This repository has no description
8.0 kB
362 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9
10 to = lib.concatStringsSep "," [
11 "lass@green.r"
12 ];
13
14 mails = [
15 "postmaster@lassul.us"
16 "lassulus@lassul.us"
17 "test@lassul.us"
18 "outlook@lassul.us"
19 "steuer@aidsballs.de"
20 "lass@aidsballs.de"
21 "finanzamt@lassul.us"
22 "netzclub@lassul.us"
23 "nebenan@lassul.us"
24 "feed@lassul.us"
25 "art@lassul.us"
26 "irgendwas@lassul.us"
27 "polo@lassul.us"
28 "shack@lassul.us"
29 "nix@lassul.us"
30 "c-base@lassul.us"
31 "paypal@lassul.us"
32 "patreon@lassul.us"
33 "steam@lassul.us"
34 "securityfocus@lassul.us"
35 "radio@lassul.us"
36 "btce@lassul.us"
37 "raf@lassul.us"
38 "apple@lassul.us"
39 "coinbase@lassul.us"
40 "tomtop@lassul.us"
41 "aliexpress@lassul.us"
42 "business@lassul.us"
43 "payeer@lassul.us"
44 "github@lassul.us"
45 "bitwala@lassul.us"
46 "bitstamp@lassul.us"
47 "bitcoin.de@lassul.us"
48 "ableton@lassul.us"
49 "dhl@lassul.us"
50 "sipgate@lassul.us"
51 "coinexchange@lassul.us"
52 "verwaltung@lassul.us"
53 "gearbest@lassul.us"
54 "binance@lassul.us"
55 "bitfinex@lassul.us"
56 "alternate@lassul.us"
57 "redacted@lassul.us"
58 "mytaxi@lassul.us"
59 "pizza@lassul.us"
60 "robinhood@lassul.us"
61 "drivenow@lassul.us"
62 "aws@lassul.us"
63 "reddit@lassul.us"
64 "banggood@lassul.us"
65 "immoscout@lassul.us"
66 "gmail@lassul.us"
67 "amazon@lassul.us"
68 "humblebundle@lassul.us"
69 "meetup@lassul.us"
70 "gebfrei@lassul.us"
71 "github@lassul.us"
72 "ovh@lassul.us"
73 "hetzner@lassul.us"
74 "allygator@lassul.us"
75 "immoscout@lassul.us"
76 "elitedangerous@lassul.us"
77 "boardgamegeek@lassul.us"
78 "qwertee@lassul.us"
79 "zazzle@lassul.us"
80 "hackbeach@lassul.us"
81 "transferwise@lassul.us"
82 "cis@lassul.us"
83 "afra@lassul.us"
84 "ksp@lassul.us"
85 "ccc@lassul.us"
86 "neocron@lassul.us"
87 "osmocom@lassul.us"
88 "lesswrong@lassul.us"
89 "nordvpn@lassul.us"
90 "csv-direct@lassul.us"
91 "nintendo@lassul.us"
92 "overleaf@lassul.us"
93 "box@lassul.us"
94 "paloalto@lassul.us"
95 "subtitles@lassul.us"
96 "lobsters@lassul.us"
97 "fysitech@lassul.us"
98 "threema@lassul.us"
99 "ubisoft@lassul.us"
100 "kottezeller@lassul.us"
101 "pie@lassul.us"
102 "vebit@lassul.us"
103 "vcvrack@lassul.us"
104 "epic@lassul.us"
105 "microsoft@lassul.us"
106 "stickers@lassul.us"
107 "nextbike@lassul.us"
108 "mytello@lassul.us"
109 "camp@lassul.us"
110 "urlwatch@lassul.us"
111 "lidl@lassul.us"
112 "geizhals@lassul.us"
113 "auschein@lassul.us"
114 "tleech@lassul.us"
115 "durstexpress@lassul.us"
116 "acme@lassul.us"
117 "antstore@lassul.us"
118 "openweather@lassul.us"
119 "lobsters@lassul.us"
120 "rewe@lassul.us"
121 "spotify@lassul.us"
122 "mojang@lassul.us"
123 # "telekom@lassul.us"
124 "doctolib@lassul.us"
125 "dragonbox@lassul.us"
126 "scalable@lassul.us"
127 "remarkable@lassul.us"
128 "lenovo@lassul.us"
129 "lapstars@lassul.us"
130 "simplywall@lassul.us"
131 "vytal@lassul.us"
132 "haftpflicht@lassul.us"
133 "dji@lassul.us"
134 "sparkasse@lassul.us"
135 "ikea@lassul.us"
136 "blizzard@lassul.us"
137 "azure@lassul.us"
138 "engadin@lassul.us"
139 "jameda@lassul.us"
140 "flaschenpost@lassul.us"
141 "irc@lassul.us"
142 "dlive*@lassul.us"
143 "bunq@lassul.us"
144 "telegram@lassul.us"
145 "ryanair@lassul.us"
146 "phone@lassul.us"
147 "bitmex@lassul.us"
148 "matrix@lassul.us"
149 "itch@lassul.us"
150 "revolut@lassul.us"
151 "coronatest@lassul.us"
152 "dcso@lassul.us"
153 "easyjet@lassul.us"
154 "flipper@lassul.us"
155 "figma@lassul.us"
156 "psiram@lassul.us"
157 "wahl@lassul.us"
158 "instagram@lassul.us"
159 "poinbit@lassul.us"
160 "vvs@lassul.us"
161 "juicy@lassul.us"
162 "auth0@lassul.us"
163 "opodo@lassul.us"
164 "mytrip@lassul.us"
165 "kraken@lassul.us"
166 "swisspass@lassul.us"
167 "heise@lassul.us"
168 "dplf@lassul.us"
169 "rc3@lassul.us"
170 "booking@lassul.us"
171 "mozilla@lassul.us"
172 "bolt@lassul.us"
173 "wolt@lassul.us"
174 "independesk@lassul.us"
