This repository has no description
12 kB
494 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10
11 inherit (self.inputs.stockholm.lib)
12 genid_uint31
13 ;
14 inherit (import ./util.nix { inherit lib pkgs; })
15 servePage
16 serveWordpress
17 ;
18
19 msmtprc = pkgs.writeText "msmtprc" ''
20 account localhost
21 host localhost
22 account default: localhost
23 '';
24
25 sendmail = pkgs.writeDash "msmtp" ''
26 exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
27 '';
28
29in
30{
31 imports = [
32 self.inputs.stockholm.nixosModules.acl
33 self.inputs.stockholm.nixosModules.on-failure
34 ./default.nix
35 ./sqlBackup.nix
36 (servePage [
37 "aldonasiech.com"
38 "www.aldonasiech.com"
39 ])
40 (servePage [
41 "illustra.de"
42 "www.illustra.de"
43 ])
44 # (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
45 (servePage [ "karlaskop.de" ])
46 (servePage [
47 "freemonkey.art"
48 "www.freemonkey.art"
49 ])
50 (serveWordpress [
51 "ubikmedia.de"
52 "ubikmedia.eu"
53 "youthtube.xyz"
54 "joemisch.com"
55 "weirdwednesday.de"
56 "jarugadesign.de"
57 "beesmooth.ch"
58
59 "www.ubikmedia.eu"
60 "www.youthtube.xyz"
61 "www.ubikmedia.de"
62 "www.joemisch.com"
63 "www.weirdwednesday.de"
64 "www.jarugadesign.de"
65 "www.beesmooth.ch"
66
67 "aldona2.ubikmedia.de"
68 "cinevita.ubikmedia.de"
69 "factscloud.ubikmedia.de"
70 "illucloud.ubikmedia.de"
71 "joemisch.ubikmedia.de"
72 "nb.ubikmedia.de"
73 "youthtube.ubikmedia.de"
74 "weirdwednesday.ubikmedia.de"
75 "freemonkey.ubikmedia.de"
76 "jarugadesign.ubikmedia.de"
77 "crypto4art.ubikmedia.de"
78 "jarugadesign.ubikmedia.de"
79 "beesmooth.ubikmedia.de"
80 ])
81 ];
82
83 # https://github.com/nextcloud/server/issues/25436
84 services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
85
86 services.mysql.ensureDatabases = [
87 "ubikmedia_de"
88 "o_ubikmedia_de"
89 ];
90 services.mysql.ensureUsers = [
91 {
92 ensurePermissions = {
93 "ubikmedia_de.*" = "ALL";
94 };
95 name = "nginx";
96 }
97 {
98 ensurePermissions = {
99 "o_ubikmedia_de.*" = "ALL";
100 };
101 name = "nginx";
102 }
103 ];
104
105 services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
106 try_files $uri $uri/ /index.php?$args;
107 '';
108
109 lass.mysqlBackup.config.all.databases = [
110 "ubikmedia_de"
111 "o_ubikmedia_de"
112 ];
113
114 services.phpfpm.phpOptions = ''
115 sendmail_path = ${sendmail} -t
116 upload_max_filesize = 100M
117 post_max_size = 100M
118 file_uploads = on
119 '';
120
121 clanCore.facts.services.nextcloud = {
122 secret."nextcloud_pw" = { };
123 generator.script = ''
124 cat > "$secrets"/nexcloud_pw;
125 '';
126 generator.prompt = ''
127 enter initial admin password for nextcloud
128 '';
129 };
130 # systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ];
131 # krebs.secret.files.nextcloud_pw = {
132 # path = "/run/nextcloud.pw";
133 # owner.name = "nextcloud";
134 # group-name = "nextcloud";
135 # source-path = "${config.krebs.secret.directory}/nextcloud_pw";
136 # };
137 services.nextcloud = {
138 enable = true;
139 hostName = "o.xanf.org";
140 package = pkgs.nextcloud30;
141 settings.overwriteProtocol = "https";
142 config.dbtype = "sqlite";
143 config.adminpassFile = "/run/nextcloud.pw";
144 https = true;
145 };
146 services.nginx.virtualHosts."o.xanf.org" = {
147 enableACME = true;
148 forceSSL = true;
149 };
150 services.nginx.virtualHosts."weirdweekender.de" = {
151 serverAliases = [ "www.weirdweekender.de" ];
152 enableACME = true;
153 forceSSL = true;
154 locations."/".extraConfig = ''
155 return 301 https://wonderl.ink/@weird0711;
156 '';
157 };
158 services.nginx.virtualHosts."shop.weirdwednesday.de" = {
159 enableACME = true;
160 addSSL = true;
161 locations."/".extraConfig = ''
162 return 301 https://weirdwednesday0711.etsy.com;
163 '';
164 };
165
166 # MAIL STUFF
167 # TODO: make into its own module
168
169 services.roundcube = {
170 enable = true;
