From e665bb0b1488bfa2d5e75f11354d0c7b02d76d36 Mon Sep 17 00:00:00 2001 From: andromeda Date: Fri, 2 Jan 2026 18:05:01 +0100 Subject: attempt mailserver? --- machines/109-199-104-83/configuration.nix | 78 +++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) (limited to 'machines/109-199-104-83') diff --git a/machines/109-199-104-83/configuration.nix b/machines/109-199-104-83/configuration.nix index 32f9ffa..f5ff048 100644 --- a/machines/109-199-104-83/configuration.nix +++ b/machines/109-199-104-83/configuration.nix @@ -2,8 +2,86 @@ config, modulesPath, machine, + pkgs, ... }: { + # mailserver config + mailserver = { + enable = true; + stateVersion = 3; + fqdn = "mail.galaxious.de"; + domains = ["galaxious.de"]; + x509.useACMEHost = config.mailserver.fqdn; + loginAccounts = { + "test@galaxious.de" = { + hashedPasswordFile = builtins.toString config.age.secrets.secret3.path; + }; + }; + }; + + # wildcard cert config + # systemctl start galaxious.de.service & journalctl -fu acme-galaxious.de.service + security.acme = { + acceptTerms = true; + defaults.email = "security@example.com"; + certs."mail.galaxious.de" = { + domain = "mail.galaxious.de"; + dnsProvider = "rfc2136"; + environmentFile = "/var/lib/secrets/certs.secret"; + dnsPropagationCheck = false; + }; + }; + services.bind = { + enable = true; + extraConfig = '' + include "/var/lib/secrets/dnskeys.conf"; + ''; + zones = [ + rec { + name = "galaxious.de"; + file = "/var/db/bind/${name}"; + master = true; + extraConfig = "allow-update { key rfc2136key.galaxious.de; };"; + } + ]; + }; + systemd.services.dns-rfc2136-conf = { + requiredBy = [ + "acme-galaxious.de.service" + "bind.service" + ]; + before = [ + "acme-galaxious.de.service" + "bind.service" + ]; + unitConfig = { + ConditionPathExists = "!/var/lib/secrets/dnskeys.conf"; + }; + serviceConfig = { + Type = "oneshot"; + UMask = 77; + }; + path = [pkgs.bind]; + script = '' + mkdir -p /var/lib/secrets + chmod 755 /var/lib/secrets + tsig-keygen rfc2136key.galaxious.de > /var/lib/secrets/dnskeys.conf + chown named:root /var/lib/secrets/dnskeys.conf + chmod 400 /var/lib/secrets/dnskeys.conf + + # extract secret value from the dnskeys.conf + while read x y; do if [ "$x" = "secret" ]; then secret="''${y:1:''${#y}-3}"; fi; done < /var/lib/secrets/dnskeys.conf + + cat > /var/lib/secrets/certs.secret << EOF + RFC2136_NAMESERVER='127.0.0.1:53' + RFC2136_TSIG_ALGORITHM='hmac-sha256.' + RFC2136_TSIG_KEY='rfc2136key.galaxious.de' + RFC2136_TSIG_SECRET='$secret' + EOF + chmod 400 /var/lib/secrets/certs.secret + ''; + }; + system.stateVersion = "25.11"; nix.settings.experimental-features = ["flakes" "nix-command"]; imports = [(modulesPath + "/profiles/qemu-guest.nix")]; -- cgit v1.3 From 52a906919ddca7f55f9181691739b1c2b671e538 Mon Sep 17 00:00:00 2001 From: andromeda Date: Fri, 2 Jan 2026 18:24:00 +0100 Subject: change cert email to a real email :'( --- machines/109-199-104-83/configuration.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'machines/109-199-104-83') diff --git a/machines/109-199-104-83/configuration.nix b/machines/109-199-104-83/configuration.nix index f5ff048..f8484f5 100644 --- a/machines/109-199-104-83/configuration.nix +++ b/machines/109-199-104-83/configuration.nix @@ -19,11 +19,11 @@ }; }; - # wildcard cert config + # cert config # systemctl start galaxious.de.service & journalctl -fu acme-galaxious.de.service security.acme = { acceptTerms = true; - defaults.email = "security@example.com"; + defaults.email = "mtgmonket@gmail.com"; certs."mail.galaxious.de" = { domain = "mail.galaxious.de"; dnsProvider = "rfc2136"; -- cgit v1.3 From 6db05df6a78dcfc9e82113fdc217ac176ba295df Mon Sep 17 00:00:00 2001 From: andromeda Date: Fri, 2 Jan 2026 18:37:27 +0100 Subject: add firewall xD --- machines/109-199-104-83/configuration.nix | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'machines/109-199-104-83') diff --git a/machines/109-199-104-83/configuration.nix b/machines/109-199-104-83/configuration.nix index f8484f5..7e170ee 100644 --- a/machines/109-199-104-83/configuration.nix +++ b/machines/109-199-104-83/configuration.nix @@ -100,6 +100,11 @@ usePredictableInterfaceNames = true; hostName = machine.hostname; domain = "galaxious.de"; + firewall = { + enable = true; + allowedTCPPorts = [80 443]; + allowedUDPPorts = [80 443]; + }; }; systemd.network = { enable = true; -- cgit v1.3 From 5366c48991c9059883dae4adcd4e6ed6a399f3ca Mon Sep 17 00:00:00 