This repository has no description
12 kB
484 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10
11 inherit (self.inputs.stockholm.lib)
12 genid_uint31
13 ;
14 inherit (import ./util.nix { inherit lib pkgs; })
15 servePage
16 serveWordpress
17 ;
18
19 msmtprc = pkgs.writeText "msmtprc" ''
20 account localhost
21 host localhost
22 account default: localhost
23 '';
24
25 sendmail = pkgs.writeDash "msmtp" ''
26 exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
27 '';
28
29in
30{
31 imports = [
32 self.inputs.stockholm.nixosModules.acl
33 self.inputs.stockholm.nixosModules.on-failure
34 ./default.nix
35 ./sqlBackup.nix
36 (servePage [
37 "aldonasiech.com"
38 "www.aldonasiech.com"
39 ])
40 (servePage [
41 "illustra.de"
42 "www.illustra.de"
43 ])
44 # (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
45 (servePage [ "karlaskop.de" ])
46 (servePage [
47 "freemonkey.art"
48 "www.freemonkey.art"
49 ])
50 (serveWordpress [
51 "ubikmedia.de"
52 "ubikmedia.eu"
53 "youthtube.xyz"
54 "joemisch.com"
55 "weirdwednesday.de"
56 "jarugadesign.de"
57 "beesmooth.ch"
58
59 "www.ubikmedia.eu"
60 "www.youthtube.xyz"
61 "www.ubikmedia.de"
62 "www.joemisch.com"
63 "www.weirdwednesday.de"
64 "www.jarugadesign.de"
65 "www.beesmooth.ch"
66
67 "aldona2.ubikmedia.de"
68 "cinevita.ubikmedia.de"
69 "factscloud.ubikmedia.de"
70 "illucloud.ubikmedia.de"
71 "joemisch.ubikmedia.de"
72 "nb.ubikmedia.de"
73 "youthtube.ubikmedia.de"
74 "weirdwednesday.ubikmedia.de"
75 "freemonkey.ubikmedia.de"
76 "jarugadesign.ubikmedia.de"
77 "crypto4art.ubikmedia.de"
78 "jarugadesign.ubikmedia.de"
79 "beesmooth.ubikmedia.de"
80 ])
81 ];
82
83 # https://github.com/nextcloud/server/issues/25436
84 services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
85
86 services.mysql.ensureDatabases = [
87 "ubikmedia_de"
88 "o_ubikmedia_de"
89 ];
90 services.mysql.ensureUsers = [
91 {
92 ensurePermissions = {
93 "ubikmedia_de.*" = "ALL";
94 };
95 name = "nginx";
96 }
97 {
98 ensurePermissions = {
99 "o_ubikmedia_de.*" = "ALL";
100 };
101 name = "nginx";
102 }
103 ];
104
105 services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
106 try_files $uri $uri/ /index.php?$args;
107 '';
108
109 lass.mysqlBackup.config.all.databases = [
110 "ubikmedia_de"
111 "o_ubikmedia_de"
112 ];
113
114 services.phpfpm.phpOptions = ''
115 sendmail_path = ${sendmail} -t
116 upload_max_filesize = 100M
117 post_max_size = 100M
118 file_uploads = on
119 '';
120
121 clanCore.facts.services.nextcloud = {
122 secret."nextcloud_pw" = { };
123 generator.script = ''
124 cat > "$secrets"/nexcloud_pw;
125 '';
126 generator.prompt = ''
127 enter initial admin password for nextcloud
128 '';
129 };
130 # systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ];
131 # krebs.secret.files.nextcloud_pw = {
132 # path = "/run/nextcloud.pw";
133 # owner.name = "nextcloud";
134 # group-name = "nextcloud";
135 # source-path = "${config.krebs.secret.directory}/nextcloud_pw";
136 # };
137 services.nextcloud = {
138 enable = true;
139 hostName = "o.xanf.org";
140 package = pkgs.nextcloud31;
141 settings.overwriteProtocol = "https";
142 config.dbtype = "sqlite";
143 config.adminpassFile = "/run/nextcloud.pw";
144 https = true;
145 };
146 services.nginx.virtualHosts."o.xanf.org" = {
147 enableACME = true;
148 forceSSL = true;
149 };
150 services.nginx.virtualHosts."weirdweekender.de" = {
151 serverAliases = [ "www.weirdweekender.de" ];
152 enableACME = true;
153 forceSSL = true;
154 locations."/".extraConfig = ''
155 return 301 https://wonderl.ink/@weird0711;
156 '';
157 };
158 services.nginx.virtualHosts."shop.weirdwednesday.de" = {
159 enableACME = true;
160 addSSL = true;
161 locations."/".extraConfig = ''
162 return 301 https://weirdwednesday0711.etsy.com;
163 '';
164 };
165
166 # MAIL STUFF
167 # TODO: make into its own module
