This repository has no description
2.6 kB
135 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9
10 to = lib.concatStringsSep "," [
11 "lass@green.r"
12 ];
13
14 mails = [
15 ];
16
17in
18{
19 imports = [
20 self.inputs.stockholm.nixosModules.exim-smarthost
21 ];
22
23 clan.core.vars.generators."lassul.us-dkim" = {
24 files."lassul.us.dkim.priv" = { };
25 files."lassul.us.dkim.pub".secret = false;
26 migrateFact = "lassul.us-dkim";
27 runtimeInputs = with pkgs; [
28 coreutils
29 openssl
30 ];
31 script = ''
32 openssl genrsa -out "$out"/lassul.us.dkim.priv 2048
33 openssl rsa -in "$out"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/lassul.us.dkim.pub
34 '';
35 };
36
37 krebs.exim-smarthost = {
38 enable = true;
39 dkim = [
40 {
41 domain = "lassul.us";
42 private_key = config.clan.core.vars.generators."lassul.us-dkim".files."lassul.us.dkim.priv".path;
43 }
44 ];
45 ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
46 ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
47 primary_hostname = "lassul.us";
48 sender_domains = [
49 "lassul.us"
50 ];
51 relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
52 config.krebs.hosts.aergia
53 config.krebs.hosts.ignavia
54 config.krebs.hosts.blue
55 config.krebs.hosts.coaxmetal
56 config.krebs.hosts.green
57 config.krebs.hosts.mors
58 config.krebs.hosts.xerxes
59 ];
60 internet-aliases =
61 map (from: { inherit from to; }) mails
62 ++ [
63 ];
64 system-aliases = [
65 {
66 from = "mailer-daemon";
67 to = "postmaster";
68 }
69 {
70 from = "postmaster";
71 to = "root";
72 }
73 {
74 from = "nobody";
75 to = "root";
76 }
77 {
78 from = "hostmaster";
79 to = "root";
80 }
81 {
82 from = "usenet";
83 to = "root";
84 }
85 {
86 from = "news";
87 to = "root";
88 }
89 {
90 from = "webmaster";
91 to = "root";
92 }
93 {
94 from = "www";
95 to = "root";
96 }
97 {
98 from = "ftp";
99 to = "root";
100 }
101 {
102 from = "abuse";
103 to = "root";
104 }
105 {
106 from = "noc";
107 to = "root";
108 }
109 {
110 from = "security";
111 to = "root";
112 }
113 {
114 from = "root";
115 to = "lass";
116 }
117 ];
118 };
119 krebs.iptables.tables.filter.INPUT.rules = [
120 {
121 predicate = "-p tcp --dport smtp";
122 target = "ACCEPT";
123 }
124 ];
125
126 security.acme.certs."mail.lassul.us" = {
127 group = "lasscert";
128 webroot = "/var/lib/acme/acme-challenge";
129 };
130 users.groups.lasscert.members = [
131 "dovecot2"
132 "exim"
133 "nginx"
134 ];
135}