This repository has no description
12 kB
486 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10
11 inherit (self.inputs.stockholm.lib)
12 genid_uint31
13 ;
14 inherit (import ./util.nix { inherit lib pkgs; })
15 servePage
16 serveWordpress
17 ;
18
19 msmtprc = pkgs.writeText "msmtprc" ''
20 account localhost
21 host localhost
22 account default: localhost
23 '';
24
25 sendmail = pkgs.writeDash "msmtp" ''
26 exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
27 '';
28
29in
30{
31 imports = [
32 self.inputs.stockholm.nixosModules.acl
33 self.inputs.stockholm.nixosModules.on-failure
34 ./default.nix
35 ./sqlBackup.nix
36 (servePage [
37 "aldonasiech.com"
38 "www.aldonasiech.com"
39 ])
40 (servePage [
41 "illustra.de"
42 "www.illustra.de"
43 ])
44 # (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
45 (servePage [ "karlaskop.de" ])
46 (servePage [
47 "freemonkey.art"
48 "www.freemonkey.art"
49 ])
50 (serveWordpress [
51 "ubikmedia.de"
52 "ubikmedia.eu"
53 "youthtube.xyz"
54 "joemisch.com"
55 "weirdwednesday.de"
56 "jarugadesign.de"
57 "beesmooth.ch"
58
59 "www.ubikmedia.eu"
60 "www.youthtube.xyz"
61 "www.ubikmedia.de"
62 "www.joemisch.com"
63 "www.weirdwednesday.de"
64 "www.jarugadesign.de"
65 "www.beesmooth.ch"
66
67 "aldona2.ubikmedia.de"
68 "cinevita.ubikmedia.de"
69 "factscloud.ubikmedia.de"
70 "illucloud.ubikmedia.de"
71 "joemisch.ubikmedia.de"
72 "nb.ubikmedia.de"
73 "youthtube.ubikmedia.de"
74 "weirdwednesday.ubikmedia.de"
75 "freemonkey.ubikmedia.de"
76 "jarugadesign.ubikmedia.de"
77 "crypto4art.ubikmedia.de"
78 "jarugadesign.ubikmedia.de"
79 "beesmooth.ubikmedia.de"
80 ])
81 ];
82
83 # https://github.com/nextcloud/server/issues/25436
84 services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
85
86 services.mysql.ensureDatabases = [
87 "ubikmedia_de"
88 "o_ubikmedia_de"
89 ];
90 services.mysql.ensureUsers = [
91 {
92 ensurePermissions = {
93 "ubikmedia_de.*" = "ALL";
94 };
95 name = "nginx";
96 }
97 {
98 ensurePermissions = {
99 "o_ubikmedia_de.*" = "ALL";
100 };
101 name = "nginx";
102 }
103 ];
104
105 services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
106 try_files $uri $uri/ /index.php?$args;
107 '';
108
109 lass.mysqlBackup.config.all.databases = [
110 "ubikmedia_de"
111 "o_ubikmedia_de"
112 ];
113
114 services.phpfpm.phpOptions = ''
115 sendmail_path = ${sendmail} -t
116 upload_max_filesize = 100M
117 post_max_size = 100M
118 file_uploads = on
119 '';
120
121 clan.core.vars.generators.nextcloud = {
122 files."nextcloud_pw" = { };
123 prompts.password.description = "enter initial admin password for nextcloud";
124 script = ''
125 cat "$prompts"/password > "$out"/nextcloud_pw
126 '';
127 };
128 # systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ];
129 # krebs.secret.files.nextcloud_pw = {
130 # path = "/run/nextcloud.pw";
131 # owner.name = "nextcloud";
132 # group-name = "nextcloud";
133 # source-path = "${config.krebs.secret.directory}/nextcloud_pw";
134 # };
135 services.nextcloud = {
136 enable = true;
137 hostName = "o.xanf.org";
138 package = pkgs.nextcloud31;
139 settings.overwriteProtocol = "https";
140 config.dbtype = "sqlite";
141 config.adminpassFile = "/run/nextcloud.pw";
142 https = true;
143 };
144 services.nginx.virtualHosts."o.xanf.org" = {
145 enableACME = true;
146 forceSSL = true;
147 };
148 services.nginx.virtualHosts."weirdweekender.de" = {
149 serverAliases = [ "www.weirdweekender.de" ];
150 enableACME = true;
151 forceSSL = true;
152 locations."/".extraConfig = ''
153 return 301 https://wonderl.ink/@weird0711;
154 '';
155 };
156 services.nginx.virtualHosts."shop.weirdwednesday.de" = {
157 enableACME = true;
158 addSSL = true;
159 locations."/".extraConfig = ''
160 return 301 https://weirdwednesday0711.etsy.com;
161 '';
162 };
163
164 # MAIL STUFF
165 # TODO: make into its own module
166
167 services.roundcube = {
168 enable = true;
