This repository has no description
8.2 kB
336 lines
1{
2 self,
3 config,
4 pkgs,
5 ...
6}:
7{
8 imports = [
9 ../../2configs
10 ../../2configs/retiolum.nix
11 ../../2configs/autoupdate.nix
12
13 self.inputs.stockholm.nixosModules.exim-smarthost
14 ];
15
16 krebs.build.host = config.krebs.hosts.ubik;
17 clan.password-store.targetDirectory = "/var/state/secrets";
18 clan.vars.password-store.secretLocation = "/var/state/secret-vars";
19
20 krebs.sync-containers3.inContainer = {
21 enable = true;
22 pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBFGMjH0+Dco6DVFZbByENMci8CFTLXCL7j53yctPnM";
23 };
24
25 security.acme = {
26 acceptTerms = true;
27 defaults.email = "acme@lassul.us";
28 };
29 networking.firewall.allowedTCPPorts = [
30 80
31 443
32 ];
33
34 # nextcloud
35 services.nginx.virtualHosts."c.apanowicz.de" = {
36 enableACME = true;
37 forceSSL = true;
38 };
39 services.nextcloud = {
40 enable = true;
41 hostName = "c.apanowicz.de";
42 package = pkgs.nextcloud29;
43 config.dbtype = "sqlite";
44 config.adminpassFile = "/run/nextcloud.pw";
45 https = true;
46 maxUploadSize = "9001M";
47 };
48 clanCore.facts.services.nextcloud-pw = {
49 secret."nextcloud.pw" = { };
50 generator.script = ''
51 echo "$prompt_value" > "$secrets"/nextcloud.pw
52 '';
53 generator.prompt = ''
54 please enter the nextcloud admin password:
55 '';
56 };
57 systemd.services.nextcloud-setup.serviceConfig.ExecStartPre = [
58 "+${pkgs.writeDash "copy-pw" ''
59 ${pkgs.rsync}/bin/rsync \
60 --chown nextcloud:nextcloud \
61 --chmod 0700 \
62 ${config.clanCore.facts.services.nextcloud-pw.secret."nextcloud.pw".path} /run/nextcloud.pw
63 ''}"
64 ];
65
66 # mail
67 lass.usershadow.enable = true;
68 services.nginx.virtualHosts."mail.ubikmedia.eu" = {
69 enableACME = true;
70 forceSSL = true;
71 };
72 services.roundcube = {
73 enable = true;
74 hostName = "mail.ubikmedia.eu";
75 extraConfig = ''
76 $config['smtp_debug'] = true;
77 $config['smtp_host'] = "localhost:25";
78 '';
79 };
80 services.dovecot2 = {
81 enable = true;
82 showPAMFailure = true;
83 mailLocation = "maildir:~/Mail";
84 sslServerCert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
85 sslServerKey = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
86 };
87 krebs.exim-smarthost = {
88 ssl_cert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
89 ssl_key = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
90 authenticators.PLAIN = ''
91 driver = plaintext
92 public_name = PLAIN
93 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
94 '';
95 authenticators.LOGIN = ''
96 driver = plaintext
97 public_name = LOGIN
98 server_prompts = "Username:: : Password::"
99 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
100 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
101 '';
102 internet-aliases = [
103 {
104 from = "dma@ubikmedia.de";
105 to = "domsen";
106 }
107 {
108 from = "dma@ubikmedia.eu";
109 to = "domsen";
110 }
111 {
112 from = "hallo@apanowicz.de";
113 to = "domsen";
114 }
115 {
116 from = "bruno@apanowicz.de";
117 to = "bruno";
118 }
119 {
120 from = "mail@jla-trading.com";
121 to = "jla-trading";
122 }
123 {
124 from = "jms@ubikmedia.eu";
125 to = "jms";
126 }
127 {
128 from = "ms@ubikmedia.eu";
129 to = "ms";
130 }
131 {
132 from = "ubik@ubikmedia.eu";
133 to = "domsen, jms, ms";
134 }
135 {
136 from = "kontakt@alewis.de";
137 to = "klabusterbeere";
138 }
139 {
140 from = "hallo@jarugadesign.de";
141 to = "kasia";
142 }
143 {
144 from = "noreply@beeshmooth.ch";
145 to = "besmooth@gmx.ch";
146 }
147
148 {
149 from = "testuser@ubikmedia.eu";
150 to = "testuser";
151 }
152 ];
153 sender_domains = [
154 "jla-trading.com"
155 "ubikmedia.eu"
156 "ubikmedia.de"
157 "apanowicz.de"
158 "alewis.de"
159 "jarugadesign.de"
160 "beesmooth.ch"
161 ];
162 dkim = [
163 { domain = "ubikmedia.eu"; }
164 { domain = "apanowicz.de"; }
165 { domain = "beesmooth.ch"; }
166 ];
167 };
168
169 # users
170 users.groups.xanf = { };
171 users.users.UBIK-SFTP = {
172 uid = pkgs.stockholm.lib.genid_uint31 "UBIK-SFTP";
