This repository has no description
7.8 kB
322 lines
1{
2 self,
3 config,
4 pkgs,
5 ...
6}:
7{
8 imports = [
9 ../../2configs
10 ../../2configs/retiolum.nix
11 ../../2configs/autoupdate.nix
12
13 self.inputs.stockholm.nixosModules.exim-smarthost
14 ];
15
16 krebs.build.host = config.krebs.hosts.ubik;
17 clan.password-store.targetDirectory = "/var/state/secrets";
18 clan.core.vars.password-store.secretLocation = "/var/state/secret-vars";
19
20 krebs.sync-containers3.inContainer = {
21 enable = true;
22 pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBFGMjH0+Dco6DVFZbByENMci8CFTLXCL7j53yctPnM";
23 };
24
25 security.acme = {
26 acceptTerms = true;
27 defaults.email = "acme@lassul.us";
28 };
29 networking.firewall.allowedTCPPorts = [
30 80
31 443
32 ];
33
34 # nextcloud
35 services.nginx.virtualHosts."c.apanowicz.de" = {
36 enableACME = true;
37 forceSSL = true;
38 };
39 services.nextcloud = {
40 enable = true;
41 hostName = "c.apanowicz.de";
42 package = pkgs.nextcloud30;
43 config.dbtype = "sqlite";
44 config.adminpassFile = config.clan.core.vars.generators.nextcloud-pw.files.nextcloud-pw.path;
45 https = true;
46 maxUploadSize = "9001M";
47 };
48 clan.core.vars.generators.nextcloud-pw = {
49 prompts.nextcloud-pw.persist = true;
50 };
51
52 # mail
53 lass.usershadow.enable = true;
54 services.nginx.virtualHosts."mail.ubikmedia.eu" = {
55 enableACME = true;
56 forceSSL = true;
57 };
58 services.roundcube = {
59 enable = true;
60 hostName = "mail.ubikmedia.eu";
61 extraConfig = ''
62 $config['smtp_debug'] = true;
63 $config['smtp_host'] = "localhost:25";
64 '';
65 };
66 services.dovecot2 = {
67 enable = true;
68 showPAMFailure = true;
69 mailLocation = "maildir:~/Mail";
70 sslServerCert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
71 sslServerKey = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
72 };
73 krebs.exim-smarthost = {
74 ssl_cert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
75 ssl_key = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
76 authenticators.PLAIN = ''
77 driver = plaintext
78 public_name = PLAIN
79 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
80 '';
81 authenticators.LOGIN = ''
82 driver = plaintext
83 public_name = LOGIN
84 server_prompts = "Username:: : Password::"
85 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
86 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
87 '';
88 internet-aliases = [
89 {
90 from = "dma@ubikmedia.de";
91 to = "domsen";
92 }
93 {
94 from = "dma@ubikmedia.eu";
95 to = "domsen";
96 }
97 {
98 from = "hallo@apanowicz.de";
99 to = "domsen";
100 }
101 {
102 from = "bruno@apanowicz.de";
103 to = "bruno";
104 }
105 {
106 from = "mail@jla-trading.com";
107 to = "jla-trading";
108 }
109 {
110 from = "jms@ubikmedia.eu";
111 to = "jms";
112 }
113 {
114 from = "ms@ubikmedia.eu";
115 to = "ms";
116 }
117 {
118 from = "ubik@ubikmedia.eu";
119 to = "domsen, jms, ms";
120 }
121 {
122 from = "kontakt@alewis.de";
123 to = "klabusterbeere";
124 }
125 {
126 from = "hallo@jarugadesign.de";
127 to = "kasia";
128 }
129 {
130 from = "noreply@beeshmooth.ch";
131 to = "besmooth@gmx.ch";
132 }
133
134 {
135 from = "testuser@ubikmedia.eu";
136 to = "testuser";
137 }
138 ];
139 sender_domains = [
140 "jla-trading.com"
141 "ubikmedia.eu"
142 "ubikmedia.de"
143 "apanowicz.de"
144 "alewis.de"
145 "jarugadesign.de"
146 "beesmooth.ch"
147 ];
148 dkim = [
149 { domain = "ubikmedia.eu"; }
150 { domain = "apanowicz.de"; }
151 { domain = "beesmooth.ch"; }
152 ];
153 };
154
155 # users
156 users.groups.xanf = { };
157 users.users.UBIK-SFTP = {
158 uid = pkgs.stockholm.lib.genid_uint31 "UBIK-SFTP";
159 home = "/home/UBIK-SFTP";
160 useDefaultShell = true;
161 createHome = true;
162 isNormalUser = true;
163 };
164
165 users.users.xanf = {
166 uid = pkgs.stockholm.lib.genid_uint31 "xanf";
