This repository has no description
remove exim from all machines and clean up references
author
lassulus
date
(Mar 6, 2026, 11:26 PM CET)
commit
8698eb17
8698eb17e8166742c1ee4a970814b2cdaa096dd9
parent
0cf09e67
0cf09e67345373852de30c9d6b6cb29b01e0f08d
+1
-189
+1
-3
2configs/default.nix
+1
-3
2configs/default.nix
···
42
42
self.inputs.stockholm.nixosModules.kartei
43
43
self.inputs.stockholm.nixosModules.build
44
44
self.inputs.stockholm.nixosModules.dns
45
-
self.inputs.stockholm.nixosModules.exim
46
-
self.inputs.stockholm.nixosModules.exim-retiolum
47
45
self.inputs.stockholm.nixosModules.tinc
48
46
self.inputs.stockholm.nixosModules.iptables
49
-
self.inputs.stockholm.nixosModules.setuid
50
47
self.inputs.stockholm.nixosModules.secret
48
+
self.inputs.stockholm.nixosModules.setuid
51
49
self.inputs.stockholm.nixosModules.sitemap
52
50
self.inputs.stockholm.nixosModules.ssl
53
51
self.inputs.stockholm.nixosModules.systemd
-26
2configs/exim-retiolum.nix
-26
2configs/exim-retiolum.nix
···
1
-
{ ... }:
2
-
{
3
-
krebs.exim-retiolum = {
4
-
enable = true;
5
-
system-aliases = [
6
-
{
7
-
from = "root";
8
-
to = "lass";
9
-
}
10
-
];
11
-
};
12
-
krebs.iptables.tables.filter.INPUT.rules = [
13
-
{
14
-
predicate = "-i retiolum -p tcp --dport smtp";
15
-
target = "ACCEPT";
16
-
}
17
-
{
18
-
predicate = "-i zttzibeakb -p tcp --dport smtp";
19
-
target = "ACCEPT";
20
-
}
21
-
{
22
-
predicate = "-i nether -p tcp --dport smtp";
23
-
target = "ACCEPT";
24
-
}
25
-
];
26
-
}
-150
2configs/exim-smarthost.nix
-150
2configs/exim-smarthost.nix
···
1
-
{
2
-
self,
3
-
config,
4
-
lib,
5
-
pkgs,
6
-
...
7
-
}:
8
-
let
9
-
10
-
to = lib.concatStringsSep "," [
11
-
"lass@green.r"
12
-
"bot"
13
-
];
14
-
15
-
# Keep a minimal alias list for the ACL; the catchall router handles the rest
16
-
mails = [
17
-
"lassulus@lassul.us"
18
-
];
19
-
20
-
in
21
-
{
22
-
imports = [
23
-
self.inputs.stockholm.nixosModules.exim-smarthost
24
-
];
25
-
26
-
clan.core.vars.generators."lassul.us-dkim" = {
27
-
files."lassul.us.dkim.priv" = { };
28
-
files."lassul.us.dkim.pub".secret = false;
29
-
migrateFact = "lassul.us-dkim";
30
-
runtimeInputs = with pkgs; [
31
-
coreutils
32
-
openssl
33
-
];
34
-
script = ''
35
-
openssl genrsa -out "$out"/lassul.us.dkim.priv 2048
36
-
openssl rsa -in "$out"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/lassul.us.dkim.pub
37
-
'';
38
-
};
39
-
40
-
krebs.exim-smarthost = {
41
-
enable = true;
42
-
dkim = [
43
-
{
44
-
domain = "lassul.us";
45
-
private_key = config.clan.core.vars.generators."lassul.us-dkim".files."lassul.us.dkim.priv".path;
46
-
}
47
-
];
48
-
ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
49
-
ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
50
-
primary_hostname = "lassul.us";
51
-
sender_domains = [
52
-
"lassul.us"
53
-
];
54
-
relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
55
-
config.krebs.hosts.aergia
56
-
config.krebs.hosts.ignavia
57
-
config.krebs.hosts.coaxmetal
58
-
config.krebs.hosts.green
59
-
config.krebs.hosts.mors
60
-
];
61
-
internet-aliases = map (from: { inherit from to; }) mails ++ [
62
-
];
63
-
64
-
# Catchall: redirect any unmatched @lassul.us mail
65
-
# This runs after internet_aliases (which handles the explicit list)
66
-
# and after system_aliases, but before local_user would reject unknown users.
67
-
extraRouters = ''
68
-
catchall_lassulus:
69
-
debug_print = "R: catchall for $local_part@$domain"
70
-
driver = redirect
71
-
domains = lassul.us
72
-
data = ${to}
73
-
no_more
74
-
'';
75
-
76
-
system-aliases = [
77
-
{
78
-
from = "mailer-daemon";
79
-
to = "postmaster";
80
-
}
81
-
{
82
-
from = "postmaster";
83
-
to = "root";
84
-
}
85
-
{
86
-
from = "nobody";
87
-
to = "root";
88
-
}
89
-
{
90
-
from = "hostmaster";
91
-
to = "root";
92
-
}
93
-
{
94
-
from = "usenet";
95
-
to = "root";
96
-
}
97
-
{
98
-
from = "news";
99
-
to = "root";
100
-
}
101
-
{
102
-
from = "webmaster";
103
-
to = "root";
104
-
}
105
-
{
106
-
from = "www";
107
-
to = "root";
108
-
}
109
-
{
110
-
from = "ftp";
111
-
to = "root";
112
-
}
113
-
{
114
-
from = "abuse";
115
-
to = "root";
116
-
}
117
-
{
118
-
from = "noc";
119
-
to = "root";
120
-
}
121
-
{
122
-
from = "security";
123
-
to = "root";
124
-
}
125
-
{
126
-
from = "root";
127
-
to = "lass";
128
-
}
129
-
];
130
-
};
131
-
# msmtp for local submission via SSH (connects to localhost:25)
132
-
environment.systemPackages = [ pkgs.msmtp ];
133
-
134
-
krebs.iptables.tables.filter.INPUT.rules = [
135
-
{
136
-
predicate = "-p tcp --dport smtp";
137
-
target = "ACCEPT";
138
-
}
139
-
];
140
-
141
-
security.acme.certs."mail.lassul.us" = {
142
-
group = "lasscert";
143
-
webroot = "/var/lib/acme/acme-challenge";
144
-
};
145
-
users.groups.lasscert.members = [
146
-
"dovecot2"
147
-
"exim"
148
-
"nginx"
149
-
];
150
-
}
-2
2configs/websites/lassulus.nix
-2
2configs/websites/lassulus.nix
-1
machines/aergia/config.nix
-1
machines/aergia/config.nix
-1
machines/coaxmetal/config.nix
-1
machines/coaxmetal/config.nix
-1
machines/icarus/config.nix
-1
machines/icarus/config.nix
-1
machines/mors/config.nix
-1
machines/mors/config.nix
-1
machines/prism/config.nix
-1
machines/prism/config.nix
-1
machines/styx/config.nix
-1
machines/styx/config.nix