diff options
| -rw-r--r-- | flake.lock | 106 | ||||
| -rw-r--r-- | flake.nix | 6 | ||||
| -rw-r--r-- | machines/109-199-104-83/configuration.nix | 45 | ||||
| -rw-r--r-- | pub-keys.nix | 1 | ||||
| -rw-r--r-- | secrets/secret3.age | 9 | ||||
| -rw-r--r-- | secrets/secrets.nix | 1 |
6 files changed, 167 insertions, 1 deletions
@@ -91,6 +91,22 @@ "type": "github" } }, + "blobs": { + "flake": false, + "locked": { + "lastModified": 1604995301, + "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=", + "owner": "simple-nixos-mailserver", + "repo": "blobs", + "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265", + "type": "gitlab" + }, + "original": { + "owner": "simple-nixos-mailserver", + "repo": "blobs", + "type": "gitlab" + } + }, "darwin": { "inputs": { "nixpkgs": [ @@ -132,6 +148,22 @@ "flake-compat": { "flake": false, "locked": { + "lastModified": 1761588595, + "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_2": { + "flake": false, + "locked": { "lastModified": 1751685974, "narHash": "sha256-NKw96t+BgHIYzHUjkTK95FqYRVKB8DHpVhefWSz/kTw=", "ref": "refs/heads/main", @@ -224,6 +256,54 @@ "type": "github" } }, + "git-hooks": { + "inputs": { + "flake-compat": [ + "nixos-mailserver", + "flake-compat" + ], + "gitignore": "gitignore", + "nixpkgs": [ + "nixos-mailserver", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1763988335, + "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=", + "owner": "cachix", + "repo": "git-hooks.nix", + "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "git-hooks.nix", + "type": "github" + } + }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "nixos-mailserver", + "git-hooks", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, "gnome-shell": { "flake": false, "locked": { @@ -332,6 +412,29 @@ "type": "github" } }, + "nixos-mailserver": { + "inputs": { + "blobs": "blobs", + "flake-compat": "flake-compat", + "git-hooks": "git-hooks", + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1766321686, + "narHash": "sha256-icOWbnD977HXhveirqA10zoqvErczVs3NKx8Bj+ikHY=", + "owner": "simple-nixos-mailserver", + "repo": "nixos-mailserver", + "rev": "7d433bf89882f61621f95082e90a4ab91eb0bdd3", + "type": "gitlab" + }, + "original": { + "owner": "simple-nixos-mailserver", + "repo": "nixos-mailserver", + "type": "gitlab" + } + }, "nixpkgs": { "locked": { "lastModified": 1766651565, @@ -432,7 +535,7 @@ }, "nvf": { "inputs": { - "flake-compat": "flake-compat", + "flake-compat": "flake-compat_2", "flake-parts": "flake-parts_2", "mnw": "mnw", "ndg": "ndg", @@ -480,6 +583,7 @@ "agenix": "agenix", "home-manager": "home-manager_2", "impermanence": "impermanence", + "nixos-mailserver": "nixos-mailserver", "nixpkgs": "nixpkgs", "noshell": "noshell", "nur": "nur", @@ -9,6 +9,10 @@ inputs.nixpkgs.follows = "nixpkgs"; }; impermanence.url = "github:nix-community/impermanence"; + nixos-mailserver = { + url = "gitlab:simple-nixos-mailserver/nixos-mailserver"; + inputs.nixpkgs.follows = "nixpkgs"; + }; nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; noshell = { url = "github:viperML/noshell"; @@ -35,6 +39,7 @@ agenix, home-manager, impermanence, + nixos-mailserver, nixpkgs, noshell, nur, @@ -56,6 +61,7 @@ ./secrets.nix impermanence.nixosModules.impermanence agenix.nixosModules.default + nixos-mailserver.nixosModule phoenix.nixosModules.default ]; }; diff --git a/machines/109-199-104-83/configuration.nix b/machines/109-199-104-83/configuration.nix index 32f9ffa..2699370 100644 --- a/machines/109-199-104-83/configuration.nix +++ b/machines/109-199-104-83/configuration.nix @@ -4,6 +4,46 @@ machine, ... }: { + # roundcube config + services.roundcube = { + enable = true; + hostName = "webmail.${config.networking.domain}"; + extraConfig = '' + $config['imap_host'] = "ssl://${config.mailserver.fqdn}"; + $config['smtp_host'] = "ssl://${config.mailserver.fqdn}"; + $config['smtp_user'] = "%u"; + $config['smtp_pass'] = "%p"; + ''; + }; + + # mailserver config + mailserver = { + enable = true; + stateVersion = 3; + fqdn = "mail.${config.networking.domain}"; + domains = ["${config.networking.domain}"]; + x509.useACMEHost = config.mailserver.fqdn; + loginAccounts = { + "test@${config.networking.domain}" = { + hashedPasswordFile = builtins.toString config.age.secrets.secret3.path; + }; + }; + }; + + # cert config + security.acme = { + acceptTerms = true; + defaults.email = "mtgmonket@gmail.com"; + }; + services.nginx = { + enable = true; + virtualHosts."mail.${config.networking.domain}" = { + forceSSL = true; + enableACME = true; + }; + }; + + # system config system.stateVersion = "25.11"; nix.settings.experimental-features = ["flakes" "nix-command"]; imports = [(modulesPath + "/profiles/qemu-guest.nix")]; @@ -22,6 +62,11 @@ usePredictableInterfaceNames = true; hostName = machine.hostname; domain = "galaxious.de"; + firewall = { + enable = true; + allowedTCPPorts = [80 443]; + allowedUDPPorts = [80 443]; + }; }; systemd.network = { enable = true; diff --git a/pub-keys.nix b/pub-keys.nix index 389786b..8bf4995 100644 --- a/pub-keys.nix +++ b/pub-keys.nix @@ -3,6 +3,7 @@ secret0.file = ./secrets/secret0.age; secret1.file = ./secrets/secret1.age; secret2.file = ./secrets/secret2.age; + secret3.file = ./secrets/secret3.age; }; pub-keys = { ssh = { diff --git a/secrets/secret3.age b/secrets/secret3.age new file mode 100644 index 0000000..c38cb97 --- /dev/null +++ b/secrets/secret3.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 mT2fyg slLOkD/9TAYOuZ/g5U4NvPWUlmYZeie12xzggioviw0 +E0uAj4RMgv7DTJpvtEO54G9XHNLFOgFflR54Cl6/X8g +-> ssh-ed25519 UHxfvA xHFujOdegur0PLNHZP+h5RxHhVD2K906NZx7nprMkUs +PdDxzD5QBdE/yWPMnF+CDGROEpE4nYvg12v1G3QK9XI +-> ssh-ed25519 Xoin5w YWsO9HtEFB79+aKr6eWi5Sg5geKfzT+IrDy2L5qEmx4 +sXLRmcRDyAv64nSGs8QXcHmKYO+F11Pzea1EVGmpEys +--- Sjg8SqkkEEL4X0G1GOUoHO702ZtrM0hMniIdS7yIsDA +'B(7Dϓ=hh fɮxT!K. ~س,ߓD|+p"tGyQRcPQ Q
Ս=qiא<c%~Ԃ#
\ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 309c6ac..285a1ab 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -7,4 +7,5 @@ in { "secret0.age".publicKeys = [andromeda lenovo]; "secret1.age".publicKeys = [andromeda lenovo]; "secret2.age".publicKeys = [andromeda lenovo _109-199-104-83]; + "secret3.age".publicKeys = [andromeda lenovo _109-199-104-83]; } |