This repository has no description
14 kB
496 lines
1{ self, config, pkgs, lib, ... }:
2
3let
4
5 inherit (self.inputs.stockholm.lib)
6 genid_uint31
7 ;
8 inherit (import ./util.nix {inherit lib pkgs;})
9 servePage
10 serveOwncloud
11 serveWordpress;
12
13 msmtprc = pkgs.writeText "msmtprc" ''
14 account localhost
15 host localhost
16 account default: localhost
17 '';
18
19 sendmail = pkgs.writeDash "msmtp" ''
20 exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
21 '';
22
23in {
24 imports = [
25 self.inputs.stockholm.nixosModules.acl
26 self.inputs.stockholm.nixosModules.on-failure
27 ./default.nix
28 ./sqlBackup.nix
29 (servePage [ "aldonasiech.com" "www.aldonasiech.com" ])
30 (servePage [ "apanowicz.de" "www.apanowicz.de" ])
31 (servePage [ "reich-gebaeudereinigung.de" "www.reich-gebaeudereinigung.de" ])
32 (servePage [ "illustra.de" "www.illustra.de" ])
33 (servePage [ "event-extra.de" "www.event-extra.de" ])
34 # (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
35 (servePage [ "familienrat-hamburg.de" "www.familienrat-hamburg.de" ])
36 (servePage [ "karlaskop.de" ])
37 (servePage [
38 "freemonkey.art"
39 "www.freemonkey.art"
40 ])
41 (serveOwncloud [ "o.ubikmedia.de" ])
42 (serveWordpress [
43 "ubikmedia.de"
44 "ubikmedia.eu"
45 "youthtube.xyz"
46 "joemisch.com"
47 "weirdwednesday.de"
48 "jarugadesign.de"
49 "beesmooth.ch"
50
51 "www.ubikmedia.eu"
52 "www.youthtube.xyz"
53 "www.ubikmedia.de"
54 "www.joemisch.com"
55 "www.weirdwednesday.de"
56 "www.jarugadesign.de"
57 "www.beesmooth.ch"
58
59 "aldona2.ubikmedia.de"
60 "cinevita.ubikmedia.de"
61 "factscloud.ubikmedia.de"
62 "illucloud.ubikmedia.de"
63 "joemisch.ubikmedia.de"
64 "nb.ubikmedia.de"
65 "youthtube.ubikmedia.de"
66 "weirdwednesday.ubikmedia.de"
67 "freemonkey.ubikmedia.de"
68 "jarugadesign.ubikmedia.de"
69 "crypto4art.ubikmedia.de"
70 "jarugadesign.ubikmedia.de"
71 "beesmooth.ubikmedia.de"
72 ])
73 ];
74
75 # https://github.com/nextcloud/server/issues/25436
76 services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
77
78 services.mysql.ensureDatabases = [ "ubikmedia_de" "o_ubikmedia_de" ];
79 services.mysql.ensureUsers = [
80 { ensurePermissions = { "ubikmedia_de.*" = "ALL"; }; name = "nginx"; }
81 { ensurePermissions = { "o_ubikmedia_de.*" = "ALL"; }; name = "nginx"; }
82 ];
83
84 services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
85 try_files $uri $uri/ /index.php?$args;
86 '';
87
88 lass.mysqlBackup.config.all.databases = [
89 "ubikmedia_de"
90 "o_ubikmedia_de"
91 ];
92
93 services.phpfpm.phpOptions = ''
94 sendmail_path = ${sendmail} -t
95 upload_max_filesize = 100M
96 post_max_size = 100M
97 file_uploads = on
98 '';
99
100 clanCore.facts.services.nextcloud = {
101 secret."nextcloud_pw" = { };
102 generator.script = ''
103 cat > "$secrets"/nexcloud_pw;
104 '';
105 generator.prompt = ''
106 enter initial admin password for nextcloud
107 '';
108 };
109 systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ];
110 krebs.secret.files.nextcloud_pw = {
111 path = "/run/nextcloud.pw";
112 owner.name = "nextcloud";
113 group-name = "nextcloud";
114 source-path = "${config.krebs.secret.directory}/nextcloud_pw";
115 };
116 services.nextcloud = {
117 enable = true;
118 hostName = "o.xanf.org";
119 package = pkgs.nextcloud28;
120 settings.overwriteProtocol = "https";
121 config.adminpassFile = "/run/nextcloud.pw";
