From 1bd62a3d9fab23c0bec51809ef1d8543f12754ff Mon Sep 17 00:00:00 2001 From: Gonne Date: Mon, 5 Feb 2024 21:36:51 +0100 Subject: [PATCH 1/4] Setze Mailman-Maschine auf --- nixos/machines/lobon/configuration.nix | 20 ++++++ .../machines/lobon/hardware-configuration.nix | 30 +++++++++ nixos/machines/lobon/network.nix | 16 +++++ nixos/modules/mailman.nix | 67 +++++++++++++++++++ 4 files changed, 133 insertions(+) create mode 100644 nixos/machines/lobon/configuration.nix create mode 100644 nixos/machines/lobon/hardware-configuration.nix create mode 100644 nixos/machines/lobon/network.nix create mode 100644 nixos/modules/mailman.nix diff --git a/nixos/machines/lobon/configuration.nix b/nixos/machines/lobon/configuration.nix new file mode 100644 index 0000000..8c5252c --- /dev/null +++ b/nixos/machines/lobon/configuration.nix @@ -0,0 +1,20 @@ +{ + imports = [ + ./hardware-configuration.nix + ../../modules/mailman.nix + ../../roles + ../../roles/vm.nix + ./network.nix + ]; + + # System configuration here + + services.mathebau-mailman = { + enable = true; + hostName = "lists.mathebau.de"; + siteOwner = "root@mathebau.de"; + }; + + networking.hostName = "lobon"; + system.stateVersion = "23.11"; +} diff --git a/nixos/machines/lobon/hardware-configuration.nix b/nixos/machines/lobon/hardware-configuration.nix new file mode 100644 index 0000000..af20597 --- /dev/null +++ b/nixos/machines/lobon/hardware-configuration.nix @@ -0,0 +1,30 @@ +{ + lib, + pkgs, + ... +}: { + imports = []; + + fileSystems."/" = { + device = "root"; + fsType = "tmpfs"; + options = ["size=512M" "mode=755"]; + }; + fileSystems."/persist" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=persist"]; + neededForBoot = true; + }; + fileSystems."/boot" = { + device = "/dev/disk/by-label/boot"; + fsType = "ext4"; + }; + fileSystems."/nix" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=nix"]; + }; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/nixos/machines/lobon/network.nix b/nixos/machines/lobon/network.nix new file mode 100644 index 0000000..23ad3e8 --- /dev/null +++ b/nixos/machines/lobon/network.nix @@ -0,0 +1,16 @@ +# We sohuld put that config somewhere in roles and give it a parameter or something, +# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways +# depend on the same thing +{ + imports = []; + networking = { + interfaces.enX0.ipv4.addresses = [ + { + address = "192.168.0.22"; + prefixLength = 16; + } + ]; + defaultGateway = "192.168.0.149"; + nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; + }; +} diff --git a/nixos/modules/mailman.nix b/nixos/modules/mailman.nix new file mode 100644 index 0000000..7241703 --- /dev/null +++ b/nixos/modules/mailman.nix @@ -0,0 +1,67 @@ +# Adapted and simplified from https://nixos.wiki/wiki/Mailman +{ + config, + lib, + ... +}: let + inherit + (lib) + mkIf + mkEnableOption + mkOption + ; + inherit (lib.types) str; + cfg = config.services.mathebau-mailman; +in { + options.services.mathebau-mailman = { + enable = mkEnableOption "mathebau mailman service"; + hostName = mkOption { + type = str; + }; + siteOwner = mkOption { + type = str; + }; + }; + + config = mkIf cfg.enable { + services = { + postfix = { + enable = true; + relayDomains = ["hash:/var/lib/mailman/data/postfix_domains"]; + sslCert = config.security.acme.certs.${cfg.hostName}.directory + "/full.pem"; + sslKey = config.security.acme.certs.${cfg.hostName}.directory + "/key.pem"; + config = { + transport_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"]; + local_recipient_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"]; + proxy_interfaces = "130.83.2.184"; + smtputf8_enable = "no"; # HRZ does not know SMTPUTF8 + }; + relayHost = "mailout.hrz.tu-darmstadt.de"; # Relay to HRZ + }; + mailman = { + enable = true; + inherit (cfg) siteOwner; + hyperkitty.enable = true; + webHosts = [cfg.hostName]; + serve.enable = true; # + }; + nginx.virtualHosts.${cfg.hostName} = { + enableACME = true; + forceSSL = false; + }; + }; + + environment.persistence.