171 hostName = "mail.lassul.us";
172 extraConfig = ''
173 $config['smtp_debug'] = true;
174 $config['smtp_host'] = "localhost:25";
175 '';
176 };
177 services.dovecot2 = {
178 enable = true;
179 showPAMFailure = true;
180 mailLocation = "maildir:~/Mail";
181 sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
182 sslServerKey = "/var/lib/acme/lassul.us/key.pem";
183 };
184 krebs.iptables.tables.filter.INPUT.rules = [
185 {
186 predicate = "-p tcp --dport pop3s";
187 target = "ACCEPT";
188 }
189 {
190 predicate = "-p tcp --dport imaps";
191 target = "ACCEPT";
192 }
193 ];
194
195 environment.systemPackages = [
196 (pkgs.writers.writeDashBin "debug_exim" ''
197 set -ef
198 export PATH="${lib.makeBinPath [ pkgs.coreutils ]}"
199 echo "$@" >> /tmp/xxx
200 /run/wrappers/bin/shadow_verify_arg "${config.lass.usershadow.pattern}" "$2" "$3" 2>>/tmp/xxx1
201 echo "ok" >> /tmp/yyy
202 exit 23
203 '')
204 ];
205
206 krebs.exim-smarthost = {
207 authenticators.PLAIN = ''
208 driver = plaintext
209 public_name = PLAIN
210 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
211 '';
212 authenticators.LOGIN = ''
213 driver = plaintext
214 public_name = LOGIN
215 server_prompts = "Username:: : Password::"
216 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
217 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
218 '';
219 internet-aliases = [
220 {
221 from = "dma@ubikmedia.de";
222 to = "domsen";
223 }
224 {
225 from = "dma@ubikmedia.eu";
226 to = "domsen";
227 }
228 {
229 from = "mail@habsys.de";
230 to = "domsen";
231 }
232 {
233 from = "mail@habsys.eu";
234 to = "domsen";
235 }
236 {
237 from = "hallo@apanowicz.de";
238 to = "domsen";
239 }
240 {
241 from = "bruno@apanowicz.de";
242 to = "bruno";
243 }
244 {
245 from = "mail@jla-trading.com";
246 to = "jla-trading";
247 }
248 {
249 from = "jms@ubikmedia.eu";
250 to = "jms";
251 }
252 {
253 from = "ms@ubikmedia.eu";
254 to = "ms";
255 }
256 {
257 from = "ubik@ubikmedia.eu";
258 to = "domsen, jms, ms";
259 }
260 {
261 from = "kontakt@alewis.de";
262 to = "klabusterbeere";
263 }
264 {
265 from = "hallo@jarugadesign.de";
266 to = "kasia";
267 }
268 {
269 from = "noreply@beeshmooth.ch";
270 to = "besmooth@gmx.ch";
271 }
272
273 {
274 from = "testuser@lassul.us";
275 to = "testuser";
276 }
277 {
278 from = "testuser@ubikmedia.eu";
279 to = "testuser";
280 }
281 ];
282 sender_domains = [
283 "jla-trading.com"
284 "ubikmedia.eu"
285 "ubikmedia.de"
286 "apanowicz.de"
287 "alewis.de"
288 "jarugadesign.de"
289 "beesmooth.ch"
290 "event-extra.de"
291 ];
292 dkim = [
293 { domain = "ubikmedia.eu"; }
294 { domain = "apanowicz.de"; }
295 { domain = "beesmooth.ch"; }
296 ];
297 };
298 clanCore.facts.services."ubikmedia.eu-dkim" = {
299 secret."ubikmedia.eu.dkim.priv" = { };
300 public."ubikmedia.eu.dkim.pub" = { };
301 generator.path = with pkgs; [
302 coreutils
303 openssl
304 ];
305 generator.script = ''
306 openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 1024
307 openssl rsa -in "$secrets"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/ubikmedia.eu.dkim.pub
308 '';
309 };
310 clanCore.facts.services."apanowicz.de-dkim" = {
311 secret."apanowicz.de.dkim.priv" = { };
312 public."apanowicz.de.dkim.pub" = { };
313 generator.path = with pkgs; [
314 coreutils
315 openssl
316 ];
317 generator.script = ''
318 openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 1024
319 openssl rsa -in "$secrets"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/apanowicz.de.dkim.pub
320 '';
321 };
322 clanCore.facts.services."beesmooth.ch-dkim" = {
323 secret."beesmooth.ch.dkim.priv" = { };
324 public."beesmooth.ch.dkim.pub" = { };
325 generator.path = with pkgs; [
326 coreutils
327 openssl
328 ];
329 generator.script = ''
330 openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024
331 openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
332 '';
333 };
