This repository has no description
15 kB
622 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10
11 inherit (self.inputs.stockholm.lib)
12 genid_uint31
13 ;
14 inherit (import ./util.nix { inherit lib pkgs; })
15 servePage
16 serveOwncloud
17 serveWordpress
18 ;
19
20 msmtprc = pkgs.writeText "msmtprc" ''
21 account localhost
22 host localhost
23 account default: localhost
24 '';
25
26 sendmail = pkgs.writeDash "msmtp" ''
27 exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
28 '';
29
30in
31{
32 imports = [
33 self.inputs.stockholm.nixosModules.acl
34 self.inputs.stockholm.nixosModules.on-failure
35 ./default.nix
36 ./sqlBackup.nix
37 (servePage [
38 "aldonasiech.com"
39 "www.aldonasiech.com"
40 ])
41 (servePage [
42 "apanowicz.de"
43 "www.apanowicz.de"
44 ])
45 (servePage [
46 "reich-gebaeudereinigung.de"
47 "www.reich-gebaeudereinigung.de"
48 ])
49 (servePage [
50 "illustra.de"
51 "www.illustra.de"
52 ])
53 (servePage [
54 "event-extra.de"
55 "www.event-extra.de"
56 ])
57 # (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
58 (servePage [
59 "familienrat-hamburg.de"
60 "www.familienrat-hamburg.de"
61 ])
62 (servePage [ "karlaskop.de" ])
63 (servePage [
64 "freemonkey.art"
65 "www.freemonkey.art"
66 ])
67 (serveOwncloud [ "o.ubikmedia.de" ])
68 (serveWordpress [
69 "ubikmedia.de"
70 "ubikmedia.eu"
71 "youthtube.xyz"
72 "joemisch.com"
73 "weirdwednesday.de"
74 "jarugadesign.de"
75 "beesmooth.ch"
76
77 "www.ubikmedia.eu"
78 "www.youthtube.xyz"
79 "www.ubikmedia.de"
80 "www.joemisch.com"
81 "www.weirdwednesday.de"
82 "www.jarugadesign.de"
83 "www.beesmooth.ch"
84
85 "aldona2.ubikmedia.de"
86 "cinevita.ubikmedia.de"
87 "factscloud.ubikmedia.de"
88 "illucloud.ubikmedia.de"
89 "joemisch.ubikmedia.de"
90 "nb.ubikmedia.de"
91 "youthtube.ubikmedia.de"
92 "weirdwednesday.ubikmedia.de"
93 "freemonkey.ubikmedia.de"
94 "jarugadesign.ubikmedia.de"
95 "crypto4art.ubikmedia.de"
96 "jarugadesign.ubikmedia.de"
97 "beesmooth.ubikmedia.de"
98 ])
99 ];
100
101 # https://github.com/nextcloud/server/issues/25436
102 services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
103
104 services.mysql.ensureDatabases = [
105 "ubikmedia_de"
106 "o_ubikmedia_de"
107 ];
108 services.mysql.ensureUsers = [
109 {
110 ensurePermissions = {
111 "ubikmedia_de.*" = "ALL";
112 };
113 name = "nginx";
114 }
115 {
116 ensurePermissions = {
117 "o_ubikmedia_de.*" = "ALL";
118 };
119 name = "nginx";
120 }
121 ];
122
123 services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
124 try_files $uri $uri/ /index.php?$args;
125 '';
126
127 lass.mysqlBackup.config.all.databases = [
128 "ubikmedia_de"
129 "o_ubikmedia_de"
130 ];
131
132 services.phpfpm.phpOptions = ''
133 sendmail_path = ${sendmail} -t
134 upload_max_filesize = 100M
135 post_max_size = 100M
136 file_uploads = on
137 '';
138
139 clanCore.facts.services.nextcloud = {
140 secret."nextcloud_pw" = { };
141 generator.script = ''
142 cat > "$secrets"/nexcloud_pw;
143 '';
144 generator.prompt = ''
145 enter initial admin password for nextcloud
146 '';
147 };
148 systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ];
149 krebs.secret.files.nextcloud_pw = {
150 path = "/run/nextcloud.pw";
151 owner.name = "nextcloud";
152 group-name = "nextcloud";
153 source-path = "${config.krebs.secret.directory}/nextcloud_pw";
154 };
155 services.nextcloud = {
156 enable = true;
157 hostName = "o.xanf.org";
158 package = pkgs.nextcloud28;
159 settings.overwriteProtocol = "https";
160 config.adminpassFile = "/run/nextcloud.pw";
161 https = true;
162 };
163 services.nginx.virtualHosts."o.xanf.org" = {
