This repository has no description
8.2 kB
367 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9
10 to = lib.concatStringsSep "," [
11 "lass@green.r"
12 ];
13
14 mails = [
15 "postmaster@lassul.us"
16 "lassulus@lassul.us"
17 "test@lassul.us"
18 "outlook@lassul.us"
19 "steuer@aidsballs.de"
20 "lass@aidsballs.de"
21 "finanzamt@lassul.us"
22 "netzclub@lassul.us"
23 "nebenan@lassul.us"
24 "feed@lassul.us"
25 "art@lassul.us"
26 "irgendwas@lassul.us"
27 "polo@lassul.us"
28 "shack@lassul.us"
29 "nix@lassul.us"
30 "c-base@lassul.us"
31 "paypal@lassul.us"
32 "patreon@lassul.us"
33 "steam@lassul.us"
34 "securityfocus@lassul.us"
35 "radio@lassul.us"
36 "btce@lassul.us"
37 "raf@lassul.us"
38 "apple@lassul.us"
39 "coinbase@lassul.us"
40 "tomtop@lassul.us"
41 "aliexpress@lassul.us"
42 "business@lassul.us"
43 "payeer@lassul.us"
44 "github@lassul.us"
45 "bitwala@lassul.us"
46 "bitstamp@lassul.us"
47 "bitcoin.de@lassul.us"
48 "ableton@lassul.us"
49 "dhl@lassul.us"
50 "sipgate@lassul.us"
51 "coinexchange@lassul.us"
52 "verwaltung@lassul.us"
53 "gearbest@lassul.us"
54 "binance@lassul.us"
55 "bitfinex@lassul.us"
56 "alternate@lassul.us"
57 "redacted@lassul.us"
58 "mytaxi@lassul.us"
59 "pizza@lassul.us"
60 "robinhood@lassul.us"
61 "drivenow@lassul.us"
62 "aws@lassul.us"
63 "reddit@lassul.us"
64 "banggood@lassul.us"
65 "immoscout@lassul.us"
66 "gmail@lassul.us"
67 "amazon@lassul.us"
68 "humblebundle@lassul.us"
69 "meetup@lassul.us"
70 "gebfrei@lassul.us"
71 "github@lassul.us"
72 "ovh@lassul.us"
73 "hetzner@lassul.us"
74 "allygator@lassul.us"
75 "immoscout@lassul.us"
76 "elitedangerous@lassul.us"
77 "boardgamegeek@lassul.us"
78 "qwertee@lassul.us"
79 "zazzle@lassul.us"
80 "hackbeach@lassul.us"
81 "transferwise@lassul.us"
82 "cis@lassul.us"
83 "afra@lassul.us"
84 "ksp@lassul.us"
85 "ccc@lassul.us"
86 "neocron@lassul.us"
87 "osmocom@lassul.us"
88 "lesswrong@lassul.us"
89 "nordvpn@lassul.us"
90 "csv-direct@lassul.us"
91 "nintendo@lassul.us"
92 "overleaf@lassul.us"
93 "box@lassul.us"
94 "paloalto@lassul.us"
95 "subtitles@lassul.us"
96 "lobsters@lassul.us"
97 "fysitech@lassul.us"
98 "threema@lassul.us"
99 "ubisoft@lassul.us"
100 "kottezeller@lassul.us"
101 "pie@lassul.us"
102 "vebit@lassul.us"
103 "vcvrack@lassul.us"
104 "epic@lassul.us"
105 "microsoft@lassul.us"
106 "stickers@lassul.us"
107 "nextbike@lassul.us"
108 "mytello@lassul.us"
109 "camp@lassul.us"
110 "urlwatch@lassul.us"
111 "lidl@lassul.us"
112 "geizhals@lassul.us"
113 "auschein@lassul.us"
114 "tleech@lassul.us"
115 "durstexpress@lassul.us"
116 "acme@lassul.us"
117 "antstore@lassul.us"
118 "openweather@lassul.us"
119 "lobsters@lassul.us"
120 "rewe@lassul.us"
121 "spotify@lassul.us"
122 "mojang@lassul.us"
123 # "telekom@lassul.us"
124 "doctolib@lassul.us"
125 "dragonbox@lassul.us"
126 "scalable@lassul.us"
127 "remarkable@lassul.us"
128 "lenovo@lassul.us"
129 "lapstars@lassul.us"
130 "simplywall@lassul.us"
131 "vytal@lassul.us"
132 "haftpflicht@lassul.us"
133 "dji@lassul.us"
134 "sparkasse@lassul.us"
135 "ikea@lassul.us"
136 "blizzard@lassul.us"
137 "azure@lassul.us"
138 "engadin@lassul.us"
139 "jameda@lassul.us"
140 "flaschenpost@lassul.us"
141 "irc@lassul.us"
142 "dlive*@lassul.us"
143 "bunq@lassul.us"
144 "telegram@lassul.us"
145 "ryanair@lassul.us"
146 "phone@lassul.us"
147 "bitmex@lassul.us"
148 "matrix@lassul.us"
149 "itch@lassul.us"
150 "revolut@lassul.us"
151 "coronatest@lassul.us"
152 "dcso@lassul.us"
153 "easyjet@lassul.us"
154 "flipper@lassul.us"
155 "figma@lassul.us"
156 "psiram@lassul.us"
157 "wahl@lassul.us"
158 "instagram@lassul.us"
159 "poinbit@lassul.us"
160 "vvs@lassul.us"
161 "juicy@lassul.us"
162 "auth0@lassul.us"
163 "opodo@lassul.us"
164 "mytrip@lassul.us"
165 "kraken@lassul.us"
166 "swisspass@lassul.us"
167 "heise@lassul.us"
168 "dplf@lassul.us"
169 "rc3@lassul.us"
170 "booking@lassul.us"
171 "mozilla@lassul.us"
172 "bolt@lassul.us"
173 "wolt@lassul.us"
174 "independesk@lassul.us"
175 "oracle@lassul.us"
176 "dev@lassul.us"
177 "nebula@lassul.us"
178 "golem@lassul.us"