169 hostName = "mail.lassul.us";
170 extraConfig = ''
171 $config['smtp_debug'] = true;
172 $config['smtp_host'] = "localhost:25";
173 '';
174 };
175 services.dovecot2 = {
176 enable = true;
177 showPAMFailure = true;
178 mailLocation = "maildir:~/Mail";
179 sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
180 sslServerKey = "/var/lib/acme/lassul.us/key.pem";
181 };
182
183 environment.systemPackages = [
184 (pkgs.writers.writeDashBin "debug_exim" ''
185 set -ef
186 export PATH="${lib.makeBinPath [ pkgs.coreutils ]}"
187 echo "$@" >> /tmp/xxx
188 /run/wrappers/bin/shadow_verify_arg "${config.lass.usershadow.pattern}" "$2" "$3" 2>>/tmp/xxx1
189 echo "ok" >> /tmp/yyy
190 exit 23
191 '')
192 ];
193
194 krebs.exim-smarthost = {
195 authenticators.PLAIN = ''
196 driver = plaintext
197 public_name = PLAIN
198 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
199 '';
200 authenticators.LOGIN = ''
201 driver = plaintext
202 public_name = LOGIN
203 server_prompts = "Username:: : Password::"
204 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
205 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
206 '';
207 internet-aliases = [
208 {
209 from = "dma@ubikmedia.de";
210 to = "domsen";
211 }
212 {
213 from = "dma@ubikmedia.eu";
214 to = "domsen";
215 }
216 {
217 from = "mail@habsys.de";
218 to = "domsen";
219 }
220 {
221 from = "mail@habsys.eu";
222 to = "domsen";
223 }
224 {
225 from = "hallo@apanowicz.de";
226 to = "domsen";
227 }
228 {
229 from = "bruno@apanowicz.de";
230 to = "bruno";
231 }
232 {
233 from = "mail@jla-trading.com";
234 to = "jla-trading";
235 }
236 {
237 from = "jms@ubikmedia.eu";
238 to = "jms";
239 }
240 {
241 from = "ms@ubikmedia.eu";
242 to = "ms";
243 }
244 {
245 from = "ubik@ubikmedia.eu";
246 to = "domsen, jms, ms";
247 }
248 {
249 from = "kontakt@alewis.de";
250 to = "klabusterbeere";
251 }
252 {
253 from = "hallo@jarugadesign.de";
254 to = "kasia";
255 }
256 {
257 from = "noreply@beeshmooth.ch";
258 to = "besmooth@gmx.ch";
259 }
260
261 {
262 from = "testuser@lassul.us";
263 to = "testuser";
264 }
265 {
266 from = "testuser@ubikmedia.eu";
267 to = "testuser";
268 }
269 ];
270 sender_domains = [
271 "jla-trading.com"
272 "ubikmedia.eu"
273 "ubikmedia.de"
274 "apanowicz.de"
275 "alewis.de"
276 "jarugadesign.de"
277 "beesmooth.ch"
278 "event-extra.de"
279 ];
280 dkim = [
281 { domain = "ubikmedia.eu"; }
282 { domain = "apanowicz.de"; }
283 { domain = "beesmooth.ch"; }
284 ];
285 };
286 clan.core.vars.generators."ubikmedia.eu-dkim" = {
287 files."ubikmedia.eu.dkim.priv" = { };
288 files."ubikmedia.eu.dkim.pub".secret = false;
289 runtimeInputs = with pkgs; [
290 coreutils
291 openssl
292 ];
293 script = ''
294 exit 1 # Manual migration required from facts to vars
295 openssl genrsa -out "$out"/ubikmedia.eu.dkim.priv 1024
296 openssl rsa -in "$out"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/ubikmedia.eu.dkim.pub
297 '';
298 };
299 clan.core.vars.generators."apanowicz.de-dkim" = {
300 files."apanowicz.de.dkim.priv" = { };
301 files."apanowicz.de.dkim.pub".secret = false;
302 runtimeInputs = with pkgs; [
303 coreutils
304 openssl
305 ];
306 script = ''
307 exit 1 # Manual migration required from facts to vars
308 openssl genrsa -out "$out"/apanowicz.de.dkim.priv 1024
309 openssl rsa -in "$out"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/apanowicz.de.dkim.pub
310 '';
311 };
312 clan.core.vars.generators."beesmooth.ch-dkim" = {
313 files."beesmooth.ch.dkim.priv" = { };
314 files."beesmooth.ch.dkim.pub".secret = false;
315 runtimeInputs = with pkgs; [
316 coreutils
317 openssl
318 ];
319 script = ''
320 exit 1 # Manual migration required from facts to vars
321 openssl genrsa -out "$out"/beesmooth.ch.dkim.priv 1024
322 openssl rsa -in "$out"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/beesmooth.ch.dkim.pub
323 '';
324 };
325 clan.core.vars.generators."freemonkey.art" = {