334 clanCore.facts.services."freemonkey.art" = {
335 secret."freemonkey.art.dkim.priv" = { };
336 public."freemonkey.art.dkim.pub" = { };
337 generator.path = with pkgs; [
338 coreutils
339 openssl
340 ];
341 generator.script = ''
342 openssl genrsa -out "$secrets"/freemonkey.art.dkim.priv 1024
343 openssl rsa -in "$secrets"/freemonkey.art.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/freemonkey.art.dkim.pub
344 '';
345 };
346 services.borgbackup.jobs.hetzner.paths = [
347 "/home/xanf"
348 "/home/domsen"
349 "/home/bruno"
350 "/home/jla-trading"
351 "/home/jms"
352 "/home/ms"
353 "/home/bui"
354 "/home/klabusterbeere"
355 "/home/akayguen"
356 "/home/kasia"
357 "/home/dif"
358 "/home/lavafilms"
359 "/home/movematchers"
360 "/home/blackphoton"
361 "/home/avada"
362 "/home/sts"
363 "/home/familienrat"
364 ];
365 users.users.domsen = {
366 uid = genid_uint31 "domsen";
367 description = "maintenance acc for domsen";
368 home = "/home/domsen";
369 useDefaultShell = true;
370 extraGroups = [
371 "syncthing"
372 "download"
373 "xanf"
374 ];
375 createHome = true;
376 isNormalUser = true;
377 };
378
379 users.users.bruno = {
380 uid = genid_uint31 "bruno";
381 home = "/home/bruno";
382 useDefaultShell = true;
383 createHome = true;
384 isNormalUser = true;
385 };
386
387 users.users.jms = {
388 uid = genid_uint31 "jms";
389 home = "/home/jms";
390 useDefaultShell = true;
391 createHome = true;
392 isNormalUser = true;
393 };
394
395 users.users.ms = {
396 uid = genid_uint31 "ms";
397 home = "/home/ms";
398 useDefaultShell = true;
399 createHome = true;
400 isNormalUser = true;
401 };
402
403 users.users.testuser = {
404 uid = genid_uint31 "testuser";
405 home = "/home/testuser";
406 useDefaultShell = true;
407 createHome = true;
408 isNormalUser = true;
409 };
410
411 #users.users.akayguen = {
412 # uid = genid_uint31 "akayguen";
413 # home = "/home/akayguen";
414 # useDefaultShell = true;
415 # createHome = true;
416 # isNormalUser = true;
417 #};
418
419 users.users.klabusterbeere = {
420 uid = genid_uint31 "klabusterbeere";
421 home = "/home/klabusterbeere";
422 useDefaultShell = true;
423 createHome = true;
424 isNormalUser = true;
425 };
426
427 users.users.familienrat = {
428 uid = genid_uint31 "familienrat";
429 home = "/home/familienrat";
430 useDefaultShell = true;
431 createHome = true;
432 isNormalUser = true;
433 };
434
435 users.users.pr = {
436 uid = genid_uint31 "pr";
437 home = "/home/pr";
438 useDefaultShell = true;
439 createHome = true;
440 isNormalUser = true;
441 };
442
443 krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = { };
444 krebs.acl."/srv/http"."u:familienrat:X" = {
445 default = false;
446 recursive = false;
447 };
448
449 krebs.on-failure.plans.restic-backups-domsen = {
450 journalctl = {
451 lines = 1000;
452 };
453 };
454
455 # services.restic.backups.domsen = {
456 # initialize = true;
457 # repository = "/backups/domsen";
458 # passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
459 # timerConfig = {
460 # OnCalendar = "00:05";
461 # RandomizedDelaySec = "5h";
462 # };
463 # paths = [
464 # "/home/domsen/Mail"
465 # "/home/ms/Mail"
466 # "/home/klabusterbeere/Mail"
467 # "/home/jms/Mail"
468 # "/home/kasia/Mail"
469 # "/home/bruno/Mail"
470 # "/home/akayguen/Mail"
471 # "/backups/sql_dumps"
472 # ];
473 # };
474
475 # services.syncthing.settings.folders = {
476 # domsen-backups = {
477 # path = "/backups/domsen";
478 # devices = [ "domsen-backup" ];
479 # };
480 # domsen-backup-srv-http = {
481 # path = "/srv/http";
482 # devices = [ "domsen-backup" ];
483 # };
484 # };
485
486 system.activationScripts.domsen-backups = ''
487 ${pkgs.coreutils}/bin/chmod 750 /backups
488 '';
489
490 # takes too long!!
491 # krebs.acl."/srv/http"."u:syncthing:rwX" = {};
492 # krebs.acl."/srv/http"."u:nginx:rwX" = {};
493 # krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
494}