This repository has no description
8.2 kB
366 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9
10 to = lib.concatStringsSep "," [
11 "lass@green.r"
12 ];
13
14 mails = [
15 "postmaster@lassul.us"
16 "lassulus@lassul.us"
17 "test@lassul.us"
18 "outlook@lassul.us"
19 "steuer@aidsballs.de"
20 "lass@aidsballs.de"
21 "finanzamt@lassul.us"
22 "netzclub@lassul.us"
23 "nebenan@lassul.us"
24 "feed@lassul.us"
25 "art@lassul.us"
26 "irgendwas@lassul.us"
27 "polo@lassul.us"
28 "shack@lassul.us"
29 "nix@lassul.us"
30 "c-base@lassul.us"
31 "paypal@lassul.us"
32 "patreon@lassul.us"
33 "steam@lassul.us"
34 "securityfocus@lassul.us"
35 "radio@lassul.us"
36 "btce@lassul.us"
37 "raf@lassul.us"
38 "apple@lassul.us"
39 "coinbase@lassul.us"
40 "tomtop@lassul.us"
41 "aliexpress@lassul.us"
42 "business@lassul.us"
43 "payeer@lassul.us"
44 "github@lassul.us"
45 "bitwala@lassul.us"
46 "bitstamp@lassul.us"
47 "bitcoin.de@lassul.us"
48 "ableton@lassul.us"
49 "dhl@lassul.us"
50 "sipgate@lassul.us"
51 "coinexchange@lassul.us"
52 "verwaltung@lassul.us"
53 "gearbest@lassul.us"
54 "binance@lassul.us"
55 "bitfinex@lassul.us"
56 "alternate@lassul.us"
57 "redacted@lassul.us"
58 "mytaxi@lassul.us"
59 "pizza@lassul.us"
60 "robinhood@lassul.us"
61 "drivenow@lassul.us"
62 "aws@lassul.us"
63 "reddit@lassul.us"
64 "banggood@lassul.us"
65 "immoscout@lassul.us"
66 "gmail@lassul.us"
67 "amazon@lassul.us"
68 "humblebundle@lassul.us"
69 "meetup@lassul.us"
70 "gebfrei@lassul.us"
71 "github@lassul.us"
72 "ovh@lassul.us"
73 "hetzner@lassul.us"
74 "allygator@lassul.us"
75 "immoscout@lassul.us"
76 "elitedangerous@lassul.us"
77 "boardgamegeek@lassul.us"
78 "qwertee@lassul.us"
79 "zazzle@lassul.us"
80 "hackbeach@lassul.us"
81 "transferwise@lassul.us"
82 "cis@lassul.us"
83 "afra@lassul.us"
84 "ksp@lassul.us"
85 "ccc@lassul.us"
86 "neocron@lassul.us"
87 "osmocom@lassul.us"
88 "lesswrong@lassul.us"
89 "nordvpn@lassul.us"
90 "csv-direct@lassul.us"
91 "nintendo@lassul.us"
92 "overleaf@lassul.us"
93 "box@lassul.us"
94 "paloalto@lassul.us"
95 "subtitles@lassul.us"
96 "lobsters@lassul.us"
97 "fysitech@lassul.us"
98 "threema@lassul.us"
99 "ubisoft@lassul.us"
100 "kottezeller@lassul.us"
101 "pie@lassul.us"
102 "vebit@lassul.us"
103 "vcvrack@lassul.us"
104 "epic@lassul.us"
105 "microsoft@lassul.us"
106 "stickers@lassul.us"
107 "nextbike@lassul.us"
108 "mytello@lassul.us"
109 "camp@lassul.us"
110 "urlwatch@lassul.us"
111 "lidl@lassul.us"
112 "geizhals@lassul.us"
113 "auschein@lassul.us"
114 "tleech@lassul.us"
115 "durstexpress@lassul.us"
116 "acme@lassul.us"
117 "antstore@lassul.us"
118 "openweather@lassul.us"
119 "lobsters@lassul.us"
120 "rewe@lassul.us"
121 "spotify@lassul.us"
122 "mojang@lassul.us"
123 # "telekom@lassul.us"
124 "doctolib@lassul.us"
125 "dragonbox@lassul.us"
126 "scalable@lassul.us"
127 "remarkable@lassul.us"
128 "lenovo@lassul.us"
129 "lapstars@lassul.us"
130 "simplywall@lassul.us"
131 "vytal@lassul.us"
132 "haftpflicht@lassul.us"
133 "dji@lassul.us"
134 "sparkasse@lassul.us"
135 "ikea@lassul.us"
136 "blizzard@lassul.us"
137 "azure@lassul.us"
138 "engadin@lassul.us"
139 "jameda@lassul.us"
140 "flaschenpost@lassul.us"
141 "irc@lassul.us"
142 "dlive*@lassul.us"
143 "bunq@lassul.us"
144 "telegram@lassul.us"
145 "ryanair@lassul.us"
146 "phone@lassul.us"
147 "bitmex@lassul.us"
148 "matrix@lassul.us"
149 "itch@lassul.us"
150 "revolut@lassul.us"
151 "coronatest@lassul.us"
152 "dcso@lassul.us"
153 "easyjet@lassul.us"
154 "flipper@lassul.us"
155 "figma@lassul.us"
156 "psiram@lassul.us"
157 "wahl@lassul.us"
158 "instagram@lassul.us"
159 "poinbit@lassul.us"
160 "vvs@lassul.us"
161 "juicy@lassul.us"
162 "auth0@lassul.us"
163 "opodo@lassul.us"
164 "mytrip@lassul.us"
165 "kraken@lassul.us"
166 "swisspass@lassul.us"
167 "heise@lassul.us"
168 "dplf@lassul.us"
169 "rc3@lassul.us"
170 "booking@lassul.us"
171 "mozilla@lassul.us"
172 "bolt@lassul.us"
173 "wolt@lassul.us"
174 "independesk@lassul.us"
175 "oracle@lassul.us"
176 "dev@lassul.us"
177 "nebula@lassul.us"