2001 From: andromeda Date: Fri, 2 Jan 2026 20:21:46 +0100 Subject: use nginx for acme --- machines/109-199-104-83/configuration.nix | 68 ++++--------------------------- 1 file changed, 9 insertions(+), 59 deletions(-) (limited to 'machines/109-199-104-83') diff --git a/machines/109-199-104-83/configuration.nix b/machines/109-199-104-83/configuration.nix index 7e170ee..1ec2aa7 100644 --- a/machines/109-199-104-83/configuration.nix +++ b/machines/109-199-104-83/configuration.nix @@ -2,86 +2,36 @@ config, modulesPath, machine, - pkgs, ... -}: { +}: rec { # mailserver config mailserver = { enable = true; stateVersion = 3; - fqdn = "mail.galaxious.de"; - domains = ["galaxious.de"]; + fqdn = "mail.${networking.domain}"; + domains = ["${networking.domain}"]; x509.useACMEHost = config.mailserver.fqdn; loginAccounts = { - "test@galaxious.de" = { + "test@${networking.domain}" = { hashedPasswordFile = builtins.toString config.age.secrets.secret3.path; }; }; }; # cert config - # systemctl start galaxious.de.service & journalctl -fu acme-galaxious.de.service security.acme = { acceptTerms = true; defaults.email = "mtgmonket@gmail.com"; - certs."mail.galaxious.de" = { - domain = "mail.galaxious.de"; - dnsProvider = "rfc2136"; - environmentFile = "/var/lib/secrets/certs.secret"; - dnsPropagationCheck = false; - }; }; - services.bind = { + services.nginx = { enable = true; - extraConfig = '' - include "/var/lib/secrets/dnskeys.conf"; - ''; - zones = [ - rec { - name = "galaxious.de"; - file = "/var/db/bind/${name}"; - master = true; - extraConfig = "allow-update { key rfc2136key.galaxious.de; };"; - } - ]; - }; - systemd.services.dns-rfc2136-conf = { - requiredBy = [ - "acme-galaxious.de.service" - "bind.service" - ]; - before = [ - "acme-galaxious.de.service" - "bind.service" - ]; - unitConfig = { - ConditionPathExists = "!/var/lib/secrets/dnskeys.conf"; - }; - serviceConfig = { - Type = "oneshot"; - UMask = 77; + virtualHosts."mail.${networking.domain}" = { + forceSSL = true; + enableACME = true; }; - path = [pkgs.bind]; - script = '' - mkdir -p /var/lib/secrets - chmod 755 /var/lib/secrets - tsig-keygen rfc2136key.galaxious.de > /var/lib/secrets/dnskeys.conf - chown named:root /var/lib/secrets/dnskeys.conf - chmod 400 /var/lib/secrets/dnskeys.conf - - # extract secret value from the dnskeys.conf - while read x y; do if [ "$x" = "secret" ]; then secret="''${y:1:''${#y}-3}"; fi; done < /var/lib/secrets/dnskeys.conf - - cat > /var/lib/secrets/certs.secret << EOF - RFC2136_NAMESERVER='127.0.0.1:53' - RFC2136_TSIG_ALGORITHM='hmac-sha256.' - RFC2136_TSIG_KEY='rfc2136key.galaxious.de' - RFC2136_TSIG_SECRET='$secret' - EOF - chmod 400 /var/lib/secrets/certs.secret - ''; }; + # system config system.stateVersion = "25.11"; nix.settings.experimental-features = ["flakes" "nix-command"]; imports = [(modulesPath + "/profiles/qemu-guest.nix")]; -- cgit v1.3 From c632cd20c62d3fc4de58a1b9efc4c89fad52a9d5 Mon Sep 17 00:00:00 2001 From: andromeda Date: Fri, 2 Jan 2026 20:33:21 +0100 Subject: roundcube? --- machines/109-199-104-83/configuration.nix | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) (limited to 'machines/109-199-104-83') diff --git a/machines/109-199-104-83/configuration.nix b/machines/109-199-104-83/configuration.nix index 1ec2aa7..2699370 100644 --- a/machines/109-199-104-83/configuration.nix +++ b/machines/109-199-104-83/configuration.nix @@ -3,16 +3,28 @@ modulesPath, machine, ... -}: rec { +}: { + # roundcube config + services.roundcube = { + enable = true; + hostName = "webmail.${config.networking.domain}"; + extraConfig = '' + $config['imap_host'] = "ssl://${config.mailserver.fqdn}"; + $config['smtp_host'] = "ssl://${config.mailserver.fqdn}"; + $config['smtp_user'] = "%u"; + $config['smtp_pass'] = "%p"; + ''; + }; + # mailserver config mailserver = { enable = true; stateVersion = 3; - fqdn = "mail.${networking.domain}"; - domains = ["${networking.domain}"]; + fqdn = "mail.${config.networking.domain}"; + domains = ["${config.networking.domain}"]; x509.useACMEHost = config.mailserver.fqdn; loginAccounts = { - "test@${networking.domain}" = { + "test@${config.networking.domain}" = { hashedPasswordFile = builtins.toString config.age.secrets.secret3.path; }; }; @@ -25,7 +37,7 @@ }; services.nginx = { enable = true; - virtualHosts."mail.${networking.domain}" = { + virtualHosts."mail.${config.networking.domain}" = { forceSSL = true; enableACME = true; }; -- cgit v1.3