122 https = true;
123 };
124 services.nginx.virtualHosts."o.xanf.org" = {
125 enableACME = true;
126 forceSSL = true;
127 };
128 services.nginx.virtualHosts."weirdweekender.de" = {
129 serverAliases = [ "www.weirdweekender.de" ];
130 enableACME = true;
131 forceSSL = true;
132 locations."/".extraConfig = ''
133 return 301 https://weirdwednesday.de/weirdweekender/;
134 '';
135 };
136
137 # MAIL STUFF
138 # TODO: make into its own module
139
140 services.roundcube = {
141 enable = true;
142 hostName = "mail.lassul.us";
143 extraConfig = ''
144 $config['smtp_debug'] = true;
145 $config['smtp_host'] = "localhost:25";
146 '';
147 };
148 services.dovecot2 = {
149 enable = true;
150 showPAMFailure = true;
151 mailLocation = "maildir:~/Mail";
152 sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
153 sslServerKey = "/var/lib/acme/lassul.us/key.pem";
154 };
155 krebs.iptables.tables.filter.INPUT.rules = [
156 { predicate = "-p tcp --dport pop3s"; target = "ACCEPT"; }
157 { predicate = "-p tcp --dport imaps"; target = "ACCEPT"; }
158 ];
159
160 environment.systemPackages = [
161 (pkgs.writers.writeDashBin "debug_exim" ''
162 set -ef
163 export PATH="${lib.makeBinPath [ pkgs.coreutils ]}"
164 echo "$@" >> /tmp/xxx
165 /run/wrappers/bin/shadow_verify_arg "${config.lass.usershadow.pattern}" "$2" "$3" 2>>/tmp/xxx1
166 echo "ok" >> /tmp/yyy
167 exit 23
168 '')
169 ];
170
171 krebs.exim-smarthost = {
172 authenticators.PLAIN = ''
173 driver = plaintext
174 public_name = PLAIN
175 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
176 '';
177 authenticators.LOGIN = ''
178 driver = plaintext
179 public_name = LOGIN
180 server_prompts = "Username:: : Password::"
181 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
182 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
183 '';
184 internet-aliases = [
185 { from = "dma@ubikmedia.de"; to = "domsen"; }
186 { from = "dma@ubikmedia.eu"; to = "domsen"; }
187 { from = "mail@habsys.de"; to = "domsen"; }
188 { from = "mail@habsys.eu"; to = "domsen"; }
189 { from = "hallo@apanowicz.de"; to = "domsen"; }
190 { from = "bruno@apanowicz.de"; to = "bruno"; }
191 { from = "mail@jla-trading.com"; to = "jla-trading"; }
192 { from = "jms@ubikmedia.eu"; to = "jms"; }
193 { from = "ms@ubikmedia.eu"; to = "ms"; }
194 { from = "ubik@ubikmedia.eu"; to = "domsen, jms, ms"; }
195 { from = "kontakt@alewis.de"; to ="klabusterbeere"; }
196 { from = "hallo@jarugadesign.de"; to ="kasia"; }
197 { from = "noreply@beeshmooth.ch"; to ="besmooth@gmx.ch"; }
198
199 { from = "testuser@lassul.us"; to = "testuser"; }
200 { from = "testuser@ubikmedia.eu"; to = "testuser"; }
201 ];
202 sender_domains = [
203 "jla-trading.com"
204 "ubikmedia.eu"
205 "ubikmedia.de"
206 "apanowicz.de"
207 "alewis.de"
208 "jarugadesign.de"
209 "beesmooth.ch"
210 "event-extra.de"
211 ];
212 dkim = [
213 { domain = "ubikmedia.eu"; }
214 { domain = "apanowicz.de"; }
215 { domain = "beesmooth.ch"; }
216 ];
217 };
218 clanCore.facts.services."ubikmedia.eu-dkim" = {
219 secret."ubikmedia.eu.dkim.priv" = { };
220 public."ubikmedia.eu.dkim.pub" = { };
221 generator.path = with pkgs; [ coreutils openssl ];
222 generator.script = ''
223 openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 2048
224 openssl rsa -in "$secrets"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/ubikmedia.eu.dkim.pub
