This repository has no description
2.5 kB
131 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9
10 to = lib.concatStringsSep "," [
11 "lass@green.r"
12 ];
13
14 mails = [
15 ];
16
17in
18{
19 imports = [
20 self.inputs.stockholm.nixosModules.exim-smarthost
21 ];
22
23 clanCore.facts.services."lassul.us-dkim" = {
24 secret."lassul.us.dkim.priv" = { };
25 public."lassul.us.dkim.pub" = { };
26 generator.path = with pkgs; [
27 coreutils
28 openssl
29 ];
30 generator.script = ''
31 openssl genrsa -out "$secrets"/lassul.us.dkim.priv 2048
32 openssl rsa -in "$secrets"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/lassul.us.dkim.pub
33 '';
34 };
35
36 krebs.exim-smarthost = {
37 enable = true;
38 dkim = [
39 { domain = "lassul.us"; }
40 ];
41 ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
42 ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
43 primary_hostname = "lassul.us";
44 sender_domains = [
45 "lassul.us"
46 ];
47 relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
48 config.krebs.hosts.aergia
49 config.krebs.hosts.ignavia
50 config.krebs.hosts.blue
51 config.krebs.hosts.coaxmetal
52 config.krebs.hosts.green
53 config.krebs.hosts.mors
54 config.krebs.hosts.xerxes
55 ];
56 internet-aliases =
57 map (from: { inherit from to; }) mails
58 ++ [
59 ];
60 system-aliases = [
61 {
62 from = "mailer-daemon";
63 to = "postmaster";
64 }
65 {
66 from = "postmaster";
67 to = "root";
68 }
69 {
70 from = "nobody";
71 to = "root";
72 }
73 {
74 from = "hostmaster";
75 to = "root";
76 }
77 {
78 from = "usenet";
79 to = "root";
80 }
81 {
82 from = "news";
83 to = "root";
84 }
85 {
86 from = "webmaster";
87 to = "root";
88 }
89 {
90 from = "www";
91 to = "root";
92 }
93 {
94 from = "ftp";
95 to = "root";
96 }
97 {
98 from = "abuse";
99 to = "root";
100 }
101 {
102 from = "noc";
103 to = "root";
104 }
105 {
106 from = "security";
107 to = "root";
108 }
109 {
110 from = "root";
111 to = "lass";
112 }
113 ];
114 };
115 krebs.iptables.tables.filter.INPUT.rules = [
116 {
117 predicate = "-p tcp --dport smtp";
118 target = "ACCEPT";
119 }
120 ];
121
122 security.acme.certs."mail.lassul.us" = {
123 group = "lasscert";
124 webroot = "/var/lib/acme/acme-challenge";
125 };
126 users.groups.lasscert.members = [
127 "dovecot2"
128 "exim"
129 "nginx"
130 ];
131}