164 enableACME = true;
165 forceSSL = true;
166 };
167 services.nginx.virtualHosts."weirdweekender.de" = {
168 serverAliases = [ "www.weirdweekender.de" ];
169 enableACME = true;
170 forceSSL = true;
171 locations."/".extraConfig = ''
172 return 301 https://weirdwednesday.de/weirdweekender/;
173 '';
174 };
175
176 # MAIL STUFF
177 # TODO: make into its own module
178
179 services.roundcube = {
180 enable = true;
181 hostName = "mail.lassul.us";
182 extraConfig = ''
183 $config['smtp_debug'] = true;
184 $config['smtp_host'] = "localhost:25";
185 '';
186 };
187 services.dovecot2 = {
188 enable = true;
189 showPAMFailure = true;
190 mailLocation = "maildir:~/Mail";
191 sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
192 sslServerKey = "/var/lib/acme/lassul.us/key.pem";
193 };
194 krebs.iptables.tables.filter.INPUT.rules = [
195 {
196 predicate = "-p tcp --dport pop3s";
197 target = "ACCEPT";
198 }
199 {
200 predicate = "-p tcp --dport imaps";
201 target = "ACCEPT";
202 }
203 ];
204
205 environment.systemPackages = [
206 (pkgs.writers.writeDashBin "debug_exim" ''
207 set -ef
208 export PATH="${lib.makeBinPath [ pkgs.coreutils ]}"
209 echo "$@" >> /tmp/xxx
210 /run/wrappers/bin/shadow_verify_arg "${config.lass.usershadow.pattern}" "$2" "$3" 2>>/tmp/xxx1
211 echo "ok" >> /tmp/yyy
212 exit 23
213 '')
214 ];
215
216 krebs.exim-smarthost = {
217 authenticators.PLAIN = ''
218 driver = plaintext
219 public_name = PLAIN
220 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
221 '';
222 authenticators.LOGIN = ''
223 driver = plaintext
224 public_name = LOGIN
225 server_prompts = "Username:: : Password::"
226 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
227 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
228 '';
229 internet-aliases = [
230 {
231 from = "dma@ubikmedia.de";
232 to = "domsen";
233 }
234 {
235 from = "dma@ubikmedia.eu";
236 to = "domsen";
237 }
238 {
239 from = "mail@habsys.de";
240 to = "domsen";
241 }
242 {
243 from = "mail@habsys.eu";
244 to = "domsen";
245 }
246 {
247 from = "hallo@apanowicz.de";
248 to = "domsen";
249 }
250 {
251 from = "bruno@apanowicz.de";
252 to = "bruno";
253 }
254 {
255 from = "mail@jla-trading.com";
256 to = "jla-trading";
257 }
258 {
259 from = "jms@ubikmedia.eu";
260 to = "jms";
261 }
262 {
263 from = "ms@ubikmedia.eu";
264 to = "ms";
265 }
266 {
267 from = "ubik@ubikmedia.eu";
268 to = "domsen, jms, ms";
269 }
270 {
271 from = "kontakt@alewis.de";
272 to = "klabusterbeere";
273 }
274 {
275 from = "hallo@jarugadesign.de";
276 to = "kasia";
277 }
278 {
279 from = "noreply@beeshmooth.ch";
280 to = "besmooth@gmx.ch";
281 }
282
283 {
284 from = "testuser@lassul.us";
285 to = "testuser";
286 }
287 {
288 from = "testuser@ubikmedia.eu";
289 to = "testuser";
290 }
291 ];
292 sender_domains = [
293 "jla-trading.com"
294 "ubikmedia.eu"
295 "ubikmedia.de"
296 "apanowicz.de"
297 "alewis.de"
298 "jarugadesign.de"
299 "beesmooth.ch"
300 "event-extra.de"
301 ];
302 dkim = [
303 { domain = "ubikmedia.eu"; }
304 { domain = "apanowicz.de"; }
305 { domain = "beesmooth.ch"; }
306 ];
307 };
308 clanCore.facts.services."ubikmedia.eu-dkim" = {
309 secret."ubikmedia.eu.dkim.priv" = { };
310 public."ubikmedia.eu.dkim.pub" = { };
311 generator.path = with pkgs; [
312 coreutils
313 openssl
314 ];
315 generator.script = ''
316 openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 1024
317 openssl rsa -in "$secrets"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/ubikmedia.eu.dkim.pub
318 '';
319 };
320 clanCore.facts.services."apanowicz.de-dkim" = {
321 secret."apanowicz.de.dkim.priv" = { };