225 '';
226 };
227 clanCore.facts.services."apanowicz.de-dkim" = {
228 secret."apanowicz.de.dkim.priv" = { };
229 public."apanowicz.de.dkim.pub" = { };
230 generator.path = with pkgs; [ coreutils openssl ];
231 generator.script = ''
232 openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 2048
233 openssl rsa -in "$secrets"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/apanowicz.de.dkim.pub
234 '';
235 };
236 clanCore.facts.services."beesmooth.ch-dkim" = {
237 secret."beesmooth.ch.dkim.priv" = { };
238 public."beesmooth.ch.dkim.pub" = { };
239 generator.path = with pkgs; [ coreutils openssl ];
240 generator.script = ''
241 openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 2048
242 openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
243 '';
244 };
245 services.borgbackup.jobs.hetzner.paths = [
246 "/home/xanf"
247 "/home/domsen"
248 "/home/bruno"
249 "/home/jla-trading"
250 "/home/jms"
251 "/home/ms"
252 "/home/bui"
253 "/home/klabusterbeere"
254 "/home/akayguen"
255 "/home/kasia"
256 "/home/dif"
257 "/home/lavafilms"
258 "/home/movematchers"
259 "/home/blackphoton"
260 "/home/avada"
261 "/home/sts"
262 "/home/familienrat"
263 ];
264 users.users.UBIK-SFTP = {
265 uid = genid_uint31 "UBIK-SFTP";
266 home = "/home/UBIK-SFTP";
267 useDefaultShell = true;
268 createHome = true;
269 isNormalUser = true;
270 };
271
272 users.users.xanf = {
273 uid = genid_uint31 "xanf";
274 group = "xanf";
275 home = "/home/xanf";
276 useDefaultShell = true;
277 createHome = false; # creathome forces permissions
278 isNormalUser = true;
279 };
280
281 users.users.domsen = {
282 uid = genid_uint31 "domsen";
283 description = "maintenance acc for domsen";
284 home = "/home/domsen";
285 useDefaultShell = true;
286 extraGroups = [ "syncthing" "download" "xanf" ];
287 createHome = true;
288 isNormalUser = true;
289 };
290
291 users.users.bruno = {
292 uid = genid_uint31 "bruno";
293 home = "/home/bruno";
294 useDefaultShell = true;
295 createHome = true;
296 isNormalUser = true;
297 };
298
299 users.users.jla-trading = {
300 uid = genid_uint31 "jla-trading";
301 home = "/home/jla-trading";
302 useDefaultShell = true;
303 createHome = true;
304 isNormalUser = true;
305 };
306
307 users.users.jms = {
308 uid = genid_uint31 "jms";
309 home = "/home/jms";
310 useDefaultShell = true;
311 createHome = true;
312 isNormalUser = true;
313 };
314
315 users.users.ms = {
316 uid = genid_uint31 "ms";
317 home = "/home/ms";
318 useDefaultShell = true;
319 createHome = true;
320 isNormalUser = true;
321 };
322
323 users.users.testuser = {
324 uid = genid_uint31 "testuser";
325 home = "/home/testuser";
326 useDefaultShell = true;
327 createHome = true;
328 isNormalUser = true;
329 };
330
331 #users.users.akayguen = {
332 # uid = genid_uint31 "akayguen";
333 # home = "/home/akayguen";
334 # useDefaultShell = true;
335 # createHome = true;
336 # isNormalUser = true;
337 #};
338
339 users.users.bui = {
340 uid = genid_uint31 "bui";
341 home = "/home/bui";
342 useDefaultShell = true;
343 createHome = true;
344 isNormalUser = true;
345 };
346
347 users.users.klabusterbeere = {
348 uid = genid_uint31 "klabusterbeere";
349 home = "/home/klabusterbeere";
350 useDefaultShell = true;
351 createHome = true;
352 isNormalUser = true;
353 };
354
355 users.users.kasia = {
356 uid = genid_uint31 "kasia";
