This repository has no description
8.1 kB
333 lines
1{
2 self,
3 config,
4 pkgs,
5 ...
6}:
7{
8 imports = [
9 ../../2configs
10 ../../2configs/retiolum.nix
11
12 self.inputs.stockholm.nixosModules.exim-smarthost
13 ];
14
15 krebs.build.host = config.krebs.hosts.ubik;
16 clan.password-store.targetDirectory = "/var/state/secrets";
17
18 krebs.sync-containers3.inContainer = {
19 enable = true;
20 pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBFGMjH0+Dco6DVFZbByENMci8CFTLXCL7j53yctPnM";
21 };
22
23 security.acme = {
24 acceptTerms = true;
25 defaults.email = "acme@lassul.us";
26 };
27 networking.firewall.allowedTCPPorts = [
28 80
29 443
30 ];
31
32 # nextcloud
33 services.nginx.virtualHosts."c.apanowicz.de" = {
34 enableACME = true;
35 forceSSL = true;
36 };
37 services.nextcloud = {
38 enable = true;
39 hostName = "c.apanowicz.de";
40 package = pkgs.nextcloud29;
41 config.adminpassFile = "/run/nextcloud.pw";
42 https = true;
43 maxUploadSize = "9001M";
44 };
45 clanCore.facts.services.nextcloud-pw = {
46 secret."nextcloud.pw" = { };
47 generator.script = ''
48 echo "$prompt_value" > "$secrets"/nextcloud.pw
49 '';
50 generator.prompt = ''
51 please enter the nextcloud admin password:
52 '';
53 };
54 systemd.services.nextcloud-setup.serviceConfig.ExecStartPre = [
55 "+${pkgs.writeDash "copy-pw" ''
56 ${pkgs.rsync}/bin/rsync \
57 --chown nextcloud:nextcloud \
58 --chmod 0700 \
59 ${config.clanCore.facts.services.nextcloud-pw.secret."nextcloud.pw".path} /run/nextcloud.pw
60 ''}"
61 ];
62
63 # mail
64 lass.usershadow.enable = true;
65 services.nginx.virtualHosts."mail.ubikmedia.eu" = {
66 enableACME = true;
67 forceSSL = true;
68 };
69 services.roundcube = {
70 enable = true;
71 hostName = "mail.ubikmedia.eu";
72 extraConfig = ''
73 $config['smtp_debug'] = true;
74 $config['smtp_host'] = "localhost:25";
75 '';
76 };
77 services.dovecot2 = {
78 enable = true;
79 showPAMFailure = true;
80 mailLocation = "maildir:~/Mail";
81 sslServerCert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
82 sslServerKey = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
83 };
84 krebs.exim-smarthost = {
85 ssl_cert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
86 ssl_key = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
87 authenticators.PLAIN = ''
88 driver = plaintext
89 public_name = PLAIN
90 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
91 '';
92 authenticators.LOGIN = ''
93 driver = plaintext
94 public_name = LOGIN
95 server_prompts = "Username:: : Password::"
96 server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
97 # server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
98 '';
99 internet-aliases = [
100 {
101 from = "dma@ubikmedia.de";
102 to = "domsen";
103 }
104 {
105 from = "dma@ubikmedia.eu";
106 to = "domsen";
107 }
108 {
109 from = "hallo@apanowicz.de";
110 to = "domsen";
111 }
112 {
113 from = "bruno@apanowicz.de";
114 to = "bruno";
115 }
116 {
117 from = "mail@jla-trading.com";
118 to = "jla-trading";
119 }
120 {
121 from = "jms@ubikmedia.eu";
122 to = "jms";
123 }
124 {
125 from = "ms@ubikmedia.eu";
126 to = "ms";
127 }
128 {
129 from = "ubik@ubikmedia.eu";
130 to = "domsen, jms, ms";
131 }
132 {
133 from = "kontakt@alewis.de";
134 to = "klabusterbeere";
135 }
136 {
137 from = "hallo@jarugadesign.de";
138 to = "kasia";
139 }
140 {
141 from = "noreply@beeshmooth.ch";
142 to = "besmooth@gmx.ch";
143 }
144
145 {
146 from = "testuser@ubikmedia.eu";
147 to = "testuser";
148 }
149 ];
150 sender_domains = [
151 "jla-trading.com"
152 "ubikmedia.eu"
153 "ubikmedia.de"
154 "apanowicz.de"
155 "alewis.de"
156 "jarugadesign.de"
157 "beesmooth.ch"
158 ];
159 dkim = [
160 { domain = "ubikmedia.eu"; }
161 { domain = "apanowicz.de"; }
162 { domain = "beesmooth.ch"; }
163 ];
164 };
165
166 # users
167 users.groups.xanf = { };
168 users.users.UBIK-SFTP = {
169 uid = pkgs.stockholm.lib.genid_uint31 "UBIK-SFTP";
170 home = "/home/UBIK-SFTP";
