul.us"
211 "post@lassul.us"
212 "buhl@lassul.us"
213 "xxx@lassul.us"
214 "chess@lassul.us"
215 "thainix@lassul.us"
216 "volders@lassul.us"
217 "namecheap@lassul.us"
218 "clanlol@lassul.us"
219 "harvest@lassul.us"
220 "bauhaus@lassul.us"
221 "bahn@lassul.us"
222 "framework@lassul.us"
223 "bsdex@lassul.us"
224 "expressvpn@lassul.us"
225 "airvpn@lassul.us"
226 "prog@lassul.us"
227 "eventphone@lassul.us"
228 "startgg@lassul.us"
229 "ferdium@lassul.us"
230 "start@lassul.us"
231 "pad@lassul.us"
232 "ups@lassul.us"
233 "zalando@lassul.us"
234 "trip@lassul.us"
235 "git@lassul.us"
236 "archive@lassul.us"
237 "bybit@lassul.us"
238 "okcupid@lassul.us"
239 "ing@lassul.us"
240 "hornbach@lassul.us"
241 "huk@lassul.us"
242 "kleinanzeigen@lassul.us"
243 "nzbgeek@lassul.us"
244 "bonify@lassul.us"
245 "bitpanda@lassul.us"
246 "schufa@lassul.us"
247 "burger@lassul.us"
248 "eweka@lassul.us"
249 ];
250
251in
252{
253 imports = [
254 self.inputs.stockholm.nixosModules.exim-smarthost
255 ];
256
257 clan.core.vars.generators."lassul.us-dkim" = {
258 files."lassul.us.dkim.priv" = { };
259 files."lassul.us.dkim.pub".secret = false;
260 migrateFact = "lassul.us-dkim";
261 runtimeInputs = with pkgs; [
262 coreutils
263 openssl
264 ];
265 script = ''
266 openssl genrsa -out "$out"/lassul.us.dkim.priv 2048
267 openssl rsa -in "$out"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/lassul.us.dkim.pub
268 '';
269 };
270
271 krebs.exim-smarthost = {
272 enable = true;
273 dkim = [
274 {
275 domain = "lassul.us";
276 private_key = config.clan.core.vars.generators."lassul.us-dkim".files."lassul.us.dkim.priv".path;
277 }
278 ];
279 ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
280 ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
281 primary_hostname = "lassul.us";
282 sender_domains = [
283 "lassul.us"
284 ];
285 relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
286 config.krebs.hosts.aergia
287 config.krebs.hosts.ignavia
288 config.krebs.hosts.coaxmetal
289 config.krebs.hosts.green
290 config.krebs.hosts.mors
291 ];
292 internet-aliases = map (from: { inherit from to; }) mails ++ [
293 ];
294 system-aliases = [
295 {
296 from = "mailer-daemon";
297 to = "postmaster";
298 }
299 {
300 from = "postmaster";
301 to = "root";
302 }
303 {
304 from = "nobody";
305 to = "root";
306 }
307 {
308 from = "hostmaster";
309 to = "root";
310 }
311 {
312 from = "usenet";
313 to = "root";
314 }
315 {
316 from = "news";
317 to = "root";
318 }
319 {
320 from = "webmaster";
321 to = "root";
322 }
323 {
324 from = "www";
325 to = "root";
326 }
327 {
328 from = "ftp";
329 to = "root";
330 }
331 {
332 from = "abuse";
333 to = "root";
334 }
335 {
336 from = "noc";
337 to = "root";
338 }
339 {
340 from = "security";
341 to = "root";
342 }
343 {
344 from = "root";
345 to = "lass";
346 }
347 ];
348 };
349 # msmtp for local submission via SSH (connects to localhost:25)
350 environment.systemPackages = [ pkgs.msmtp ];
351
352 krebs.iptables.tables.filter.INPUT.rules = [
353 {
354 predicate = "-p tcp --dport smtp";
355 target = "ACCEPT";
356 }
357 ];
358
359 security.acme.certs."mail.lassul.us" = {
360 group = "lasscert";
361 webroot = "/var/lib/acme/acme-challenge";
362 };
363 users.groups.lasscert.members = [
364 "dovecot2"
365 "exim"
366 "nginx"
367 ];
368}