175 "oracle@lassul.us"
176 "dev@lassul.us"
177 "nebula@lassul.us"
178 "golem@lassul.us"
179 "planet@lassul.us"
180 "zerotier@lassul.us"
181 "coqui@lassul.us"
182 "numtide@lassul.us"
183 "linkedin@lassul.us"
184 "kaggle@lassul.us"
185 "lastfm@lassul.us"
186 "obi@lassul.us"
187 "aok@lassul.us"
188 "sevdesk@lassul.us"
189 "penta@lassul.us"
190 "solarisbank@lassul.us"
191 "tinder@lassul.us"
192 "vodafone@lassul.us"
193 "42keebs@lassul.us"
194 "pcb@lassul.us"
195 "splitkb@lassul.us"
196 "brackethq@lassul.us"
197 "fosdem@lassul.us"
198 "nreal@lassul.us"
199 "packaging@lassul.us"
200 "ebay@lassul.us"
201 "fusion@lassul.us"
202 "uber@lassul.us"
203 "consulting@lassul.us"
204 "steuer@lassul.us"
205 "versicherung@lassul.us"
206 "satellite@lassul.us"
207 "doodle@lassul.us"
208 "epost@lassul.us"
209 "gog@lassul.us"
210 "post@lassul.us"
211 "buhl@lassul.us"
212 "xxx@lassul.us"
213 "chess@lassul.us"
214 "thainix@lassul.us"
215 "volders@lassul.us"
216 "namecheap@lassul.us"
217 "clanlol@lassul.us"
218 "harvest@lassul.us"
219 "bauhaus@lassul.us"
220 "bahn@lassul.us"
221 "framework@lassul.us"
222 "bsdex@lassul.us"
223 "expressvpn@lassul.us"
224 "airvpn@lassul.us"
225 "prog@lassul.us"
226 "eventphone@lassul.us"
227 "startgg@lassul.us"
228 "ferdium@lassul.us"
229 "start@lassul.us"
230 "pad@lassul.us"
231 "ups@lassul.us"
232 "zalando@lassul.us"
233 "trip@lassul.us"
234 "git@lassul.us"
235 "archive@lassul.us"
236 "bybit@lassul.us"
237 "okcupid@lassul.us"
238 "ing@lassul.us"
239 "hornbach@lassul.us"
240 "huk@lassul.us"
241 "kleinanzeigen@lassul.us"
242 "nzbgeek@lassul.us"
243 "bonify@lassul.us"
244 "bitpanda@lassul.us"
245 "schufa@lassul.us"
246 ];
247
248in
249{
250 imports = [
251 self.inputs.stockholm.nixosModules.exim-smarthost
252 ];
253
254 clan.core.vars.generators."lassul.us-dkim" = {
255 files."lassul.us.dkim.priv" = { };
256 files."lassul.us.dkim.pub".secret = false;
257 migrateFact = "lassul.us-dkim";
258 runtimeInputs = with pkgs; [
259 coreutils
260 openssl
261 ];
262 script = ''
263 openssl genrsa -out "$out"/lassul.us.dkim.priv 2048
264 openssl rsa -in "$out"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/lassul.us.dkim.pub
265 '';
266 };
267
268 krebs.exim-smarthost = {
269 enable = true;
270 dkim = [
271 {
272 domain = "lassul.us";
273 private_key = config.clan.core.vars.generators."lassul.us-dkim".files."lassul.us.dkim.priv".path;
274 }
275 ];
276 ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
277 ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
278 primary_hostname = "lassul.us";
279 sender_domains = [
280 "lassul.us"
281 ];
282 relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
283 config.krebs.hosts.aergia
284 config.krebs.hosts.ignavia
285 config.krebs.hosts.coaxmetal
286 config.krebs.hosts.green
287 config.krebs.hosts.mors
288 ];
289 internet-aliases = map (from: { inherit from to; }) mails ++ [
290 ];
291 system-aliases = [
292 {
293 from = "mailer-daemon";
294 to = "postmaster";
295 }
296 {
297 from = "postmaster";
298 to = "root";
299 }
300 {
301 from = "nobody";
302 to = "root";
303 }
304 {
305 from = "hostmaster";
306 to = "root";
307 }
308 {
309 from = "usenet";
310 to = "root";
311 }
312 {
313 from = "news";
314 to = "root";
315 }
316 {
317 from = "webmaster";
318 to = "root";
319 }
320 {
321 from = "www";
322 to = "root";
323 }
324 {
325 from = "ftp";
326 to = "root";
327 }
328 {
329 from = "abuse";
330 to = "root";
331 }
332 {
333 from = "noc";
334 to = "root";
335 }
336 {
337 from = "security";
338 to = "root";
339 }
340 {
341 from = "root";
342 to = "lass";
343 }
344 ];
345 };
346 krebs.iptables.tables.filter.INPUT.rules = [
347 {
348 predicate = "-p tcp --dport smtp";
349 target = "ACCEPT";
350 }
351 ];
352
353 security.acme.certs."mail.lassul.us" = {
354 group = "lasscert";
355 webroot = "/var/lib/acme/acme-challenge";
356 };
357 users.groups.lasscert.members = [
358 "dovecot2"
359 "exim"
360 "nginx"
361 ];
362}