This repository has no description
15 kB
618 lines
1{
2 self,
3 config,
4 pkgs,
5 lib,
6 ...
7}:
8
9let
10
11 inherit (self.inputs.stockholm.lib)
12 genid_uint31
13 ;
14 inherit (import ./util.nix { inherit lib pkgs; })
15 servePage
16 serveOwncloud
17 serveWordpress
18 ;
19
20 msmtprc = pkgs.writeText "msmtprc" ''
21 account localhost
22 host localhost
23 account default: localhost
24 '';
25
26 sendmail = pkgs.writeDash "msmtp" ''
27 exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
28 '';
29
30in
31{
32 imports = [
33 self.inputs.stockholm.nixosModules.acl
34 self.inputs.stockholm.nixosModules.on-failure
35 ./default.nix
36 ./sqlBackup.nix
37 (servePage [
38 "aldonasiech.com"
39 "www.aldonasiech.com"
40 ])
41 (servePage [
42 "apanowicz.de"
43 "www.apanowicz.de"
44 ])
45 (servePage [
46 "reich-gebaeudereinigung.de"
47 "www.reich-gebaeudereinigung.de"
48 ])
49 (servePage [
50 "illustra.de"
51 "www.illustra.de"
52 ])
53 # (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
54 (servePage [
55 "familienrat-hamburg.de"
56 "www.familienrat-hamburg.de"
57 ])
58 (servePage [ "karlaskop.de" ])
59 (servePage [
60 "freemonkey.art"
61 "www.freemonkey.art"
62 ])
63 (serveOwncloud [ "o.ubikmedia.de" ])
64 (serveWordpress [
65 "ubikmedia.de"
66 "ubikmedia.eu"
67 "youthtube.xyz"
68 "joemisch.com"
69 "weirdwednesday.de"
70 "jarugadesign.de"
71 "beesmooth.ch"
72
73 "www.ubikmedia.eu"
74 "www.youthtube.xyz"
75 "www.ubikmedia.de"
76 "www.joemisch.com"
77 "www.weirdwednesday.de"
78 "www.jarugadesign.de"
79 "www.beesmooth.ch"
80
81 "aldona2.ubikmedia.de"
82 "cinevita.ubikmedia.de"
83 "factscloud.ubikmedia.de"
84 "illucloud.ubikmedia.de"
85 "joemisch.ubikmedia.de"
86 "nb.ubikmedia.de"
87 "youthtube.ubikmedia.de"
88 "weirdwednesday.ubikmedia.de"
89 "freemonkey.ubikmedia.de"
90 "jarugadesign.ubikmedia.de"
91 "crypto4art.ubikmedia.de"
92 "jarugadesign.ubikmedia.de"
93 "beesmooth.ubikmedia.de"
94 ])
95 ];
96
97 # https://github.com/nextcloud/server/issues/25436
98 services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
99
100 services.mysql.ensureDatabases = [
101 "ubikmedia_de"
102 "o_ubikmedia_de"
103 ];
104 services.mysql.ensureUsers = [
105 {
106 ensurePermissions = {
107 "ubikmedia_de.*" = "ALL";
108 };
109 name = "nginx";
110 }
111 {
112 ensurePermissions = {
113 "o_ubikmedia_de.*" = "ALL";
114 };
115 name = "nginx";
116 }
117 ];
118
119 services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
120 try_files $uri $uri/ /index.php?$args;
121 '';
122
123 lass.mysqlBackup.config.all.databases = [
124 "ubikmedia_de"
125 "o_ubikmedia_de"
126 ];
127
128 services.phpfpm.phpOptions = ''
129 sendmail_path = ${sendmail} -t
130 upload_max_filesize = 100M
131 post_max_size = 100M
132 file_uploads = on
133 '';
134
135 clanCore.facts.services.nextcloud = {
136 secret."nextcloud_pw" = { };
137 generator.script = ''
138 cat > "$secrets"/nexcloud_pw;
139 '';
140 generator.prompt = ''
141 enter initial admin password for nextcloud
142 '';
143 };
144 systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ];
145 krebs.secret.files.nextcloud_pw = {
146 path = "/run/nextcloud.pw";
147 owner.name = "nextcloud";
148 group-name = "nextcloud";
149 source-path = "${config.krebs.secret.directory}/nextcloud_pw";
150 };
151 services.nextcloud = {
152 enable = true;
153 hostName = "o.xanf.org";
154 package = pkgs.nextcloud28;
155 settings.overwriteProtocol = "https";
156 config.adminpassFile = "/run/nextcloud.pw";
157 https = true;
158 };
159 services.nginx.virtualHosts."o.xanf.org" = {
160 enableACME = true;
161 forceSSL = true;
162 };