168
169 services.roundcube = {
170 enable = true;
171 hostName = "mail.lassul.us";
172 extraConfig = ''
173 $config['smtp_debug'] = true;
174 $config['smtp_host'] = "localhost:25";
175 '';
176 };
177 services.dovecot2 = {
178 enable = true;
179 showPAMFailure = true;
180 mailLocation = "maildir:~/Mail";
181 sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
182 sslServerKey = "/var/lib/acme/lassul.us/key.pem";
183 };
184
185 environment.systemPackages = [
186 (pkgs.writers.writeDashBin "debug_exim" ''
187 set -ef
188 export PATH="${lib.makeBinPath [ pkgs.coreutils ]}"
189 echo "$@" >> /tmp/xxx
190 /run/wrappers/bin/shadow_verify_arg "${config.lass.usershadow.pattern}" "$2" "$3" 2>>/tmp/xxx1
191 echo "ok" >> /tmp/yyy
192 exit 23
193 '')
194 ];
195
196 krebs.exim-smarthost = {
197 authenticators.PLAIN = ''
198 driver = plaintext
199 public_name = PLAIN
200 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
201 '';
202 authenticators.LOGIN = ''
203 driver = plaintext
204 public_name = LOGIN
205 server_prompts = "Username:: : Password::"
206 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
207 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
208 '';
209 internet-aliases = [
210 {
211 from = "dma@ubikmedia.de";
212 to = "domsen";
213 }
214 {
215 from = "dma@ubikmedia.eu";
216 to = "domsen";
217 }
218 {
219 from = "mail@habsys.de";
220 to = "domsen";
221 }
222 {
223 from = "mail@habsys.eu";
224 to = "domsen";
225 }
226 {
227 from = "hallo@apanowicz.de";
228 to = "domsen";
229 }
230 {
231 from = "bruno@apanowicz.de";
232 to = "bruno";
233 }
234 {
235 from = "mail@jla-trading.com";
236 to = "jla-trading";
237 }
238 {
239 from = "jms@ubikmedia.eu";
240 to = "jms";
241 }
242 {
243 from = "ms@ubikmedia.eu";
244 to = "ms";
245 }
246 {
247 from = "ubik@ubikmedia.eu";
248 to = "domsen, jms, ms";
249 }
250 {
251 from = "kontakt@alewis.de";
252 to = "klabusterbeere";
253 }
254 {
255 from = "hallo@jarugadesign.de";
256 to = "kasia";
257 }
258 {
259 from = "noreply@beeshmooth.ch";
260 to = "besmooth@gmx.ch";
261 }
262
263 {
264 from = "testuser@lassul.us";
265 to = "testuser";
266 }
267 {
268 from = "testuser@ubikmedia.eu";
269 to = "testuser";
270 }
271 ];
272 sender_domains = [
273 "jla-trading.com"
274 "ubikmedia.eu"
275 "ubikmedia.de"
276 "apanowicz.de"
277 "alewis.de"
278 "jarugadesign.de"
279 "beesmooth.ch"
280 "event-extra.de"
281 ];
282 dkim = [
283 { domain = "ubikmedia.eu"; }
284 { domain = "apanowicz.de"; }
285 { domain = "beesmooth.ch"; }
286 ];
287 };
288 clanCore.facts.services."ubikmedia.eu-dkim" = {
289 secret."ubikmedia.eu.dkim.priv" = { };
290 public."ubikmedia.eu.dkim.pub" = { };
291 generator.path = with pkgs; [
292 coreutils
293 openssl
294 ];
295 generator.script = ''
296 openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 1024
297 openssl rsa -in "$secrets"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/ubikmedia.eu.dkim.pub
298 '';
299 };
300 clanCore.facts.services."apanowicz.de-dkim" = {
301 secret."apanowicz.de.dkim.priv" = { };
302 public."apanowicz.de.dkim.pub" = { };
303 generator.path = with pkgs; [
304 coreutils
305 openssl
306 ];
307 generator.script = ''
308 openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 1024
309 openssl rsa -in "$secrets"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/apanowicz.de.dkim.pub
310 '';
311 };
312 clanCore.facts.services."beesmooth.ch-dkim" = {
313 secret."beesmooth.ch.dkim.priv" = { };
314 public."beesmooth.ch.dkim.pub" = { };
315 generator.path = with pkgs; [
316 coreutils
317 openssl
318 ];
319 generator.script = ''
320 openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024
321 openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
322 '';
323 };
324 clanCore.facts.services."freemonkey.art" = {
325 secret."freemonkey.art.dkim.priv" = { };
