This repository has no description
13 kB
489 lines
1{ self, config, pkgs, lib, ... }:
2
3let
4
5 inherit (self.inputs.stockholm.lib)
6 genid_uint31
7 ;
8 inherit (import ./util.nix {inherit lib pkgs;})
9 servePage
10 serveOwncloud
11 serveWordpress;
12
13 msmtprc = pkgs.writeText "msmtprc" ''
14 account localhost
15 host localhost
16 account default: localhost
17 '';
18
19 sendmail = pkgs.writeDash "msmtp" ''
20 exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
21 '';
22
23in {
24 imports = [
25 self.inputs.stockholm.nixosModules.acl
26 self.inputs.stockholm.nixosModules.on-failure
27 ./default.nix
28 ./sqlBackup.nix
29 (servePage [ "aldonasiech.com" "www.aldonasiech.com" ])
30 (servePage [ "apanowicz.de" "www.apanowicz.de" ])
31 (servePage [ "reich-gebaeudereinigung.de" "www.reich-gebaeudereinigung.de" ])
32 (servePage [ "illustra.de" "www.illustra.de" ])
33 (servePage [ "event-extra.de" "www.event-extra.de" ])
34 # (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
35 (servePage [ "familienrat-hamburg.de" "www.familienrat-hamburg.de" ])
36 (servePage [ "karlaskop.de" ])
37 (servePage [
38 "freemonkey.art"
39 "www.freemonkey.art"
40 ])
41 (serveOwncloud [ "o.ubikmedia.de" ])
42 (serveWordpress [
43 "ubikmedia.de"
44 "ubikmedia.eu"
45 "youthtube.xyz"
46 "joemisch.com"
47 "weirdwednesday.de"
48 "jarugadesign.de"
49 "beesmooth.ch"
50
51 "www.ubikmedia.eu"
52 "www.youthtube.xyz"
53 "www.ubikmedia.de"
54 "www.joemisch.com"
55 "www.weirdwednesday.de"
56 "www.jarugadesign.de"
57 "www.beesmooth.ch"
58
59 "aldona2.ubikmedia.de"
60 "cinevita.ubikmedia.de"
61 "factscloud.ubikmedia.de"
62 "illucloud.ubikmedia.de"
63 "joemisch.ubikmedia.de"
64 "nb.ubikmedia.de"
65 "youthtube.ubikmedia.de"
66 "weirdwednesday.ubikmedia.de"
67 "freemonkey.ubikmedia.de"
68 "jarugadesign.ubikmedia.de"
69 "crypto4art.ubikmedia.de"
70 "jarugadesign.ubikmedia.de"
71 "beesmooth.ubikmedia.de"
72 ])
73 ];
74
75 # https://github.com/nextcloud/server/issues/25436
76 services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
77
78 services.mysql.ensureDatabases = [ "ubikmedia_de" "o_ubikmedia_de" ];
79 services.mysql.ensureUsers = [
80 { ensurePermissions = { "ubikmedia_de.*" = "ALL"; }; name = "nginx"; }
81 { ensurePermissions = { "o_ubikmedia_de.*" = "ALL"; }; name = "nginx"; }
82 ];
83
84 services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
85 try_files $uri $uri/ /index.php?$args;
86 '';
87
88 lass.mysqlBackup.config.all.databases = [
89 "ubikmedia_de"
90 "o_ubikmedia_de"
91 ];
92
93 services.phpfpm.phpOptions = ''
94 sendmail_path = ${sendmail} -t
95 upload_max_filesize = 100M
96 post_max_size = 100M
97 file_uploads = on
98 '';
99
100 systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ];
101 krebs.secret.files.nextcloud_pw = {
102 path = "/run/nextcloud.pw";
103 owner.name = "nextcloud";
104 group-name = "nextcloud";
105 source-path = "${config.krebs.secret.directory}/nextcloud_pw";
106 };
107 services.nextcloud = {
108 enable = true;
109 hostName = "o.xanf.org";
110 package = pkgs.nextcloud27;
111 config = {
112 adminpassFile = "/run/nextcloud.pw";
113 overwriteProtocol = "https";
114 };
115 https = true;
116 };
117 services.nginx.virtualHosts."o.xanf.org" = {
118 enableACME = true;
119 forceSSL = true;
120 };
