This repository has no description
12 kB
505 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10
11 inherit (self.inputs.stockholm.lib)
12 genid_uint31
13 ;
14 inherit (import ./util.nix { inherit lib pkgs; })
15 servePage
16 serveWordpress
17 ;
18
19 msmtprc = pkgs.writeText "msmtprc" ''
20 account localhost
21 host localhost
22 account default: localhost
23 '';
24
25 sendmail = pkgs.writeDash "msmtp" ''
26 exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
27 '';
28
29in
30{
31 imports = [
32 self.inputs.stockholm.nixosModules.acl
33 self.inputs.stockholm.nixosModules.on-failure
34 ./default.nix
35 ./sqlBackup.nix
36 (servePage [
37 "aldonasiech.com"
38 "www.aldonasiech.com"
39 ])
40 (servePage [
41 "apanowicz.de"
42 "www.apanowicz.de"
43 ])
44 (servePage [
45 "reich-gebaeudereinigung.de"
46 "www.reich-gebaeudereinigung.de"
47 ])
48 (servePage [
49 "illustra.de"
50 "www.illustra.de"
51 ])
52 # (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
53 (servePage [
54 "familienrat-hamburg.de"
55 "www.familienrat-hamburg.de"
56 ])
57 (servePage [ "karlaskop.de" ])
58 (servePage [
59 "freemonkey.art"
60 "www.freemonkey.art"
61 ])
62 (serveWordpress [
63 "ubikmedia.de"
64 "ubikmedia.eu"
65 "youthtube.xyz"
66 "joemisch.com"
67 "weirdwednesday.de"
68 "jarugadesign.de"
69 "beesmooth.ch"
70
71 "www.ubikmedia.eu"
72 "www.youthtube.xyz"
73 "www.ubikmedia.de"
74 "www.joemisch.com"
75 "www.weirdwednesday.de"
76 "www.jarugadesign.de"
77 "www.beesmooth.ch"
78
79 "aldona2.ubikmedia.de"
80 "cinevita.ubikmedia.de"
81 "factscloud.ubikmedia.de"
82 "illucloud.ubikmedia.de"
83 "joemisch.ubikmedia.de"
84 "nb.ubikmedia.de"
85 "youthtube.ubikmedia.de"
86 "weirdwednesday.ubikmedia.de"
87 "freemonkey.ubikmedia.de"
88 "jarugadesign.ubikmedia.de"
89 "crypto4art.ubikmedia.de"
90 "jarugadesign.ubikmedia.de"
91 "beesmooth.ubikmedia.de"
92 ])
93 ];
94
95 # https://github.com/nextcloud/server/issues/25436
96 services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
97
98 services.mysql.ensureDatabases = [
99 "ubikmedia_de"
100 "o_ubikmedia_de"
101 ];
102 services.mysql.ensureUsers = [
103 {
104 ensurePermissions = {
105 "ubikmedia_de.*" = "ALL";
106 };
107 name = "nginx";
108 }
109 {
110 ensurePermissions = {
111 "o_ubikmedia_de.*" = "ALL";
112 };
113 name = "nginx";
114 }
115 ];
116
117 services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
118 try_files $uri $uri/ /index.php?$args;
119 '';
120
121 lass.mysqlBackup.config.all.databases = [
122 "ubikmedia_de"
123 "o_ubikmedia_de"
124 ];
125
126 services.phpfpm.phpOptions = ''
127 sendmail_path = ${sendmail} -t
128 upload_max_filesize = 100M
129 post_max_size = 100M
130 file_uploads = on
131 '';
132
133 clanCore.facts.services.nextcloud = {
134 secret."nextcloud_pw" = { };
135 generator.script = ''
136 cat > "$secrets"/nexcloud_pw;
137 '';
138 generator.prompt = ''
139 enter initial admin password for nextcloud
140 '';
141 };
142 systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ];
143 krebs.secret.files.nextcloud_pw = {
144 path = "/run/nextcloud.pw";
145 owner.name = "nextcloud";
146 group-name = "nextcloud";
147 source-path = "${config.krebs.secret.directory}/nextcloud_pw";
148 };
149 services.nextcloud = {
150 enable = true;
151 hostName = "o.xanf.org";
152 package = pkgs.nextcloud28;
153 settings.overwriteProtocol = "https";
154 config.adminpassFile = "/run/nextcloud.pw";
155 https = true;
156 };
157 services.nginx.virtualHosts."o.xanf.org" = {
158 enableACME = true;
159 forceSSL = true;
160 };
161 services.nginx.virtualHosts."weirdweekender.de" = {
162 serverAliases = [ "www.weirdweekender.de" ];
163 enableACME = true;
164 forceSSL = true;
165 locations."/".extraConfig = ''
166 return 301 https://weirdwednesday.de/weirdweekender/;
167 '';
168 };
169 services.nginx.virtualHosts."shop.weirdwednesday.de" = {
170 enableACME = true;
171 addSSL = true;
172 locations."/".extraConfig = ''
