Fachschaft/nixConfig
6
2
Fork 2
Code Issues 10 Pull requests 1 Projects Wiki Activity

Mailman backups

Browse source
This commit is contained in:
Gonne 2024-03-31 20:28:40 +02:00 • committed by Gonne
parent b9b7a1fa58
commit b50d7d0e6a
4 changed files with 82 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nixos/modules/mailman.nix
View file

@ -37,7 +37,7 @@ in {
proxy_interfaces = "130.83.2.184";
smtputf8_enable = "no"; # HRZ does not know SMTPUTF8
};
relayHost = "mailout.hrz.tu-darmstadt.de"; # Relay to HRZ (see https://www.hrz.tu-darmstadt.de/services/it_services/email_infrastruktur/index.de.jsp)
relayHost = "192.168.0.24"; # Relay to eihort which relays to HRZ (see https://www.hrz.tu-darmstadt.de/services/it_services/email_infrastruktur/index.de.jsp)
};
mailman = {
enable = true;
@ -60,6 +60,7 @@ in {
"/var/lib/mailman"
"/var/lib/mailman-web"
];
files = ["/root/.ssh/known_hosts"]; # for the backup server bragi
};
security.acme.defaults.email = cfg.siteOwner;
@ -95,11 +96,25 @@ in {
PrivateTmp = true;
};
};
sops.secrets.allowlistPass = {
sopsFile = ../machines/lobon/allowlistPass.yaml;
owner = "mailman";
group = "mailman";
mode = "0400";
# Backups
services.borgbackup.jobs.mailman = {
paths = [
"/var/lib/mailman/data"
"/var/lib/mailman-web"
];
encryption.mode = "none"; # Otherwise the key is next to the backup or we have human interaction.
environment = {
BORG_RSH = "ssh -i /run/secrets/backupKey";
# “Borg ensures that backups are not created on random drives that ‘just happen’ to contain a Borg repository.”
# https://borgbackup.readthedocs.io/en/stable/deployment/automated-local.html
# We don't want this in order to not need to persist borg cache and simplify new deployments.
BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes";
};
repo = "borg@192.168.1.11:lobon"; # TODO for https://gitea.mathebau.de/Fachschaft/nixConfig/issues/33
startAt = "daily";
user = "root";
group = "root";
};
};
}