121 services.nginx.virtualHosts."weirdweekender.de" = {
122 serverAliases = [ "www.weirdweekender.de" ];
123 enableACME = true;
124 forceSSL = true;
125 locations."/".extraConfig = ''
126 return 301 https://weirdwednesday.de/weirdweekender/;
127 '';
128 };
129
130 # MAIL STUFF
131 # TODO: make into its own module
132
133 services.roundcube = {
134 enable = true;
135 hostName = "mail.lassul.us";
136 extraConfig = ''
137 $config['smtp_debug'] = true;
138 $config['smtp_host'] = "localhost:25";
139 '';
140 };
141 services.dovecot2 = {
142 enable = true;
143 showPAMFailure = true;
144 mailLocation = "maildir:~/Mail";
145 sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
146 sslServerKey = "/var/lib/acme/lassul.us/key.pem";
147 };
148 krebs.iptables.tables.filter.INPUT.rules = [
149 { predicate = "-p tcp --dport pop3s"; target = "ACCEPT"; }
150 { predicate = "-p tcp --dport imaps"; target = "ACCEPT"; }
151 ];
152
153 environment.systemPackages = [
154 (pkgs.writers.writeDashBin "debug_exim" ''
155 set -ef
156 export PATH="${lib.makeBinPath [ pkgs.coreutils ]}"
157 echo "$@" >> /tmp/xxx
158 /run/wrappers/bin/shadow_verify_arg "${config.lass.usershadow.pattern}" "$2" "$3" 2>>/tmp/xxx1
159 echo "ok" >> /tmp/yyy
160 exit 23
161 '')
162 ];
163
164 krebs.exim-smarthost = {
165 authenticators.PLAIN = ''
166 driver = plaintext
167 public_name = PLAIN
168 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
169 '';
170 authenticators.LOGIN = ''
171 driver = plaintext
172 public_name = LOGIN
173 server_prompts = "Username:: : Password::"
174 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
175 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
176 '';
177 internet-aliases = [
178 { from = "dma@ubikmedia.de"; to = "domsen"; }
179 { from = "dma@ubikmedia.eu"; to = "domsen"; }
180 { from = "mail@habsys.de"; to = "domsen"; }
181 { from = "mail@habsys.eu"; to = "domsen"; }
182 { from = "hallo@apanowicz.de"; to = "domsen"; }
183 { from = "bruno@apanowicz.de"; to = "bruno"; }
184 { from = "mail@jla-trading.com"; to = "jla-trading"; }
185 { from = "jms@ubikmedia.eu"; to = "jms"; }
186 { from = "ms@ubikmedia.eu"; to = "ms"; }
187 { from = "ubik@ubikmedia.eu"; to = "domsen, jms, ms"; }
188 { from = "kontakt@alewis.de"; to ="klabusterbeere"; }
189 { from = "hallo@jarugadesign.de"; to ="kasia"; }
190 { from = "noreply@beeshmooth.ch"; to ="besmooth@gmx.ch"; }
191
192 { from = "testuser@lassul.us"; to = "testuser"; }
193 { from = "testuser@ubikmedia.eu"; to = "testuser"; }
194 ];
195 sender_domains = [
196 "jla-trading.com"
197 "ubikmedia.eu"
198 "ubikmedia.de"
199 "apanowicz.de"
200 "alewis.de"
201 "jarugadesign.de"
202 "beesmooth.ch"
203 "event-extra.de"
204 ];
205 dkim = [
206 { domain = "ubikmedia.eu"; }
207 { domain = "apanowicz.de"; }
208 { domain = "beesmooth.ch"; }
209 ];
210 };
211 clanCore.secrets."ubikmedia.eu-dkim" = {
212 secrets."ubikmedia.eu.dkim.priv" = { };
213 facts."ubikmedia.eu.dkim.pub" = { };
214 generator.path = with pkgs; [ coreutils openssl ];
215 generator.script = ''
216 openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 2048
217 openssl rsa -in "$secrets"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/ubikmedia.eu.dkim.pub
218 '';
219 };
220 clanCore.secrets."apanowicz.de-dkim" = {
221 secrets."apanowicz.de.dkim.priv" = { };