326 files."freemonkey.art.dkim.priv" = { };
327 files."freemonkey.art.dkim.pub".secret = false;
328 runtimeInputs = with pkgs; [
329 coreutils
330 openssl
331 ];
332 script = ''
333 exit 1 # Manual migration required from facts to vars
334 openssl genrsa -out "$out"/freemonkey.art.dkim.priv 1024
335 openssl rsa -in "$out"/freemonkey.art.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/freemonkey.art.dkim.pub
336 '';
337 };
338 services.borgbackup.jobs.hetzner.paths = [
339 "/home/xanf"
340 "/home/domsen"
341 "/home/bruno"
342 "/home/jla-trading"
343 "/home/jms"
344 "/home/ms"
345 "/home/bui"
346 "/home/klabusterbeere"
347 "/home/akayguen"
348 "/home/kasia"
349 "/home/dif"
350 "/home/lavafilms"
351 "/home/movematchers"
352 "/home/blackphoton"
353 "/home/avada"
354 "/home/sts"
355 "/home/familienrat"
356 ];
357 users.users.domsen = {
358 uid = genid_uint31 "domsen";
359 description = "maintenance acc for domsen";
360 home = "/home/domsen";
361 useDefaultShell = true;
362 extraGroups = [
363 "syncthing"
364 "download"
365 "xanf"
366 ];
367 createHome = true;
368 isNormalUser = true;
369 };
370
371 users.users.bruno = {
372 uid = genid_uint31 "bruno";
373 home = "/home/bruno";
374 useDefaultShell = true;
375 createHome = true;
376 isNormalUser = true;
377 };
378
379 users.users.jms = {
380 uid = genid_uint31 "jms";
381 home = "/home/jms";
382 useDefaultShell = true;
383 createHome = true;
384 isNormalUser = true;
385 };
386
387 users.users.ms = {
388 uid = genid_uint31 "ms";
389 home = "/home/ms";
390 useDefaultShell = true;
391 createHome = true;
392 isNormalUser = true;
393 };
394
395 users.users.testuser = {
396 uid = genid_uint31 "testuser";
397 home = "/home/testuser";
398 useDefaultShell = true;
399 createHome = true;
400 isNormalUser = true;
401 };
402
403 #users.users.akayguen = {
404 # uid = genid_uint31 "akayguen";
405 # home = "/home/akayguen";
406 # useDefaultShell = true;
407 # createHome = true;
408 # isNormalUser = true;
409 #};
410
411 users.users.klabusterbeere = {
412 uid = genid_uint31 "klabusterbeere";
413 home = "/home/klabusterbeere";
414 useDefaultShell = true;
415 createHome = true;
416 isNormalUser = true;
417 };
418
419 users.users.familienrat = {
420 uid = genid_uint31 "familienrat";
421 home = "/home/familienrat";
422 useDefaultShell = true;
423 createHome = true;
424 isNormalUser = true;
425 };
426
427 users.users.pr = {
428 uid = genid_uint31 "pr";
429 home = "/home/pr";
430 useDefaultShell = true;
431 createHome = true;
432 isNormalUser = true;
433 };
434
435 krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = { };
436 krebs.acl."/srv/http"."u:familienrat:X" = {
437 default = false;
438 recursive = false;
439 };
440
441 krebs.on-failure.plans.restic-backups-domsen = {
442 journalctl = {
443 lines = 1000;
444 };
445 };
446
447 # services.restic.backups.domsen = {
448 # initialize = true;
449 # repository = "/backups/domsen";
450 # passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
451 # timerConfig = {
452 # OnCalendar = "00:05";
453 # RandomizedDelaySec = "5h";
454 # };
455 # paths = [
456 # "/home/domsen/Mail"
457 # "/home/ms/Mail"
458 # "/home/klabusterbeere/Mail"
459 # "/home/jms/Mail"
460 # "/home/kasia/Mail"
461 # "/home/bruno/Mail"
462 # "/home/akayguen/Mail"
463 # "/backups/sql_dumps"
464 # ];
465 # };
466
467 # services.syncthing.settings.folders = {
468 # domsen-backups = {
469 # path = "/backups/domsen";
470 # devices = [ "domsen-backup" ];
471 # };
472 # domsen-backup-srv-http = {
473 # path = "/srv/http";
474 # devices = [ "domsen-backup" ];
475 # };
476 # };
477
478 system.activationScripts.domsen-backups = ''
479 ${pkgs.coreutils}/bin/chmod 750 /backups
480 '';
481
482 # takes too long!!
483 # krebs.acl."/srv/http"."u:syncthing:rwX" = {};
484 # krebs.acl."/srv/http"."u:nginx:rwX" = {};
485 # krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
486}