173 home = "/home/UBIK-SFTP";
174 useDefaultShell = true;
175 createHome = true;
176 isNormalUser = true;
177 };
178
179 users.users.xanf = {
180 uid = pkgs.stockholm.lib.genid_uint31 "xanf";
181 group = "xanf";
182 home = "/home/xanf";
183 useDefaultShell = true;
184 createHome = false; # creathome forces permissions
185 isNormalUser = true;
186 };
187
188 users.users.domsen = {
189 uid = pkgs.stockholm.lib.genid_uint31 "domsen";
190 description = "maintenance acc for domsen";
191 home = "/home/domsen";
192 useDefaultShell = true;
193 extraGroups = [
194 "syncthing"
195 "download"
196 "xanf"
197 ];
198 createHome = true;
199 isNormalUser = true;
200 };
201
202 users.users.bruno = {
203 uid = pkgs.stockholm.lib.genid_uint31 "bruno";
204 home = "/home/bruno";
205 useDefaultShell = true;
206 createHome = true;
207 isNormalUser = true;
208 };
209
210 users.users.jla-trading = {
211 uid = pkgs.stockholm.lib.genid_uint31 "jla-trading";
212 home = "/home/jla-trading";
213 useDefaultShell = true;
214 createHome = true;
215 isNormalUser = true;
216 };
217
218 users.users.jms = {
219 uid = pkgs.stockholm.lib.genid_uint31 "jms";
220 home = "/home/jms";
221 useDefaultShell = true;
222 createHome = true;
223 isNormalUser = true;
224 };
225
226 users.users.ms = {
227 uid = pkgs.stockholm.lib.genid_uint31 "ms";
228 home = "/home/ms";
229 useDefaultShell = true;
230 createHome = true;
231 isNormalUser = true;
232 };
233
234 users.users.testuser = {
235 uid = pkgs.stockholm.lib.genid_uint31 "testuser";
236 home = "/home/testuser";
237 useDefaultShell = true;
238 createHome = true;
239 isNormalUser = true;
240 };
241
242 users.users.bui = {
243 uid = pkgs.stockholm.lib.genid_uint31 "bui";
244 home = "/home/bui";
245 useDefaultShell = true;
246 createHome = true;
247 isNormalUser = true;
248 };
249
250 users.users.klabusterbeere = {
251 uid = pkgs.stockholm.lib.genid_uint31 "klabusterbeere";
252 home = "/home/klabusterbeere";
253 useDefaultShell = true;
254 createHome = true;
255 isNormalUser = true;
256 };
257
258 users.users.kasia = {
259 uid = pkgs.stockholm.lib.genid_uint31 "kasia";
260 home = "/home/kasia";
261 useDefaultShell = true;
262 createHome = true;
263 isNormalUser = true;
264 };
265
266 users.users.XANF_TEAM = {
267 uid = pkgs.stockholm.lib.genid_uint31 "XANF_TEAM";
268 group = "xanf";
269 home = "/home/XANF_TEAM";
270 useDefaultShell = true;
271 createHome = true;
272 isNormalUser = true;
273 };
274
275 users.users.dif = {
276 uid = pkgs.stockholm.lib.genid_uint31 "dif";
277 home = "/home/dif";
278 useDefaultShell = true;
279 extraGroups = [ "xanf" ];
280 createHome = true;
281 isNormalUser = true;
282 };
283
284 users.users.lavafilms = {
285 uid = pkgs.stockholm.lib.genid_uint31 "lavafilms";
286 home = "/home/lavafilms";
287 useDefaultShell = true;
288 extraGroups = [ "xanf" ];
289 createHome = true;
290 isNormalUser = true;
291 };
292
293 users.users.movematchers = {
294 uid = pkgs.stockholm.lib.genid_uint31 "movematchers";
295 home = "/home/movematchers";
296 useDefaultShell = true;
297 extraGroups = [ "xanf" ];
298 createHome = true;
299 isNormalUser = true;
300 };
301
302 users.users.blackphoton = {
303 uid = pkgs.stockholm.lib.genid_uint31 "blackphoton";
304 home = "/home/blackphoton";
305 useDefaultShell = true;
306 extraGroups = [ "xanf" ];
307 createHome = true;
308 isNormalUser = true;
309 };
310
311 users.users.line = {
312 uid = pkgs.stockholm.lib.genid_uint31 "line";
313 home = "/home/line";
314 useDefaultShell = true;
315 # extraGroups = [ "xanf" ];
316 createHome = true;
317 isNormalUser = true;
318 };
319
320 users.users.avada = {
321 uid = pkgs.stockholm.lib.genid_uint31 "avada";
322 home = "/home/avada";
323 useDefaultShell = true;
324 createHome = true;
325 isNormalUser = true;
326 };
327
328 users.users.familienrat = {
329 uid = pkgs.stockholm.lib.genid_uint31 "familienrat";
330 home = "/home/familienrat";
331 useDefaultShell = true;
332 createHome = true;
333 isNormalUser = true;
334 };
335
336}