357 home = "/home/kasia";
358 useDefaultShell = true;
359 createHome = true;
360 isNormalUser = true;
361 };
362
363 users.users.XANF_TEAM = {
364 uid = genid_uint31 "XANF_TEAM";
365 group = "xanf";
366 home = "/home/XANF_TEAM";
367 useDefaultShell = true;
368 createHome = true;
369 isNormalUser = true;
370 };
371
372 users.users.dif = {
373 uid = genid_uint31 "dif";
374 home = "/home/dif";
375 useDefaultShell = true;
376 extraGroups = [ "xanf" ];
377 createHome = true;
378 isNormalUser = true;
379 };
380
381 users.users.lavafilms = {
382 uid = genid_uint31 "lavafilms";
383 home = "/home/lavafilms";
384 useDefaultShell = true;
385 extraGroups = [ "xanf" ];
386 createHome = true;
387 isNormalUser = true;
388 };
389
390 users.users.movematchers = {
391 uid = genid_uint31 "movematchers";
392 home = "/home/movematchers";
393 useDefaultShell = true;
394 extraGroups = [ "xanf" ];
395 createHome = true;
396 isNormalUser = true;
397 };
398
399 users.users.blackphoton = {
400 uid = genid_uint31 "blackphoton";
401 home = "/home/blackphoton";
402 useDefaultShell = true;
403 extraGroups = [ "xanf" ];
404 createHome = true;
405 isNormalUser = true;
406 };
407
408 users.users.line = {
409 uid = genid_uint31 "line";
410 home = "/home/line";
411 useDefaultShell = true;
412 # extraGroups = [ "xanf" ];
413 createHome = true;
414 isNormalUser = true;
415 };
416
417 users.users.avada = {
418 uid = genid_uint31 "avada";
419 home = "/home/avada";
420 useDefaultShell = true;
421 createHome = true;
422 isNormalUser = true;
423 };
424
425 users.users.sts = {
426 uid = genid_uint31 "sts";
427 home = "/home/sts";
428 useDefaultShell = true;
429 createHome = true;
430 isNormalUser = true;
431 };
432
433 users.users.familienrat = {
434 uid = genid_uint31 "familienrat";
435 home = "/home/familienrat";
436 useDefaultShell = true;
437 createHome = true;
438 isNormalUser = true;
439 };
440 krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = {};
441 krebs.acl."/srv/http"."u:familienrat:X" = {
442 default = false;
443 recursive = false;
444 };
445
446 users.groups.xanf = {};
447
448 krebs.on-failure.plans.restic-backups-domsen = {
449 journalctl = {
450 lines = 1000;
451 };
452 };
453
454 services.restic.backups.domsen = {
455 initialize = true;
456 repository = "/backups/domsen";
457 passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
458 timerConfig = { OnCalendar = "00:05"; RandomizedDelaySec = "5h"; };
459 paths = [
460 "/home/domsen/Mail"
461 "/home/ms/Mail"
462 "/home/klabusterbeere/Mail"
463 "/home/jms/Mail"
464 "/home/kasia/Mail"
465 "/home/bruno/Mail"
466 "/home/akayguen/Mail"
467 "/backups/sql_dumps"
468 ];
469 };
470
471 services.syncthing.settings.folders = {
472 domsen-backups = {
473 path = "/backups/domsen";
474 devices = [ "domsen-backup" ];
475 };
476 domsen-backup-srv-http = {
477 path = "/srv/http";
478 devices = [ "domsen-backup" ];
479 };
480 };
481
482 system.activationScripts.domsen-backups = ''
483 ${pkgs.coreutils}/bin/chmod 750 /backups
484 '';
485
486 # takes too long!!
487 # krebs.acl."/srv/http"."u:syncthing:rwX" = {};
488 # krebs.acl."/srv/http"."u:nginx:rwX" = {};
489 # krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
490 krebs.acl."/home/xanf/XANF_TEAM"."g:xanf:rwX" = {};
491 krebs.acl."/home/xanf"."g:xanf:X" = {
492 default = false;
493 recursive = false;
494 };
495}
496