222 facts."apanowicz.de.dkim.pub" = { };
223 generator.path = with pkgs; [ coreutils openssl ];
224 generator.script = ''
225 openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 2048
226 openssl rsa -in "$secrets"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/apanowicz.de.dkim.pub
227 '';
228 };
229 clanCore.secrets."beesmooth.ch-dkim" = {
230 secrets."beesmooth.ch.dkim.priv" = { };
231 facts."beesmooth.ch.dkim.pub" = { };
232 generator.path = with pkgs; [ coreutils openssl ];
233 generator.script = ''
234 openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 2048
235 openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
236 '';
237 };
238 services.borgbackup.jobs.hetzner.paths = [
239 "/home/xanf"
240 "/home/domsen"
241 "/home/bruno"
242 "/home/jla-trading"
243 "/home/jms"
244 "/home/ms"
245 "/home/bui"
246 "/home/klabusterbeere"
247 "/home/akayguen"
248 "/home/kasia"
249 "/home/dif"
250 "/home/lavafilms"
251 "/home/movematchers"
252 "/home/blackphoton"
253 "/home/avada"
254 "/home/sts"
255 "/home/familienrat"
256 ];
257 users.users.UBIK-SFTP = {
258 uid = genid_uint31 "UBIK-SFTP";
259 home = "/home/UBIK-SFTP";
260 useDefaultShell = true;
261 createHome = true;
262 isNormalUser = true;
263 };
264
265 users.users.xanf = {
266 uid = genid_uint31 "xanf";
267 group = "xanf";
268 home = "/home/xanf";
269 useDefaultShell = true;
270 createHome = false; # creathome forces permissions
271 isNormalUser = true;
272 };
273
274 users.users.domsen = {
275 uid = genid_uint31 "domsen";
276 description = "maintenance acc for domsen";
277 home = "/home/domsen";
278 useDefaultShell = true;
279 extraGroups = [ "syncthing" "download" "xanf" ];
280 createHome = true;
281 isNormalUser = true;
282 };
283
284 users.users.bruno = {
285 uid = genid_uint31 "bruno";
286 home = "/home/bruno";
287 useDefaultShell = true;
288 createHome = true;
289 isNormalUser = true;
290 };
291
292 users.users.jla-trading = {
293 uid = genid_uint31 "jla-trading";
294 home = "/home/jla-trading";
295 useDefaultShell = true;
296 createHome = true;
297 isNormalUser = true;
298 };
299
300 users.users.jms = {
301 uid = genid_uint31 "jms";
302 home = "/home/jms";
303 useDefaultShell = true;
304 createHome = true;
305 isNormalUser = true;
306 };
307
308 users.users.ms = {
309 uid = genid_uint31 "ms";
310 home = "/home/ms";
311 useDefaultShell = true;
312 createHome = true;
313 isNormalUser = true;
314 };
315
316 users.users.testuser = {
317 uid = genid_uint31 "testuser";
318 home = "/home/testuser";
319 useDefaultShell = true;
320 createHome = true;
321 isNormalUser = true;
322 };
323
324 #users.users.akayguen = {
325 # uid = genid_uint31 "akayguen";
326 # home = "/home/akayguen";
327 # useDefaultShell = true;
328 # createHome = true;
329 # isNormalUser = true;
330 #};
331
332 users.users.bui = {
333 uid = genid_uint31 "bui";
334 home = "/home/bui";
335 useDefaultShell = true;
336 createHome = true;
337 isNormalUser = true;
338 };
339
340 users.users.klabusterbeere = {
341 uid = genid_uint31 "klabusterbeere";
342 home = "/home/klabusterbeere";
343 useDefaultShell = true;
344 createHome = true;
345 isNormalUser = true;
346 };
347
348 users.users.kasia = {
349 uid = genid_uint31 "kasia";
350 home = "/home/kasia";
351 useDefaultShell = true;
352 createHome = true;