163 services.nginx.virtualHosts."weirdweekender.de" = {
164 serverAliases = [ "www.weirdweekender.de" ];
165 enableACME = true;
166 forceSSL = true;
167 locations."/".extraConfig = ''
168 return 301 https://weirdwednesday.de/weirdweekender/;
169 '';
170 };
171
172 # MAIL STUFF
173 # TODO: make into its own module
174
175 services.roundcube = {
176 enable = true;
177 hostName = "mail.lassul.us";
178 extraConfig = ''
179 $config['smtp_debug'] = true;
180 $config['smtp_host'] = "localhost:25";
181 '';
182 };
183 services.dovecot2 = {
184 enable = true;
185 showPAMFailure = true;
186 mailLocation = "maildir:~/Mail";
187 sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
188 sslServerKey = "/var/lib/acme/lassul.us/key.pem";
189 };
190 krebs.iptables.tables.filter.INPUT.rules = [
191 {
192 predicate = "-p tcp --dport pop3s";
193 target = "ACCEPT";
194 }
195 {
196 predicate = "-p tcp --dport imaps";
197 target = "ACCEPT";
198 }
199 ];
200
201 environment.systemPackages = [
202 (pkgs.writers.writeDashBin "debug_exim" ''
203 set -ef
204 export PATH="${lib.makeBinPath [ pkgs.coreutils ]}"
205 echo "$@" >> /tmp/xxx
206 /run/wrappers/bin/shadow_verify_arg "${config.lass.usershadow.pattern}" "$2" "$3" 2>>/tmp/xxx1
207 echo "ok" >> /tmp/yyy
208 exit 23
209 '')
210 ];
211
212 krebs.exim-smarthost = {
213 authenticators.PLAIN = ''
214 driver = plaintext
215 public_name = PLAIN
216 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
217 '';
218 authenticators.LOGIN = ''
219 driver = plaintext
220 public_name = LOGIN
221 server_prompts = "Username:: : Password::"
222 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
223 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
224 '';
225 internet-aliases = [
226 {
227 from = "dma@ubikmedia.de";
228 to = "domsen";
229 }
230 {
231 from = "dma@ubikmedia.eu";
232 to = "domsen";
233 }
234 {
235 from = "mail@habsys.de";
236 to = "domsen";
237 }
238 {
239 from = "mail@habsys.eu";
240 to = "domsen";
241 }
242 {
243 from = "hallo@apanowicz.de";
244 to = "domsen";
245 }
246 {
247 from = "bruno@apanowicz.de";
248 to = "bruno";
249 }
250 {
251 from = "mail@jla-trading.com";
252 to = "jla-trading";
253 }
254 {
255 from = "jms@ubikmedia.eu";
256 to = "jms";
257 }
258 {
259 from = "ms@ubikmedia.eu";
260 to = "ms";
261 }
262 {
263 from = "ubik@ubikmedia.eu";
264 to = "domsen, jms, ms";
265 }
266 {
267 from = "kontakt@alewis.de";
268 to = "klabusterbeere";
269 }
270 {
271 from = "hallo@jarugadesign.de";
272 to = "kasia";
273 }
274 {
275 from = "noreply@beeshmooth.ch";
276 to = "besmooth@gmx.ch";
277 }
278
279 {
280 from = "testuser@lassul.us";
281 to = "testuser";
282 }
283 {
284 from = "testuser@ubikmedia.eu";
285 to = "testuser";
286 }
287 ];
288 sender_domains = [
289 "jla-trading.com"
290 "ubikmedia.eu"
291 "ubikmedia.de"
292 "apanowicz.de"
293 "alewis.de"
294 "jarugadesign.de"
295 "beesmooth.ch"
296 "event-extra.de"
297 ];
298 dkim = [
299 { domain = "ubikmedia.eu"; }
300 { domain = "apanowicz.de"; }
301 { domain = "beesmooth.ch"; }
302 ];
303 };
304 clanCore.facts.services."ubikmedia.eu-dkim" = {
305 secret."ubikmedia.eu.dkim.priv" = { };
306 public."ubikmedia.eu.dkim.pub" = { };
307 generator.path = with pkgs; [
308 coreutils
309 openssl
310 ];
311 generator.script = ''
312 openssl genrsa -out "$secrets"/ubikmedia.eu.dkim.priv 1024
313 openssl rsa -in "$secrets"/ubikmedia.eu.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/ubikmedia.eu.dkim.pub
314 '';
315 };
316 clanCore.facts.services."apanowicz.de-dkim" = {
317 secret."apanowicz.de.dkim.priv" = { };
318 public."apanowicz.de.dkim.pub" = { };
319 generator.path = with pkgs; [