167 group = "xanf";
168 home = "/home/xanf";
169 useDefaultShell = true;
170 createHome = false; # creathome forces permissions
171 isNormalUser = true;
172 };
173
174 users.users.domsen = {
175 uid = pkgs.stockholm.lib.genid_uint31 "domsen";
176 description = "maintenance acc for domsen";
177 home = "/home/domsen";
178 useDefaultShell = true;
179 extraGroups = [
180 "syncthing"
181 "download"
182 "xanf"
183 ];
184 createHome = true;
185 isNormalUser = true;
186 };
187
188 users.users.bruno = {
189 uid = pkgs.stockholm.lib.genid_uint31 "bruno";
190 home = "/home/bruno";
191 useDefaultShell = true;
192 createHome = true;
193 isNormalUser = true;
194 };
195
196 users.users.jla-trading = {
197 uid = pkgs.stockholm.lib.genid_uint31 "jla-trading";
198 home = "/home/jla-trading";
199 useDefaultShell = true;
200 createHome = true;
201 isNormalUser = true;
202 };
203
204 users.users.jms = {
205 uid = pkgs.stockholm.lib.genid_uint31 "jms";
206 home = "/home/jms";
207 useDefaultShell = true;
208 createHome = true;
209 isNormalUser = true;
210 };
211
212 users.users.ms = {
213 uid = pkgs.stockholm.lib.genid_uint31 "ms";
214 home = "/home/ms";
215 useDefaultShell = true;
216 createHome = true;
217 isNormalUser = true;
218 };
219
220 users.users.testuser = {
221 uid = pkgs.stockholm.lib.genid_uint31 "testuser";
222 home = "/home/testuser";
223 useDefaultShell = true;
224 createHome = true;
225 isNormalUser = true;
226 };
227
228 users.users.bui = {
229 uid = pkgs.stockholm.lib.genid_uint31 "bui";
230 home = "/home/bui";
231 useDefaultShell = true;
232 createHome = true;
233 isNormalUser = true;
234 };
235
236 users.users.klabusterbeere = {
237 uid = pkgs.stockholm.lib.genid_uint31 "klabusterbeere";
238 home = "/home/klabusterbeere";
239 useDefaultShell = true;
240 createHome = true;
241 isNormalUser = true;
242 };
243
244 users.users.kasia = {
245 uid = pkgs.stockholm.lib.genid_uint31 "kasia";
246 home = "/home/kasia";
247 useDefaultShell = true;
248 createHome = true;
249 isNormalUser = true;
250 };
251
252 users.users.XANF_TEAM = {
253 uid = pkgs.stockholm.lib.genid_uint31 "XANF_TEAM";
254 group = "xanf";
255 home = "/home/XANF_TEAM";
256 useDefaultShell = true;
257 createHome = true;
258 isNormalUser = true;
259 };
260
261 users.users.dif = {
262 uid = pkgs.stockholm.lib.genid_uint31 "dif";
263 home = "/home/dif";
264 useDefaultShell = true;
265 extraGroups = [ "xanf" ];
266 createHome = true;
267 isNormalUser = true;
268 };
269
270 users.users.lavafilms = {
271 uid = pkgs.stockholm.lib.genid_uint31 "lavafilms";
272 home = "/home/lavafilms";
273 useDefaultShell = true;
274 extraGroups = [ "xanf" ];
275 createHome = true;
276 isNormalUser = true;
277 };
278
279 users.users.movematchers = {
280 uid = pkgs.stockholm.lib.genid_uint31 "movematchers";
281 home = "/home/movematchers";
282 useDefaultShell = true;
283 extraGroups = [ "xanf" ];
284 createHome = true;
285 isNormalUser = true;
286 };
287
288 users.users.blackphoton = {
289 uid = pkgs.stockholm.lib.genid_uint31 "blackphoton";
290 home = "/home/blackphoton";
291 useDefaultShell = true;
292 extraGroups = [ "xanf" ];
293 createHome = true;
294 isNormalUser = true;
295 };
296
297 users.users.line = {
298 uid = pkgs.stockholm.lib.genid_uint31 "line";
299 home = "/home/line";
300 useDefaultShell = true;
301 # extraGroups = [ "xanf" ];
302 createHome = true;
303 isNormalUser = true;
304 };
305
306 users.users.avada = {
307 uid = pkgs.stockholm.lib.genid_uint31 "avada";
308 home = "/home/avada";
309 useDefaultShell = true;
310 createHome = true;
311 isNormalUser = true;
312 };
313
314 users.users.familienrat = {
315 uid = pkgs.stockholm.lib.genid_uint31 "familienrat";
316 home = "/home/familienrat";
317 useDefaultShell = true;
318 createHome = true;
319 isNormalUser = true;
320 };
321
322}