353 isNormalUser = true;
354 };
355
356 users.users.XANF_TEAM = {
357 uid = genid_uint31 "XANF_TEAM";
358 group = "xanf";
359 home = "/home/XANF_TEAM";
360 useDefaultShell = true;
361 createHome = true;
362 isNormalUser = true;
363 };
364
365 users.users.dif = {
366 uid = genid_uint31 "dif";
367 home = "/home/dif";
368 useDefaultShell = true;
369 extraGroups = [ "xanf" ];
370 createHome = true;
371 isNormalUser = true;
372 };
373
374 users.users.lavafilms = {
375 uid = genid_uint31 "lavafilms";
376 home = "/home/lavafilms";
377 useDefaultShell = true;
378 extraGroups = [ "xanf" ];
379 createHome = true;
380 isNormalUser = true;
381 };
382
383 users.users.movematchers = {
384 uid = genid_uint31 "movematchers";
385 home = "/home/movematchers";
386 useDefaultShell = true;
387 extraGroups = [ "xanf" ];
388 createHome = true;
389 isNormalUser = true;
390 };
391
392 users.users.blackphoton = {
393 uid = genid_uint31 "blackphoton";
394 home = "/home/blackphoton";
395 useDefaultShell = true;
396 extraGroups = [ "xanf" ];
397 createHome = true;
398 isNormalUser = true;
399 };
400
401 users.users.line = {
402 uid = genid_uint31 "line";
403 home = "/home/line";
404 useDefaultShell = true;
405 # extraGroups = [ "xanf" ];
406 createHome = true;
407 isNormalUser = true;
408 };
409
410 users.users.avada = {
411 uid = genid_uint31 "avada";
412 home = "/home/avada";
413 useDefaultShell = true;
414 createHome = true;
415 isNormalUser = true;
416 };
417
418 users.users.sts = {
419 uid = genid_uint31 "sts";
420 home = "/home/sts";
421 useDefaultShell = true;
422 createHome = true;
423 isNormalUser = true;
424 };
425
426 users.users.familienrat = {
427 uid = genid_uint31 "familienrat";
428 home = "/home/familienrat";
429 useDefaultShell = true;
430 createHome = true;
431 isNormalUser = true;
432 };
433 krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = {};
434 krebs.acl."/srv/http"."u:familienrat:X" = {
435 default = false;
436 recursive = false;
437 };
438
439 users.groups.xanf = {};
440
441 krebs.on-failure.plans.restic-backups-domsen = {
442 journalctl = {
443 lines = 1000;
444 };
445 };
446
447 services.restic.backups.domsen = {
448 initialize = true;
449 repository = "/backups/domsen";
450 passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
451 timerConfig = { OnCalendar = "00:05"; RandomizedDelaySec = "5h"; };
452 paths = [
453 "/home/domsen/Mail"
454 "/home/ms/Mail"
455 "/home/klabusterbeere/Mail"
456 "/home/jms/Mail"
457 "/home/kasia/Mail"
458 "/home/bruno/Mail"
459 "/home/akayguen/Mail"
460 "/backups/sql_dumps"
461 ];
462 };
463
464 services.syncthing.declarative.folders = {
465 domsen-backups = {
466 path = "/backups/domsen";
467 devices = [ "domsen-backup" ];
468 };
469 domsen-backup-srv-http = {
470 path = "/srv/http";
471 devices = [ "domsen-backup" ];
472 };
473 };
474
475 system.activationScripts.domsen-backups = ''
476 ${pkgs.coreutils}/bin/chmod 750 /backups
477 '';
478
479 # takes too long!!
480 # krebs.acl."/srv/http"."u:syncthing:rwX" = {};
481 # krebs.acl."/srv/http"."u:nginx:rwX" = {};
482 # krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
483 krebs.acl."/home/xanf/XANF_TEAM"."g:xanf:rwX" = {};
484 krebs.acl."/home/xanf"."g:xanf:X" = {
485 default = false;
486 recursive = false;
487 };
488}
489