From 315ceee1ae2a0bccbcc5ab61c59ad51b6ef97d89 Mon Sep 17 00:00:00 2001
From: Gonne <gonne@mathebau.de>
Date: Mon, 5 Feb 2024 21:36:51 +0100
Subject: [PATCH] Setze Mailman-Maschine auf

---
 nixos/machines/lobon/configuration.nix        | 21 ++++++
 .../machines/lobon/hardware-configuration.nix | 30 +++++++++
 nixos/modules/mailman.nix                     | 67 +++++++++++++++++++
 3 files changed, 118 insertions(+)
 create mode 100644 nixos/machines/lobon/configuration.nix
 create mode 100644 nixos/machines/lobon/hardware-configuration.nix
 create mode 100644 nixos/modules/mailman.nix

diff --git a/nixos/machines/lobon/configuration.nix b/nixos/machines/lobon/configuration.nix
new file mode 100644
index 0000000..553bfe4
--- /dev/null
+++ b/nixos/machines/lobon/configuration.nix
@@ -0,0 +1,21 @@
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules/mailman.nix
+    ../../roles
+    ../../roles/vm.nix
+    ../../modules/vmNetwork.nix
+  ];
+
+  # System configuration here
+
+  services.mathebau-mailman = {
+    enable = true;
+    hostName = "lists.mathebau.de";
+    siteOwner = "root@mathebau.de";
+  };
+
+  networking.hostName = "lobon";
+  vmNetwork.ipv4 = "192.168.0.22";
+  system.stateVersion = "23.11";
+}
diff --git a/nixos/machines/lobon/hardware-configuration.nix b/nixos/machines/lobon/hardware-configuration.nix
new file mode 100644
index 0000000..ce7112d
--- /dev/null
+++ b/nixos/machines/lobon/hardware-configuration.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  pkgs,
+  ...
+}: {
+  imports = [];
+
+  fileSystems."/" = {
+    device = "root";
+    fsType = "tmpfs";
+    options = ["size=1G" "mode=755"];
+  };
+  fileSystems."/persist" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "btrfs";
+    options = ["subvol=persist"];
+    neededForBoot = true;
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "ext4";
+  };
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "btrfs";
+    options = ["subvol=nix"];
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}
diff --git a/nixos/modules/mailman.nix b/nixos/modules/mailman.nix
new file mode 100644
index 0000000..e4265a9
--- /dev/null
+++ b/nixos/modules/mailman.nix
@@ -0,0 +1,67 @@
+# Adapted and simplified from https://nixos.wiki/wiki/Mailman
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit
+    (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    ;
+  inherit (lib.types) nonEmptyStr;
+  cfg = config.services.mathebau-mailman;
+in {
+  options.services.mathebau-mailman = {
+    enable = mkEnableOption "mathebau mailman service";
+    hostName = mkOption {
+      type = nonEmptyStr;
+    };
+    siteOwner = mkOption {
+      type = nonEmptyStr;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services = {
+      postfix = {
+        enable = true;
+        relayDomains = ["hash:/var/lib/mailman/data/postfix_domains"];
+        sslCert = config.security.acme.certs.${cfg.hostName}.directory + "/full.pem";
+        sslKey = config.security.acme.certs.${cfg.hostName}.directory + "/key.pem";
+        config = {
+          transport_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"];
+          local_recipient_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"];
+          proxy_interfaces = "130.83.2.184";
+          smtputf8_enable = "no"; # HRZ does not know SMTPUTF8
+        };
+        relayHost = "mailout.hrz.tu-darmstadt.de"; # Relay to HRZ
+      };
+      mailman = {
+        enable = true;
+        inherit (cfg) siteOwner;
+        hyperkitty.enable = true;
+        webHosts = [cfg.hostName];
+        serve.enable = true; #
+      };
+      nginx.virtualHosts.${cfg.hostName} = {
+        enableACME = true;
+        forceSSL = false;
+      };
+    };
+
+    environment.persistence.${config.impermanence.name} = {
+      directories = [
+        "/var/lib/acme" # Persist TLS keys and account
+        "/var/lib/mailman"
+        "/var/lib/mailman-web"
+      ];
+    };
+
+    security.acme.defaults.email = cfg.siteOwner;
+    security.acme.acceptTerms = true;
+
+    networking.firewall.allowedTCPPorts = [25 80 443];
+  };
+}