326 public."freemonkey.art.dkim.pub" = { };
327 generator.path = with pkgs; [
328 coreutils
329 openssl
330 ];
331 generator.script = ''
332 openssl genrsa -out "$secrets"/freemonkey.art.dkim.priv 1024
333 openssl rsa -in "$secrets"/freemonkey.art.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/freemonkey.art.dkim.pub
334 '';
335 };
336 services.borgbackup.jobs.hetzner.paths = [
337 "/home/xanf"
338 "/home/domsen"
339 "/home/bruno"
340 "/home/jla-trading"
341 "/home/jms"
342 "/home/ms"
343 "/home/bui"
344 "/home/klabusterbeere"
345 "/home/akayguen"
346 "/home/kasia"
347 "/home/dif"
348 "/home/lavafilms"
349 "/home/movematchers"
350 "/home/blackphoton"
351 "/home/avada"
352 "/home/sts"
353 "/home/familienrat"
354 ];
355 users.users.domsen = {
356 uid = genid_uint31 "domsen";
357 description = "maintenance acc for domsen";
358 home = "/home/domsen";
359 useDefaultShell = true;
360 extraGroups = [
361 "syncthing"
362 "download"
363 "xanf"
364 ];
365 createHome = true;
366 isNormalUser = true;
367 };
368
369 users.users.bruno = {
370 uid = genid_uint31 "bruno";
371 home = "/home/bruno";
372 useDefaultShell = true;
373 createHome = true;
374 isNormalUser = true;
375 };
376
377 users.users.jms = {
378 uid = genid_uint31 "jms";
379 home = "/home/jms";
380 useDefaultShell = true;
381 createHome = true;
382 isNormalUser = true;
383 };
384
385 users.users.ms = {
386 uid = genid_uint31 "ms";
387 home = "/home/ms";
388 useDefaultShell = true;
389 createHome = true;
390 isNormalUser = true;
391 };
392
393 users.users.testuser = {
394 uid = genid_uint31 "testuser";
395 home = "/home/testuser";
396 useDefaultShell = true;
397 createHome = true;
398 isNormalUser = true;
399 };
400
401 #users.users.akayguen = {
402 # uid = genid_uint31 "akayguen";
403 # home = "/home/akayguen";
404 # useDefaultShell = true;
405 # createHome = true;
406 # isNormalUser = true;
407 #};
408
409 users.users.klabusterbeere = {
410 uid = genid_uint31 "klabusterbeere";
411 home = "/home/klabusterbeere";
412 useDefaultShell = true;
413 createHome = true;
414 isNormalUser = true;
415 };
416
417 users.users.familienrat = {
418 uid = genid_uint31 "familienrat";
419 home = "/home/familienrat";
420 useDefaultShell = true;
421 createHome = true;
422 isNormalUser = true;
423 };
424
425 users.users.pr = {
426 uid = genid_uint31 "pr";
427 home = "/home/pr";
428 useDefaultShell = true;
429 createHome = true;
430 isNormalUser = true;
431 };
432
433 krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = { };
434 krebs.acl."/srv/http"."u:familienrat:X" = {
435 default = false;
436 recursive = false;
437 };
438
439 krebs.on-failure.plans.restic-backups-domsen = {
440 journalctl = {
441 lines = 1000;
442 };
443 };
444
445 # services.restic.backups.domsen = {
446 # initialize = true;
447 # repository = "/backups/domsen";
448 # passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
449 # timerConfig = {
450 # OnCalendar = "00:05";
451 # RandomizedDelaySec = "5h";
452 # };
453 # paths = [
454 # "/home/domsen/Mail"
455 # "/home/ms/Mail"
456 # "/home/klabusterbeere/Mail"
457 # "/home/jms/Mail"
458 # "/home/kasia/Mail"
459 # "/home/bruno/Mail"
460 # "/home/akayguen/Mail"
461 # "/backups/sql_dumps"
462 # ];
463 # };
464
465 # services.syncthing.settings.folders = {
466 # domsen-backups = {
467 # path = "/backups/domsen";
468 # devices = [ "domsen-backup" ];
469 # };
470 # domsen-backup-srv-http = {
471 # path = "/srv/http";
472 # devices = [ "domsen-backup" ];
473 # };
474 # };
475
476 system.activationScripts.domsen-backups = ''
477 ${pkgs.coreutils}/bin/chmod 750 /backups
478 '';
479
480 # takes too long!!
481 # krebs.acl."/srv/http"."u:syncthing:rwX" = {};
482 # krebs.acl."/srv/http"."u:nginx:rwX" = {};
483 # krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
484}