322 public."apanowicz.de.dkim.pub" = { };
323 generator.path = with pkgs; [
324 coreutils
325 openssl
326 ];
327 generator.script = ''
328 openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 1024
329 openssl rsa -in "$secrets"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/apanowicz.de.dkim.pub
330 '';
331 };
332 clanCore.facts.services."beesmooth.ch-dkim" = {
333 secret."beesmooth.ch.dkim.priv" = { };
334 public."beesmooth.ch.dkim.pub" = { };
335 generator.path = with pkgs; [
336 coreutils
337 openssl
338 ];
339 generator.script = ''
340 openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024
341 openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
342 '';
343 };
344 clanCore.facts.services."freemonkey.art" = {
345 secret."beesmooth.ch.dkim.priv" = { };
346 public."beesmooth.ch.dkim.pub" = { };
347 generator.path = with pkgs; [
348 coreutils
349 openssl
350 ];
351 generator.script = ''
352 openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024
353 openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
354 '';
355 };
356 services.borgbackup.jobs.hetzner.paths = [
357 "/home/xanf"
358 "/home/domsen"
359 "/home/bruno"
360 "/home/jla-trading"
361 "/home/jms"
362 "/home/ms"
363 "/home/bui"
364 "/home/klabusterbeere"
365 "/home/akayguen"
366 "/home/kasia"
367 "/home/dif"
368 "/home/lavafilms"
369 "/home/movematchers"
370 "/home/blackphoton"
371 "/home/avada"
372 "/home/sts"
373 "/home/familienrat"
374 ];
375 users.users.UBIK-SFTP = {
376 uid = genid_uint31 "UBIK-SFTP";
377 home = "/home/UBIK-SFTP";
378 useDefaultShell = true;
379 createHome = true;
380 isNormalUser = true;
381 };
382
383 users.users.xanf = {
384 uid = genid_uint31 "xanf";
385 group = "xanf";
386 home = "/home/xanf";
387 useDefaultShell = true;
388 createHome = false; # creathome forces permissions
389 isNormalUser = true;
390 };
391
392 users.users.domsen = {
393 uid = genid_uint31 "domsen";
394 description = "maintenance acc for domsen";
395 home = "/home/domsen";
396 useDefaultShell = true;
397 extraGroups = [
398 "syncthing"
399 "download"
400 "xanf"
401 ];
402 createHome = true;
403 isNormalUser = true;
404 };
405
406 users.users.bruno = {
407 uid = genid_uint31 "bruno";
408 home = "/home/bruno";
409 useDefaultShell = true;
410 createHome = true;
411 isNormalUser = true;
412 };
413
414 users.users.jla-trading = {
415 uid = genid_uint31 "jla-trading";
416 home = "/home/jla-trading";
417 useDefaultShell = true;
418 createHome = true;
419 isNormalUser = true;
420 };
421
422 users.users.jms = {
423 uid = genid_uint31 "jms";
424 home = "/home/jms";
425 useDefaultShell = true;
426 createHome = true;
427 isNormalUser = true;
428 };
429
430 users.users.ms = {
431 uid = genid_uint31 "ms";
432 home = "/home/ms";
433 useDefaultShell = true;
434 createHome = true;
435 isNormalUser = true;
436 };
437
438 users.users.testuser = {
439 uid = genid_uint31 "testuser";
440 home = "/home/testuser";
441 useDefaultShell = true;
442 createHome = true;
443 isNormalUser = true;
444 };
445
446 #users.users.akayguen = {
447 # uid = genid_uint31 "akayguen";
448 # home = "/home/akayguen";
449 # useDefaultShell = true;
450 # createHome = true;
451 # isNormalUser = true;
452 #};
453
454 users.users.bui = {
455 uid = genid_uint31 "bui";
456 home = "/home/bui";
457 useDefaultShell = true;
458 createHome = true;
459 isNormalUser = true;
460 };
461
462 users.users.klabusterbeere = {
463 uid = genid_uint31 "klabusterbeere";
464 home = "/home/klabusterbeere";
465 useDefaultShell = true;
466 createHome = true;
467 isNormalUser = true;
468 };
469
470 users.users.kasia = {
