This repository has no description
2.3 kB
76 lines
1{ self, config, lib, pkgs, ... }: let
2
3 to = lib.concatStringsSep "," [
4 "lass@green.r"
5 ];
6
7 mails = import "${config.krebs.secret.directory}/mails.nix"; # todo make this pure somehow
8
9in {
10 imports = [
11 self.inputs.stockholm.nixosModules.exim-smarthost
12 ];
13 environment.systemPackages = [ pkgs.review-mail-queue ];
14
15 clanCore.secrets."lassul.us-dkim" = {
16 secrets."lassul.us.dkim.priv" = { };
17 facts."lassul.us.dkim.pub" = { };
18 generator.path = with pkgs; [ coreutils openssl ];
19 generator.script = ''
20 openssl genrsa -out "$secrets"/lassul.us.dkim.priv 2048
21 openssl rsa -in "$secrets"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/lassul.us.dkim.pub
22 '';
23 };
24
25 krebs.exim-smarthost = {
26 enable = true;
27 dkim = [
28 { domain = "lassul.us"; }
29 ];
30 ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
31 ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
32 primary_hostname = "lassul.us";
33 sender_domains = [
34 "lassul.us"
35 ];
36 relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
37 config.krebs.hosts.aergia
38 config.krebs.hosts.ignavia
39 config.krebs.hosts.blue
40 config.krebs.hosts.coaxmetal
41 config.krebs.hosts.green
42 config.krebs.hosts.mors
43 config.krebs.hosts.xerxes
44 ];
45 internet-aliases = map (from: { inherit from to; }) mails ++ [
46 ];
47 system-aliases = [
48 { from = "mailer-daemon"; to = "postmaster"; }
49 { from = "postmaster"; to = "root"; }
50 { from = "nobody"; to = "root"; }
51 { from = "hostmaster"; to = "root"; }
52 { from = "usenet"; to = "root"; }
53 { from = "news"; to = "root"; }
54 { from = "webmaster"; to = "root"; }
55 { from = "www"; to = "root"; }
56 { from = "ftp"; to = "root"; }
57 { from = "abuse"; to = "root"; }
58 { from = "noc"; to = "root"; }
59 { from = "security"; to = "root"; }
60 { from = "root"; to = "lass"; }
61 ];
62 };
63 krebs.iptables.tables.filter.INPUT.rules = [
64 { predicate = "-p tcp --dport smtp"; target = "ACCEPT"; }
65 ];
66
67 security.acme.certs."mail.lassul.us" = {
68 group = "lasscert";
69 webroot = "/var/lib/acme/acme-challenge";
70 };
71 users.groups.lasscert.members = [
72 "dovecot2"
73 "exim"
74 "nginx"
75 ];
76}