173 return 301 https://weirdwednesday0711.etsy.com;
174 '';
175 };
176
177 # MAIL STUFF
178 # TODO: make into its own module
179
180 services.roundcube = {
181 enable = true;
182 hostName = "mail.lassul.us";
183 extraConfig = ''
184 $config['smtp_debug'] = true;
185 $config['smtp_host'] = "localhost:25";
186 '';
187 };
188 services.dovecot2 = {
189 enable = true;
190 showPAMFailure = true;
191 mailLocation = "maildir:~/Mail";
192 sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
193 sslServerKey = "/var/lib/acme/lassul.us/key.pem";
194 };
195 krebs.iptables.tables.filter.INPUT.rules = [
196 {
197 predicate = "-p tcp --dport pop3s";
198 target = "ACCEPT";
199 }
200 {
201 predicate = "-p tcp --dport imaps";
202 target = "ACCEPT";
203 }
204 ];
205
206 environment.systemPackages = [
207 (pkgs.writers.writeDashBin "debug_exim" ''
208 set -ef
209 export PATH="${lib.makeBinPath [ pkgs.coreutils ]}"
210 echo "$@" >> /tmp/xxx
211 /run/wrappers/bin/shadow_verify_arg "${config.lass.usershadow.pattern}" "$2" "$3" 2>>/tmp/xxx1
212 echo "ok" >> /tmp/yyy
213 exit 23
214 '')
215 ];
216
217 krebs.exim-smarthost = {
218 authenticators.PLAIN = ''
219 driver = plaintext
220 public_name = PLAIN
221 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
222 '';
223 authenticators.LOGIN = ''
224 driver = plaintext
225 public_name = LOGIN
226 server_prompts = "Username:: : Password::"
227 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
228 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
229 '';
230 internet-aliases = [
231 {
232 from = "dma@ubikmedia.de";
233 to = "domsen";
234 }
235 {
236 from = "dma@ubikmedia.eu";
237 to = "domsen";
238 }
239 {
240 from = "mail@habsys.de";
241 to = "domsen";
242 }
243 {
244 from = "mail@habsys.eu";
245 to = "domsen";
246 }
247 {
248 from = "hallo@apanowicz.de";
249 to = "domsen";
250 }
251 {
252 from = "bruno@apanowicz.de";
253 to = "bruno";
254 }
255 {
256 from = "mail@jla-trading.com";
257 to = "jla-trading";
258 }
259 {
260 from = "jms@ubikmedia.eu";
261 to = "jms";
262 }
263 {
264 from = "ms@ubikmedia.eu";
265 to = "ms";
266 }
267 {
268 from = "ubik@ubikmedia.eu";
269 to = "domsen, jms, ms";
270 }
271 {
272 from = "kontakt@alewis.de";
273 to = "klabusterbeere";
274 }
275 {
276 from = "hallo@jarugadesign.de";
277 to = "kasia";
278 }
279 {
280 from = "noreply@beeshmooth.ch";
281 to = "besmooth@gmx.ch";
282 }
283
284 {
285 from = "testuser@lassul.us";
286 to = "testuser";
287 }
288 {
289 from = "testuser@ubikmedia.eu";
290 to = "testuser";
291 }
292 ];
293 sender_domains = [
294 "jla-trading.com"
295 "ubikmedia.eu"
296 "ubikmedia.de"
297 "apanowicz.de"
298 "alewis.de"
299 "jarugadesign.de"
300 "beesmooth.ch"
301 "event-extra.de"
302 ];
303 dkim = [
304 { domain = "ubikmedia.eu"; }
305 { domain = "apanowicz.de"; }
306 { domain = "beesmooth.ch"; }
307 ];
308 };
309 clanCore.facts.services."ubikmedia.eu-dkim" = {
310 secret."ubikmedia.eu.dkim.priv" = { };
311 public."ubikmedia.eu.dkim.pub" = { };
312 generator.path = with pkgs; [
313 coreutils
314 openssl
315 ];
316 generator.script = ''
317 openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 1024
318 openssl rsa -in "$secrets"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/ubikmedia.eu.dkim.pub
319 '';
320 };
321 clanCore.facts.services."apanowicz.de-dkim" = {
322 secret."apanowicz.de.dkim.priv" = { };
323 public."apanowicz.de.dkim.pub" = { };
324 generator.path = with pkgs; [
325 coreutils
326 openssl
327 ];
328 generator.script = ''
329 openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 1024
330 openssl rsa -in "$secrets"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/apanowicz.de.dkim.pub
331 '';
332 };
333 clanCore.facts.services."beesmooth.ch-dkim" = {
334 secret."beesmooth.ch.dkim.priv" = { };
335 public."beesmooth.ch.dkim.pub" = { };
336 generator.path = with pkgs; [
337 coreutils
338 openssl
339 ];
340 generator.script = ''