171 useDefaultShell = true;
172 createHome = true;
173 isNormalUser = true;
174 };
175
176 users.users.xanf = {
177 uid = pkgs.stockholm.lib.genid_uint31 "xanf";
178 group = "xanf";
179 home = "/home/xanf";
180 useDefaultShell = true;
181 createHome = false; # creathome forces permissions
182 isNormalUser = true;
183 };
184
185 users.users.domsen = {
186 uid = pkgs.stockholm.lib.genid_uint31 "domsen";
187 description = "maintenance acc for domsen";
188 home = "/home/domsen";
189 useDefaultShell = true;
190 extraGroups = [
191 "syncthing"
192 "download"
193 "xanf"
194 ];
195 createHome = true;
196 isNormalUser = true;
197 };
198
199 users.users.bruno = {
200 uid = pkgs.stockholm.lib.genid_uint31 "bruno";
201 home = "/home/bruno";
202 useDefaultShell = true;
203 createHome = true;
204 isNormalUser = true;
205 };
206
207 users.users.jla-trading = {
208 uid = pkgs.stockholm.lib.genid_uint31 "jla-trading";
209 home = "/home/jla-trading";
210 useDefaultShell = true;
211 createHome = true;
212 isNormalUser = true;
213 };
214
215 users.users.jms = {
216 uid = pkgs.stockholm.lib.genid_uint31 "jms";
217 home = "/home/jms";
218 useDefaultShell = true;
219 createHome = true;
220 isNormalUser = true;
221 };
222
223 users.users.ms = {
224 uid = pkgs.stockholm.lib.genid_uint31 "ms";
225 home = "/home/ms";
226 useDefaultShell = true;
227 createHome = true;
228 isNormalUser = true;
229 };
230
231 users.users.testuser = {
232 uid = pkgs.stockholm.lib.genid_uint31 "testuser";
233 home = "/home/testuser";
234 useDefaultShell = true;
235 createHome = true;
236 isNormalUser = true;
237 };
238
239 users.users.bui = {
240 uid = pkgs.stockholm.lib.genid_uint31 "bui";
241 home = "/home/bui";
242 useDefaultShell = true;
243 createHome = true;
244 isNormalUser = true;
245 };
246
247 users.users.klabusterbeere = {
248 uid = pkgs.stockholm.lib.genid_uint31 "klabusterbeere";
249 home = "/home/klabusterbeere";
250 useDefaultShell = true;
251 createHome = true;
252 isNormalUser = true;
253 };
254
255 users.users.kasia = {
256 uid = pkgs.stockholm.lib.genid_uint31 "kasia";
257 home = "/home/kasia";
258 useDefaultShell = true;
259 createHome = true;
260 isNormalUser = true;
261 };
262
263 users.users.XANF_TEAM = {
264 uid = pkgs.stockholm.lib.genid_uint31 "XANF_TEAM";
265 group = "xanf";
266 home = "/home/XANF_TEAM";
267 useDefaultShell = true;
268 createHome = true;
269 isNormalUser = true;
270 };
271
272 users.users.dif = {
273 uid = pkgs.stockholm.lib.genid_uint31 "dif";
274 home = "/home/dif";
275 useDefaultShell = true;
276 extraGroups = [ "xanf" ];
277 createHome = true;
278 isNormalUser = true;
279 };
280
281 users.users.lavafilms = {
282 uid = pkgs.stockholm.lib.genid_uint31 "lavafilms";
283 home = "/home/lavafilms";
284 useDefaultShell = true;
285 extraGroups = [ "xanf" ];
286 createHome = true;
287 isNormalUser = true;
288 };
289
290 users.users.movematchers = {
291 uid = pkgs.stockholm.lib.genid_uint31 "movematchers";
292 home = "/home/movematchers";
293 useDefaultShell = true;
294 extraGroups = [ "xanf" ];
295 createHome = true;
296 isNormalUser = true;
297 };
298
299 users.users.blackphoton = {
300 uid = pkgs.stockholm.lib.genid_uint31 "blackphoton";
301 home = "/home/blackphoton";
302 useDefaultShell = true;
303 extraGroups = [ "xanf" ];
304 createHome = true;
305 isNormalUser = true;
306 };
307
308 users.users.line = {
309 uid = pkgs.stockholm.lib.genid_uint31 "line";
310 home = "/home/line";
311 useDefaultShell = true;
312 # extraGroups = [ "xanf" ];
313 createHome = true;
314 isNormalUser = true;
315 };
316
317 users.users.avada = {
318 uid = pkgs.stockholm.lib.genid_uint31 "avada";
319 home = "/home/avada";
320 useDefaultShell = true;
321 createHome = true;
322 isNormalUser = true;
323 };
324
325 users.users.familienrat = {
326 uid = pkgs.stockholm.lib.genid_uint31 "familienrat";
327 home = "/home/familienrat";
328 useDefaultShell = true;
329 createHome = true;
330 isNormalUser = true;
331 };
332
333}