This repository has no description
8.1 kB
334 lines
1{
2 self,
3 config,
4 pkgs,
5 ...
6}:
7{
8 imports = [
9 ../../2configs
10 ../../2configs/retiolum.nix
11 ../../2configs/autoupdate.nix
12
13 self.inputs.stockholm.nixosModules.exim-smarthost
14 ];
15
16 krebs.build.host = config.krebs.hosts.ubik;
17 clan.password-store.targetDirectory = "/var/state/secrets";
18
19 krebs.sync-containers3.inContainer = {
20 enable = true;
21 pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBFGMjH0+Dco6DVFZbByENMci8CFTLXCL7j53yctPnM";
22 };
23
24 security.acme = {
25 acceptTerms = true;
26 defaults.email = "acme@lassul.us";
27 };
28 networking.firewall.allowedTCPPorts = [
29 80
30 443
31 ];
32
33 # nextcloud
34 services.nginx.virtualHosts."c.apanowicz.de" = {
35 enableACME = true;
36 forceSSL = true;
37 };
38 services.nextcloud = {
39 enable = true;
40 hostName = "c.apanowicz.de";
41 package = pkgs.nextcloud29;
42 config.adminpassFile = "/run/nextcloud.pw";
43 https = true;
44 maxUploadSize = "9001M";
45 };
46 clanCore.facts.services.nextcloud-pw = {
47 secret."nextcloud.pw" = { };
48 generator.script = ''
49 echo "$prompt_value" > "$secrets"/nextcloud.pw
50 '';
51 generator.prompt = ''
52 please enter the nextcloud admin password:
53 '';
54 };
55 systemd.services.nextcloud-setup.serviceConfig.ExecStartPre = [
56 "+${pkgs.writeDash "copy-pw" ''
57 ${pkgs.rsync}/bin/rsync \
58 --chown nextcloud:nextcloud \
59 --chmod 0700 \
60 ${config.clanCore.facts.services.nextcloud-pw.secret."nextcloud.pw".path} /run/nextcloud.pw
61 ''}"
62 ];
63
64 # mail
65 lass.usershadow.enable = true;
66 services.nginx.virtualHosts."mail.ubikmedia.eu" = {
67 enableACME = true;
68 forceSSL = true;
69 };
70 services.roundcube = {
71 enable = true;
72 hostName = "mail.ubikmedia.eu";
73 extraConfig = ''
74 $config['smtp_debug'] = true;
75 $config['smtp_host'] = "localhost:25";
76 '';
77 };
78 services.dovecot2 = {
79 enable = true;
80 showPAMFailure = true;
81 mailLocation = "maildir:~/Mail";
82 sslServerCert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
83 sslServerKey = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
84 };
85 krebs.exim-smarthost = {
86 ssl_cert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
87 ssl_key = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
88 authenticators.PLAIN = ''
89 driver = plaintext
90 public_name = PLAIN
91 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
92 '';
93 authenticators.LOGIN = ''
94 driver = plaintext
95 public_name = LOGIN
96 server_prompts = "Username:: : Password::"
97 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
98 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
99 '';
100 internet-aliases = [
101 {
102 from = "dma@ubikmedia.de";
103 to = "domsen";
104 }
105 {
106 from = "dma@ubikmedia.eu";
107 to = "domsen";
108 }
109 {
110 from = "hallo@apanowicz.de";
111 to = "domsen";
112 }
113 {
114 from = "bruno@apanowicz.de";
115 to = "bruno";
116 }
117 {
118 from = "mail@jla-trading.com";
119 to = "jla-trading";
120 }
121 {
122 from = "jms@ubikmedia.eu";
123 to = "jms";
124 }
125 {
126 from = "ms@ubikmedia.eu";
127 to = "ms";
128 }
129 {
130 from = "ubik@ubikmedia.eu";
131 to = "domsen, jms, ms";
132 }
133 {
134 from = "kontakt@alewis.de";
135 to = "klabusterbeere";
136 }
137 {
138 from = "hallo@jarugadesign.de";
139 to = "kasia";
140 }
141 {
142 from = "noreply@beeshmooth.ch";
143 to = "besmooth@gmx.ch";
144 }
145
146 {
147 from = "testuser@ubikmedia.eu";
148 to = "testuser";
149 }
150 ];
151 sender_domains = [
152 "jla-trading.com"
153 "ubikmedia.eu"
154 "ubikmedia.de"
155 "apanowicz.de"
156 "alewis.de"
157 "jarugadesign.de"
158 "beesmooth.ch"
159 ];
160 dkim = [
161 { domain = "ubikmedia.eu"; }
162 { domain = "apanowicz.de"; }
163 { domain = "beesmooth.ch"; }
164 ];
165 };
166
167 # users
168 users.groups.xanf = { };
169 users.users.UBIK-SFTP = {
170 uid = pkgs.stockholm.lib.genid_uint31 "UBIK-SFTP";
171 home = "/home/UBIK-SFTP";