341 openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024
342 openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
343 '';
344 };
345 clanCore.facts.services."freemonkey.art" = {
346 secret."beesmooth.ch.dkim.priv" = { };
347 public."beesmooth.ch.dkim.pub" = { };
348 generator.path = with pkgs; [
349 coreutils
350 openssl
351 ];
352 generator.script = ''
353 openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024
354 openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
355 '';
356 };
357 services.borgbackup.jobs.hetzner.paths = [
358 "/home/xanf"
359 "/home/domsen"
360 "/home/bruno"
361 "/home/jla-trading"
362 "/home/jms"
363 "/home/ms"
364 "/home/bui"
365 "/home/klabusterbeere"
366 "/home/akayguen"
367 "/home/kasia"
368 "/home/dif"
369 "/home/lavafilms"
370 "/home/movematchers"
371 "/home/blackphoton"
372 "/home/avada"
373 "/home/sts"
374 "/home/familienrat"
375 ];
376 users.users.domsen = {
377 uid = genid_uint31 "domsen";
378 description = "maintenance acc for domsen";
379 home = "/home/domsen";
380 useDefaultShell = true;
381 extraGroups = [
382 "syncthing"
383 "download"
384 "xanf"
385 ];
386 createHome = true;
387 isNormalUser = true;
388 };
389
390 users.users.bruno = {
391 uid = genid_uint31 "bruno";
392 home = "/home/bruno";
393 useDefaultShell = true;
394 createHome = true;
395 isNormalUser = true;
396 };
397
398 users.users.jms = {
399 uid = genid_uint31 "jms";
400 home = "/home/jms";
401 useDefaultShell = true;
402 createHome = true;
403 isNormalUser = true;
404 };
405
406 users.users.ms = {
407 uid = genid_uint31 "ms";
408 home = "/home/ms";
409 useDefaultShell = true;
410 createHome = true;
411 isNormalUser = true;
412 };
413
414 users.users.testuser = {
415 uid = genid_uint31 "testuser";
416 home = "/home/testuser";
417 useDefaultShell = true;
418 createHome = true;
419 isNormalUser = true;
420 };
421
422 #users.users.akayguen = {
423 # uid = genid_uint31 "akayguen";
424 # home = "/home/akayguen";
425 # useDefaultShell = true;
426 # createHome = true;
427 # isNormalUser = true;
428 #};
429
430 users.users.klabusterbeere = {
431 uid = genid_uint31 "klabusterbeere";
432 home = "/home/klabusterbeere";
433 useDefaultShell = true;
434 createHome = true;
435 isNormalUser = true;
436 };
437
438 users.users.familienrat = {
439 uid = genid_uint31 "familienrat";
440 home = "/home/familienrat";
441 useDefaultShell = true;
442 createHome = true;
443 isNormalUser = true;
444 };
445
446 users.users.pr = {
447 uid = genid_uint31 "pr";
448 home = "/home/pr";
449 useDefaultShell = true;
450 createHome = true;
451 isNormalUser = true;
452 };
453
454 krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = { };
455 krebs.acl."/srv/http"."u:familienrat:X" = {
456 default = false;
457 recursive = false;
458 };
459
460 krebs.on-failure.plans.restic-backups-domsen = {
461 journalctl = {
462 lines = 1000;
463 };
464 };
465
466 services.restic.backups.domsen = {
467 initialize = true;
468 repository = "/backups/domsen";
469 passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
470 timerConfig = {
471 OnCalendar = "00:05";
472 RandomizedDelaySec = "5h";
473 };
474 paths = [
475 "/home/domsen/Mail"
476 "/home/ms/Mail"
477 "/home/klabusterbeere/Mail"
478 "/home/jms/Mail"
479 "/home/kasia/Mail"
480 "/home/bruno/Mail"
481 "/home/akayguen/Mail"
482 "/backups/sql_dumps"
483 ];
484 };
485
486 # services.syncthing.settings.folders = {
487 # domsen-backups = {
488 # path = "/backups/domsen";
489 # devices = [ "domsen-backup" ];
490 # };
491 # domsen-backup-srv-http = {
492 # path = "/srv/http";
493 # devices = [ "domsen-backup" ];
494 # };
495 # };
496
497 system.activationScripts.domsen-backups = ''
498 ${pkgs.coreutils}/bin/chmod 750 /backups
499 '';
500
501 # takes too long!!
502 # krebs.acl."/srv/http"."u:syncthing:rwX" = {};
503 # krebs.acl."/srv/http"."u:nginx:rwX" = {};
504 # krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
505}