320 coreutils
321 openssl
322 ];
323 generator.script = ''
324 openssl genrsa -out "$secrets"/apanowicz.de.dkim.priv 1024
325 openssl rsa -in "$secrets"/apanowicz.de.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/apanowicz.de.dkim.pub
326 '';
327 };
328 clanCore.facts.services."beesmooth.ch-dkim" = {
329 secret."beesmooth.ch.dkim.priv" = { };
330 public."beesmooth.ch.dkim.pub" = { };
331 generator.path = with pkgs; [
332 coreutils
333 openssl
334 ];
335 generator.script = ''
336 openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024
337 openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
338 '';
339 };
340 clanCore.facts.services."freemonkey.art" = {
341 secret."beesmooth.ch.dkim.priv" = { };
342 public."beesmooth.ch.dkim.pub" = { };
343 generator.path = with pkgs; [
344 coreutils
345 openssl
346 ];
347 generator.script = ''
348 openssl genrsa -out "$secrets"/beesmooth.ch.dkim.priv 1024
349 openssl rsa -in "$secrets"/beesmooth.ch.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$facts"/beesmooth.ch.dkim.pub
350 '';
351 };
352 services.borgbackup.jobs.hetzner.paths = [
353 "/home/xanf"
354 "/home/domsen"
355 "/home/bruno"
356 "/home/jla-trading"
357 "/home/jms"
358 "/home/ms"
359 "/home/bui"
360 "/home/klabusterbeere"
361 "/home/akayguen"
362 "/home/kasia"
363 "/home/dif"
364 "/home/lavafilms"
365 "/home/movematchers"
366 "/home/blackphoton"
367 "/home/avada"
368 "/home/sts"
369 "/home/familienrat"
370 ];
371 users.users.UBIK-SFTP = {
372 uid = genid_uint31 "UBIK-SFTP";
373 home = "/home/UBIK-SFTP";
374 useDefaultShell = true;
375 createHome = true;
376 isNormalUser = true;
377 };
378
379 users.users.xanf = {
380 uid = genid_uint31 "xanf";
381 group = "xanf";
382 home = "/home/xanf";
383 useDefaultShell = true;
384 createHome = false; # creathome forces permissions
385 isNormalUser = true;
386 };
387
388 users.users.domsen = {
389 uid = genid_uint31 "domsen";
390 description = "maintenance acc for domsen";
391 home = "/home/domsen";
392 useDefaultShell = true;
393 extraGroups = [
394 "syncthing"
395 "download"
396 "xanf"
397 ];
398 createHome = true;
399 isNormalUser = true;
400 };
401
402 users.users.bruno = {
403 uid = genid_uint31 "bruno";
404 home = "/home/bruno";
405 useDefaultShell = true;
406 createHome = true;
407 isNormalUser = true;
408 };
409
410 users.users.jla-trading = {
411 uid = genid_uint31 "jla-trading";
412 home = "/home/jla-trading";
413 useDefaultShell = true;
414 createHome = true;
415 isNormalUser = true;
416 };
417
418 users.users.jms = {
419 uid = genid_uint31 "jms";
420 home = "/home/jms";
421 useDefaultShell = true;
422 createHome = true;
423 isNormalUser = true;
424 };
425
426 users.users.ms = {
427 uid = genid_uint31 "ms";
428 home = "/home/ms";
429 useDefaultShell = true;
430 createHome = true;
431 isNormalUser = true;
432 };
433
434 users.users.testuser = {
435 uid = genid_uint31 "testuser";
436 home = "/home/testuser";
437 useDefaultShell = true;
438 createHome = true;
439 isNormalUser = true;
440 };
441
442 #users.users.akayguen = {
443 # uid = genid_uint31 "akayguen";
444 # home = "/home/akayguen";
445 # useDefaultShell = true;
446 # createHome = true;
447 # isNormalUser = true;
448 #};
449
450 users.users.bui = {
451 uid = genid_uint31 "bui";
452 home = "/home/bui";
453 useDefaultShell = true;
454 createHome = true;
455 isNormalUser = true;
456 };
457
458 users.users.klabusterbeere = {
459 uid = genid_uint31 "klabusterbeere";
460 home = "/home/klabusterbeere";
461 useDefaultShell = true;
462 createHome = true;
463 isNormalUser = true;
464 };
465
