forked from
lass.pds.lassul.us/superconfig
This repository has no description
2.6 kB
133 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9
10 to = lib.concatStringsSep "," [
11 "lass@green.r"
12 ];
13
14 mails = [
15 ];
16
17in
18{
19 imports = [
20 self.inputs.stockholm.nixosModules.exim-smarthost
21 ];
22
23 clan.core.vars.generators."lassul.us-dkim" = {
24 files."lassul.us.dkim.priv" = { };
25 files."lassul.us.dkim.pub".secret = false;
26 migrateFact = "lassul.us-dkim";
27 runtimeInputs = with pkgs; [
28 coreutils
29 openssl
30 ];
31 script = ''
32 openssl genrsa -out "$out"/lassul.us.dkim.priv 2048
33 openssl rsa -in "$out"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/lassul.us.dkim.pub
34 '';
35 };
36
37 krebs.exim-smarthost = {
38 enable = true;
39 dkim = [
40 {
41 domain = "lassul.us";
42 private_key = config.clan.core.vars.generators."lassul.us-dkim".files."lassul.us.dkim.priv".path;
43 }
44 ];
45 ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
46 ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
47 primary_hostname = "lassul.us";
48 sender_domains = [
49 "lassul.us"
50 ];
51 relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
52 config.krebs.hosts.aergia
53 config.krebs.hosts.ignavia
54 config.krebs.hosts.blue
55 config.krebs.hosts.coaxmetal
56 config.krebs.hosts.green
57 config.krebs.hosts.mors
58 config.krebs.hosts.xerxes
59 ];
60 internet-aliases = map (from: { inherit from to; }) mails ++ [
61 ];
62 system-aliases = [
63 {
64 from = "mailer-daemon";
65 to = "postmaster";
66 }
67 {
68 from = "postmaster";
69 to = "root";
70 }
71 {
72 from = "nobody";
73 to = "root";
74 }
75 {
76 from = "hostmaster";
77 to = "root";
78 }
79 {
80 from = "usenet";
81 to = "root";
82 }
83 {
84 from = "news";
85 to = "root";
86 }
87 {
88 from = "webmaster";
89 to = "root";
90 }
91 {
92 from = "www";
93 to = "root";
94 }
95 {
96 from = "ftp";
97 to = "root";
98 }
99 {
100 from = "abuse";
101 to = "root";
102 }
103 {
104 from = "noc";
105 to = "root";
106 }
107 {
108 from = "security";
109 to = "root";
110 }
111 {
112 from = "root";
113 to = "lass";
114 }
115 ];
116 };
117 krebs.iptables.tables.filter.INPUT.rules = [
118 {
119 predicate = "-p tcp --dport smtp";
120 target = "ACCEPT";
121 }
122 ];
123
124 security.acme.certs."mail.lassul.us" = {
125 group = "lasscert";
126 webroot = "/var/lib/acme/acme-challenge";
127 };
128 users.groups.lasscert.members = [
129 "dovecot2"
130 "exim"
131 "nginx"
132 ];
133}