178 "golem@lassul.us"
179 "planet@lassul.us"
180 "zerotier@lassul.us"
181 "coqui@lassul.us"
182 "numtide@lassul.us"
183 "linkedin@lassul.us"
184 "kaggle@lassul.us"
185 "lastfm@lassul.us"
186 "obi@lassul.us"
187 "aok@lassul.us"
188 "sevdesk@lassul.us"
189 "penta@lassul.us"
190 "solarisbank@lassul.us"
191 "tinder@lassul.us"
192 "vodafone@lassul.us"
193 "42keebs@lassul.us"
194 "pcb@lassul.us"
195 "splitkb@lassul.us"
196 "brackethq@lassul.us"
197 "fosdem@lassul.us"
198 "nreal@lassul.us"
199 "packaging@lassul.us"
200 "ebay@lassul.us"
201 "fusion@lassul.us"
202 "uber@lassul.us"
203 "consulting@lassul.us"
204 "steuer@lassul.us"
205 "versicherung@lassul.us"
206 "satellite@lassul.us"
207 "doodle@lassul.us"
208 "epost@lassul.us"
209 "gog@lassul.us"
210 "post@lassul.us"
211 "buhl@lassul.us"
212 "xxx@lassul.us"
213 "chess@lassul.us"
214 "thainix@lassul.us"
215 "volders@lassul.us"
216 "namecheap@lassul.us"
217 "clanlol@lassul.us"
218 "harvest@lassul.us"
219 "bauhaus@lassul.us"
220 "bahn@lassul.us"
221 "framework@lassul.us"
222 "bsdex@lassul.us"
223 "expressvpn@lassul.us"
224 "airvpn@lassul.us"
225 "prog@lassul.us"
226 "eventphone@lassul.us"
227 "startgg@lassul.us"
228 "ferdium@lassul.us"
229 "start@lassul.us"
230 "pad@lassul.us"
231 "ups@lassul.us"
232 "zalando@lassul.us"
233 "trip@lassul.us"
234 "git@lassul.us"
235 "archive@lassul.us"
236 "bybit@lassul.us"
237 "okcupid@lassul.us"
238 "ing@lassul.us"
239 "hornbach@lassul.us"
240 "huk@lassul.us"
241 "kleinanzeigen@lassul.us"
242 "nzbgeek@lassul.us"
243 "bonify@lassul.us"
244 "bitpanda@lassul.us"
245 "schufa@lassul.us"
246 "burger@lassul.us"
247 ];
248
249in
250{
251 imports = [
252 self.inputs.stockholm.nixosModules.exim-smarthost
253 ];
254
255 clan.core.vars.generators."lassul.us-dkim" = {
256 files."lassul.us.dkim.priv" = { };
257 files."lassul.us.dkim.pub".secret = false;
258 migrateFact = "lassul.us-dkim";
259 runtimeInputs = with pkgs; [
260 coreutils
261 openssl
262 ];
263 script = ''
264 openssl genrsa -out "$out"/lassul.us.dkim.priv 2048
265 openssl rsa -in "$out"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/lassul.us.dkim.pub
266 '';
267 };
268
269 krebs.exim-smarthost = {
270 enable = true;
271 dkim = [
272 {
273 domain = "lassul.us";
274 private_key = config.clan.core.vars.generators."lassul.us-dkim".files."lassul.us.dkim.priv".path;
275 }
276 ];
277 ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
278 ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
279 primary_hostname = "lassul.us";
280 sender_domains = [
281 "lassul.us"
282 ];
283 relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
284 config.krebs.hosts.aergia
285 config.krebs.hosts.ignavia
286 config.krebs.hosts.coaxmetal
287 config.krebs.hosts.green
288 config.krebs.hosts.mors
289 ];
290 internet-aliases = map (from: { inherit from to; }) mails ++ [
291 ];
292 system-aliases = [
293 {
294 from = "mailer-daemon";
295 to = "postmaster";
296 }
297 {
298 from = "postmaster";
299 to = "root";
300 }
301 {
302 from = "nobody";
303 to = "root";
304 }
305 {
306 from = "hostmaster";
307 to = "root";
308 }
309 {
310 from = "usenet";
311 to = "root";
312 }
313 {
314 from = "news";
315 to = "root";
316 }
317 {
318 from = "webmaster";
319 to = "root";
320 }
321 {
322 from = "www";
323 to = "root";
324 }
325 {
326 from = "ftp";
327 to = "root";
328 }
329 {
330 from = "abuse";
331 to = "root";
332 }
333 {
334 from = "noc";
335 to = "root";
336 }
337 {
338 from = "security";
339 to = "root";
340 }
341 {
342 from = "root";
343 to = "lass";
344 }
345 ];
346 };
347 # msmtp for local submission via SSH (connects to localhost:25)
348 environment.systemPackages = [ pkgs.msmtp ];
349
350 krebs.iptables.tables.filter.INPUT.rules = [
351 {
352 predicate = "-p tcp --dport smtp";
353 target = "ACCEPT";
354 }
355 ];
356
357 security.acme.certs."mail.lassul.us" = {
358 group = "lasscert";
359 webroot = "/var/lib/acme/acme-challenge";
360 };
361 users.groups.lasscert.members = [
362 "dovecot2"
363 "exim"
364 "nginx"
365 ];
366}