172 useDefaultShell = true;
173 createHome = true;
174 isNormalUser = true;
175 };
176
177 users.users.xanf = {
178 uid = pkgs.stockholm.lib.genid_uint31 "xanf";
179 group = "xanf";
180 home = "/home/xanf";
181 useDefaultShell = true;
182 createHome = false; # creathome forces permissions
183 isNormalUser = true;
184 };
185
186 users.users.domsen = {
187 uid = pkgs.stockholm.lib.genid_uint31 "domsen";
188 description = "maintenance acc for domsen";
189 home = "/home/domsen";
190 useDefaultShell = true;
191 extraGroups = [
192 "syncthing"
193 "download"
194 "xanf"
195 ];
196 createHome = true;
197 isNormalUser = true;
198 };
199
200 users.users.bruno = {
201 uid = pkgs.stockholm.lib.genid_uint31 "bruno";
202 home = "/home/bruno";
203 useDefaultShell = true;
204 createHome = true;
205 isNormalUser = true;
206 };
207
208 users.users.jla-trading = {
209 uid = pkgs.stockholm.lib.genid_uint31 "jla-trading";
210 home = "/home/jla-trading";
211 useDefaultShell = true;
212 createHome = true;
213 isNormalUser = true;
214 };
215
216 users.users.jms = {
217 uid = pkgs.stockholm.lib.genid_uint31 "jms";
218 home = "/home/jms";
219 useDefaultShell = true;
220 createHome = true;
221 isNormalUser = true;
222 };
223
224 users.users.ms = {
225 uid = pkgs.stockholm.lib.genid_uint31 "ms";
226 home = "/home/ms";
227 useDefaultShell = true;
228 createHome = true;
229 isNormalUser = true;
230 };
231
232 users.users.testuser = {
233 uid = pkgs.stockholm.lib.genid_uint31 "testuser";
234 home = "/home/testuser";
235 useDefaultShell = true;
236 createHome = true;
237 isNormalUser = true;
238 };
239
240 users.users.bui = {
241 uid = pkgs.stockholm.lib.genid_uint31 "bui";
242 home = "/home/bui";
243 useDefaultShell = true;
244 createHome = true;
245 isNormalUser = true;
246 };
247
248 users.users.klabusterbeere = {
249 uid = pkgs.stockholm.lib.genid_uint31 "klabusterbeere";
250 home = "/home/klabusterbeere";
251 useDefaultShell = true;
252 createHome = true;
253 isNormalUser = true;
254 };
255
256 users.users.kasia = {
257 uid = pkgs.stockholm.lib.genid_uint31 "kasia";
258 home = "/home/kasia";
259 useDefaultShell = true;
260 createHome = true;
261 isNormalUser = true;
262 };
263
264 users.users.XANF_TEAM = {
265 uid = pkgs.stockholm.lib.genid_uint31 "XANF_TEAM";
266 group = "xanf";
267 home = "/home/XANF_TEAM";
268 useDefaultShell = true;
269 createHome = true;
270 isNormalUser = true;
271 };
272
273 users.users.dif = {
274 uid = pkgs.stockholm.lib.genid_uint31 "dif";
275 home = "/home/dif";
276 useDefaultShell = true;
277 extraGroups = [ "xanf" ];
278 createHome = true;
279 isNormalUser = true;
280 };
281
282 users.users.lavafilms = {
283 uid = pkgs.stockholm.lib.genid_uint31 "lavafilms";
284 home = "/home/lavafilms";
285 useDefaultShell = true;
286 extraGroups = [ "xanf" ];
287 createHome = true;
288 isNormalUser = true;
289 };
290
291 users.users.movematchers = {
292 uid = pkgs.stockholm.lib.genid_uint31 "movematchers";
293 home = "/home/movematchers";
294 useDefaultShell = true;
295 extraGroups = [ "xanf" ];
296 createHome = true;
297 isNormalUser = true;
298 };
299
300 users.users.blackphoton = {
301 uid = pkgs.stockholm.lib.genid_uint31 "blackphoton";
302 home = "/home/blackphoton";
303 useDefaultShell = true;
304 extraGroups = [ "xanf" ];
305 createHome = true;
306 isNormalUser = true;
307 };
308
309 users.users.line = {
310 uid = pkgs.stockholm.lib.genid_uint31 "line";
311 home = "/home/line";
312 useDefaultShell = true;
313 # extraGroups = [ "xanf" ];
314 createHome = true;
315 isNormalUser = true;
316 };
317
318 users.users.avada = {
319 uid = pkgs.stockholm.lib.genid_uint31 "avada";
320 home = "/home/avada";
321 useDefaultShell = true;
322 createHome = true;
323 isNormalUser = true;
324 };
325
326 users.users.familienrat = {
327 uid = pkgs.stockholm.lib.genid_uint31 "familienrat";
328 home = "/home/familienrat";
329 useDefaultShell = true;
330 createHome = true;
331 isNormalUser = true;
332 };
333
334}