179 "planet@lassul.us"
180 "zerotier@lassul.us"
181 "coqui@lassul.us"
182 "numtide@lassul.us"
183 "linkedin@lassul.us"
184 "kaggle@lassul.us"
185 "lastfm@lassul.us"
186 "obi@lassul.us"
187 "aok@lassul.us"
188 "sevdesk@lassul.us"
189 "penta@lassul.us"
190 "solarisbank@lassul.us"
191 "tinder@lassul.us"
192 "vodafone@lassul.us"
193 "42keebs@lassul.us"
194 "pcb@lassul.us"
195 "splitkb@lassul.us"
196 "brackethq@lassul.us"
197 "fosdem@lassul.us"
198 "nreal@lassul.us"
199 "packaging@lassul.us"
200 "ebay@lassul.us"
201 "fusion@lassul.us"
202 "uber@lassul.us"
203 "consulting@lassul.us"
204 "steuer@lassul.us"
205 "versicherung@lassul.us"
206 "satellite@lassul.us"
207 "doodle@lassul.us"
208 "epost@lassul.us"
209 "gog@lassul.us"
210 "post@lassul.us"
211 "buhl@lassul.us"
212 "xxx@lassul.us"
213 "chess@lassul.us"
214 "thainix@lassul.us"
215 "volders@lassul.us"
216 "namecheap@lassul.us"
217 "clanlol@lassul.us"
218 "harvest@lassul.us"
219 "bauhaus@lassul.us"
220 "bahn@lassul.us"
221 "framework@lassul.us"
222 "bsdex@lassul.us"
223 "expressvpn@lassul.us"
224 "airvpn@lassul.us"
225 "prog@lassul.us"
226 "eventphone@lassul.us"
227 "startgg@lassul.us"
228 "ferdium@lassul.us"
229 "start@lassul.us"
230 "pad@lassul.us"
231 "ups@lassul.us"
232 "zalando@lassul.us"
233 "trip@lassul.us"
234 "git@lassul.us"
235 "archive@lassul.us"
236 "bybit@lassul.us"
237 "okcupid@lassul.us"
238 "ing@lassul.us"
239 "hornbach@lassul.us"
240 "huk@lassul.us"
241 "kleinanzeigen@lassul.us"
242 "nzbgeek@lassul.us"
243 "bonify@lassul.us"
244 "bitpanda@lassul.us"
245 "schufa@lassul.us"
246 "burger@lassul.us"
247 "eweka@lassul.us"
248 ];
249
250in
251{
252 imports = [
253 self.inputs.stockholm.nixosModules.exim-smarthost
254 ];
255
256 clan.core.vars.generators."lassul.us-dkim" = {
257 files."lassul.us.dkim.priv" = { };
258 files."lassul.us.dkim.pub".secret = false;
259 migrateFact = "lassul.us-dkim";
260 runtimeInputs = with pkgs; [
261 coreutils
262 openssl
263 ];
264 script = ''
265 openssl genrsa -out "$out"/lassul.us.dkim.priv 2048
266 openssl rsa -in "$out"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/lassul.us.dkim.pub
267 '';
268 };
269
270 krebs.exim-smarthost = {
271 enable = true;
272 dkim = [
273 {
274 domain = "lassul.us";
275 private_key = config.clan.core.vars.generators."lassul.us-dkim".files."lassul.us.dkim.priv".path;
276 }
277 ];
278 ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
279 ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
280 primary_hostname = "lassul.us";
281 sender_domains = [
282 "lassul.us"
283 ];
284 relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
285 config.krebs.hosts.aergia
286 config.krebs.hosts.ignavia
287 config.krebs.hosts.coaxmetal
288 config.krebs.hosts.green
289 config.krebs.hosts.mors
290 ];
291 internet-aliases = map (from: { inherit from to; }) mails ++ [
292 ];
293 system-aliases = [
294 {
295 from = "mailer-daemon";
296 to = "postmaster";
297 }
298 {
299 from = "postmaster";
300 to = "root";
301 }
302 {
303 from = "nobody";
304 to = "root";
305 }
306 {
307 from = "hostmaster";
308 to = "root";
309 }
310 {
311 from = "usenet";
312 to = "root";
313 }
314 {
315 from = "news";
316 to = "root";
317 }
318 {
319 from = "webmaster";
320 to = "root";
321 }
322 {
323 from = "www";
324 to = "root";
325 }
326 {
327 from = "ftp";
328 to = "root";
329 }
330 {
331 from = "abuse";
332 to = "root";
333 }
334 {
335 from = "noc";
336 to = "root";
337 }
338 {
339 from = "security";
340 to = "root";
341 }
342 {
343 from = "root";
344 to = "lass";
345 }
346 ];
347 };
348 # msmtp for local submission via SSH (connects to localhost:25)
349 environment.systemPackages = [ pkgs.msmtp ];
350
351 krebs.iptables.tables.filter.INPUT.rules = [
352 {
353 predicate = "-p tcp --dport smtp";
354 target = "ACCEPT";
355 }
356 ];
357
358 security.acme.certs."mail.lassul.us" = {
359 group = "lasscert";
360 webroot = "/var/lib/acme/acme-challenge";
361 };
362 users.groups.lasscert.members = [
363 "dovecot2"
364 "exim"
365 "nginx"
366 ];
367}