471 uid = genid_uint31 "kasia";
472 home = "/home/kasia";
473 useDefaultShell = true;
474 createHome = true;
475 isNormalUser = true;
476 };
477
478 users.users.XANF_TEAM = {
479 uid = genid_uint31 "XANF_TEAM";
480 group = "xanf";
481 home = "/home/XANF_TEAM";
482 useDefaultShell = true;
483 createHome = true;
484 isNormalUser = true;
485 };
486
487 users.users.dif = {
488 uid = genid_uint31 "dif";
489 home = "/home/dif";
490 useDefaultShell = true;
491 extraGroups = [ "xanf" ];
492 createHome = true;
493 isNormalUser = true;
494 };
495
496 users.users.lavafilms = {
497 uid = genid_uint31 "lavafilms";
498 home = "/home/lavafilms";
499 useDefaultShell = true;
500 extraGroups = [ "xanf" ];
501 createHome = true;
502 isNormalUser = true;
503 };
504
505 users.users.movematchers = {
506 uid = genid_uint31 "movematchers";
507 home = "/home/movematchers";
508 useDefaultShell = true;
509 extraGroups = [ "xanf" ];
510 createHome = true;
511 isNormalUser = true;
512 };
513
514 users.users.blackphoton = {
515 uid = genid_uint31 "blackphoton";
516 home = "/home/blackphoton";
517 useDefaultShell = true;
518 extraGroups = [ "xanf" ];
519 createHome = true;
520 isNormalUser = true;
521 };
522
523 users.users.line = {
524 uid = genid_uint31 "line";
525 home = "/home/line";
526 useDefaultShell = true;
527 # extraGroups = [ "xanf" ];
528 createHome = true;
529 isNormalUser = true;
530 };
531
532 users.users.avada = {
533 uid = genid_uint31 "avada";
534 home = "/home/avada";
535 useDefaultShell = true;
536 createHome = true;
537 isNormalUser = true;
538 };
539
540 users.users.sts = {
541 uid = genid_uint31 "sts";
542 home = "/home/sts";
543 useDefaultShell = true;
544 createHome = true;
545 isNormalUser = true;
546 };
547
548 users.users.familienrat = {
549 uid = genid_uint31 "familienrat";
550 home = "/home/familienrat";
551 useDefaultShell = true;
552 createHome = true;
553 isNormalUser = true;
554 };
555
556 users.users.pr = {
557 uid = genid_uint31 "pr";
558 home = "/home/pr";
559 useDefaultShell = true;
560 createHome = true;
561 isNormalUser = true;
562 };
563
564 krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = { };
565 krebs.acl."/srv/http"."u:familienrat:X" = {
566 default = false;
567 recursive = false;
568 };
569
570 users.groups.xanf = { };
571
572 krebs.on-failure.plans.restic-backups-domsen = {
573 journalctl = {
574 lines = 1000;
575 };
576 };
577
578 services.restic.backups.domsen = {
579 initialize = true;
580 repository = "/backups/domsen";
581 passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
582 timerConfig = {
583 OnCalendar = "00:05";
584 RandomizedDelaySec = "5h";
585 };
586 paths = [
587 "/home/domsen/Mail"
588 "/home/ms/Mail"
589 "/home/klabusterbeere/Mail"
590 "/home/jms/Mail"
591 "/home/kasia/Mail"
592 "/home/bruno/Mail"
593 "/home/akayguen/Mail"
594 "/backups/sql_dumps"
595 ];
596 };
597
598 # services.syncthing.settings.folders = {
599 # domsen-backups = {
600 # path = "/backups/domsen";
601 # devices = [ "domsen-backup" ];
602 # };
603 # domsen-backup-srv-http = {
604 # path = "/srv/http";
605 # devices = [ "domsen-backup" ];
606 # };
607 # };
608
609 system.activationScripts.domsen-backups = ''
610 ${pkgs.coreutils}/bin/chmod 750 /backups
611 '';
612
613 # takes too long!!
614 # krebs.acl."/srv/http"."u:syncthing:rwX" = {};
615 # krebs.acl."/srv/http"."u:nginx:rwX" = {};
616 # krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
617 krebs.acl."/home/xanf/XANF_TEAM"."g:xanf:rwX" = { };
618 krebs.acl."/home/xanf"."g:xanf:X" = {
619 default = false;
620 recursive = false;
621 };
622}