466 users.users.kasia = {
467 uid = genid_uint31 "kasia";
468 home = "/home/kasia";
469 useDefaultShell = true;
470 createHome = true;
471 isNormalUser = true;
472 };
473
474 users.users.XANF_TEAM = {
475 uid = genid_uint31 "XANF_TEAM";
476 group = "xanf";
477 home = "/home/XANF_TEAM";
478 useDefaultShell = true;
479 createHome = true;
480 isNormalUser = true;
481 };
482
483 users.users.dif = {
484 uid = genid_uint31 "dif";
485 home = "/home/dif";
486 useDefaultShell = true;
487 extraGroups = [ "xanf" ];
488 createHome = true;
489 isNormalUser = true;
490 };
491
492 users.users.lavafilms = {
493 uid = genid_uint31 "lavafilms";
494 home = "/home/lavafilms";
495 useDefaultShell = true;
496 extraGroups = [ "xanf" ];
497 createHome = true;
498 isNormalUser = true;
499 };
500
501 users.users.movematchers = {
502 uid = genid_uint31 "movematchers";
503 home = "/home/movematchers";
504 useDefaultShell = true;
505 extraGroups = [ "xanf" ];
506 createHome = true;
507 isNormalUser = true;
508 };
509
510 users.users.blackphoton = {
511 uid = genid_uint31 "blackphoton";
512 home = "/home/blackphoton";
513 useDefaultShell = true;
514 extraGroups = [ "xanf" ];
515 createHome = true;
516 isNormalUser = true;
517 };
518
519 users.users.line = {
520 uid = genid_uint31 "line";
521 home = "/home/line";
522 useDefaultShell = true;
523 # extraGroups = [ "xanf" ];
524 createHome = true;
525 isNormalUser = true;
526 };
527
528 users.users.avada = {
529 uid = genid_uint31 "avada";
530 home = "/home/avada";
531 useDefaultShell = true;
532 createHome = true;
533 isNormalUser = true;
534 };
535
536 users.users.sts = {
537 uid = genid_uint31 "sts";
538 home = "/home/sts";
539 useDefaultShell = true;
540 createHome = true;
541 isNormalUser = true;
542 };
543
544 users.users.familienrat = {
545 uid = genid_uint31 "familienrat";
546 home = "/home/familienrat";
547 useDefaultShell = true;
548 createHome = true;
549 isNormalUser = true;
550 };
551
552 users.users.pr = {
553 uid = genid_uint31 "pr";
554 home = "/home/pr";
555 useDefaultShell = true;
556 createHome = true;
557 isNormalUser = true;
558 };
559
560 krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = { };
561 krebs.acl."/srv/http"."u:familienrat:X" = {
562 default = false;
563 recursive = false;
564 };
565
566 users.groups.xanf = { };
567
568 krebs.on-failure.plans.restic-backups-domsen = {
569 journalctl = {
570 lines = 1000;
571 };
572 };
573
574 services.restic.backups.domsen = {
575 initialize = true;
576 repository = "/backups/domsen";
577 passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
578 timerConfig = {
579 OnCalendar = "00:05";
580 RandomizedDelaySec = "5h";
581 };
582 paths = [
583 "/home/domsen/Mail"
584 "/home/ms/Mail"
585 "/home/klabusterbeere/Mail"
586 "/home/jms/Mail"
587 "/home/kasia/Mail"
588 "/home/bruno/Mail"
589 "/home/akayguen/Mail"
590 "/backups/sql_dumps"
591 ];
592 };
593
594 # services.syncthing.settings.folders = {
595 # domsen-backups = {
596 # path = "/backups/domsen";
597 # devices = [ "domsen-backup" ];
598 # };
599 # domsen-backup-srv-http = {
600 # path = "/srv/http";
601 # devices = [ "domsen-backup" ];
602 # };
603 # };
604
605 system.activationScripts.domsen-backups = ''
606 ${pkgs.coreutils}/bin/chmod 750 /backups
607 '';
608
609 # takes too long!!
610 # krebs.acl."/srv/http"."u:syncthing:rwX" = {};
611 # krebs.acl."/srv/http"."u:nginx:rwX" = {};
612 # krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
613 krebs.acl."/home/xanf/XANF_TEAM"."g:xanf:rwX" = { };
614 krebs.acl."/home/xanf"."g:xanf:X" = {
615 default = false;
616 recursive = false;
617 };
618}