${config.impermanence.name} = { + directories = [ + "/var/lib/acme" # Persist TLS keys and account + "/var/lib/mailman" + "/var/lib/mailman-web" + ]; + }; + + security.acme.defaults.email = cfg.siteOwner; + security.acme.acceptTerms = true; + + networking.firewall.allowedTCPPorts = [25 80 443]; + }; +} From b8f993d71cf98b2b08ae767281be0e9b3223cda8 Mon Sep 17 00:00:00 2001 From: Gonne Date: Thu, 1 Feb 2024 21:00:43 +0100 Subject: [PATCH 2/4] nix flake update --- flake.lock | 94 +++++++++++++++++++++++++++--------------------------- 1 file changed, 47 insertions(+), 47 deletions(-) diff --git a/flake.lock b/flake.lock index 8128842..2237126 100644 --- a/flake.lock +++ b/flake.lock @@ -21,11 +21,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1704152458, - "narHash": "sha256-DS+dGw7SKygIWf9w4eNBUZsK+4Ug27NwEWmn2tnbycg=", + "lastModified": 1706830856, + "narHash": "sha256-a0NYyp+h9hlb7ddVz4LUn1vT/PLwqfrWYcHMvFB1xYg=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "88a2cd8166694ba0b6cb374700799cec53aef527", + "rev": "b253292d9c0a5ead9bc98c4e9a26c6312e27d69f", "type": "github" }, "original": { @@ -38,11 +38,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1685518550, - "narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=", + "lastModified": 1701680307, + "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=", "owner": "numtide", "repo": "flake-utils", - "rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef", + "rev": "4022d587cbbfd70fe950c1e2083a02621806a725", "type": "github" }, "original": { @@ -53,11 +53,11 @@ }, "impermanence": { "locked": { - "lastModified": 1703656108, - "narHash": "sha256-hCSUqdFJKHHbER8Cenf5JRzjMlBjIdwdftGQsO0xoJs=", + "lastModified": 1706639736, + "narHash": "sha256-CaG4j9+UwBDfinxxvJMo6yOonSmSo0ZgnbD7aj2Put0=", "owner": "nix-community", "repo": "impermanence", - "rev": "033643a45a4a920660ef91caa391fbffb14da466", + "rev": "cd13c2917eaa68e4c49fea0ff9cada45440d7045", "type": "github" }, "original": { @@ -71,16 +71,16 @@ "blobs": "blobs", "flake-compat": [], "nixpkgs": [], - "nixpkgs-22_11": "nixpkgs-22_11", "nixpkgs-23_05": "nixpkgs-23_05", + "nixpkgs-23_11": "nixpkgs-23_11", "utils": "utils" }, "locked": { - "lastModified": 1703666786, - "narHash": "sha256-SLPNpM/rI8XPyVJAxMYAe+n6NiYSpuXvdwPILHP4yZI=", + "lastModified": 1706742486, + "narHash": "sha256-sv/MISTeD0rqeVivpZJpynboMWJp6i62OmrZX1rGl38=", "ref": "refs/heads/master", - "rev": "b5023b36a1f6628865cb42b4353bd2ddde0ea9f4", - "revCount": 575, + "rev": "9e36323ae3dde787f761420465c3ae560f3dbf29", + "revCount": 577, "type": "git", "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git" }, @@ -91,11 +91,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1703961334, - "narHash": "sha256-M1mV/Cq+pgjk0rt6VxoyyD+O8cOUiai8t9Q6Yyq4noY=", + "lastModified": 1707092692, + "narHash": "sha256-ZbHsm+mGk/izkWtT4xwwqz38fdlwu7nUUKXTOmm4SyE=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "b0d36bd0a420ecee3bc916c91886caca87c894e9", + "rev": "faf912b086576fd1a15fca610166c98d47bc667e", "type": "github" }, "original": { @@ -105,28 +105,13 @@ "type": "github" } }, - "nixpkgs-22_11": { - "locked": { - "lastModified": 1669558522, - "narHash": "sha256-yqxn+wOiPqe6cxzOo4leeJOp1bXE/fjPEi/3F/bBHv8=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "ce5fe99df1f15a09a91a86be9738d68fadfbad82", - "type": "github" - }, - "original": { - "id": "nixpkgs", - "ref": "nixos-22.11", - "type": "indirect" - } - }, "nixpkgs-23_05": { "locked": { - "lastModified": 1684782344, - "narHash": "sha256-SHN8hPYYSX0thDrMLMWPWYulK3YFgASOrCsIL3AJ78g=", + "lastModified": 1704290814, + "narHash": "sha256-LWvKHp7kGxk/GEtlrGYV68qIvPHkU9iToomNFGagixU=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "8966c43feba2c701ed624302b6a935f97bcbdf88", + "rev": "70bdadeb94ffc8806c0570eb5c2695ad29f0e421", "type": "github" }, "original": { @@ -135,14 +120,29 @@ "type": "indirect" } }, + "nixpkgs-23_11": { + "locked": { + "lastModified": 1706098335, + "narHash": "sha256-r3dWjT8P9/Ah5m5ul4WqIWD8muj5F+/gbCdjiNVBKmU=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "a77ab169a83a4175169d78684ddd2e54486ac651", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "ref": "nixos-23.11", + "type": "indirect" + } + }, "nixpkgs-lib": { "locked": { "dir": "lib", - "lastModified": 1703961334, - "narHash": "sha256-M1mV/Cq+pgjk0rt6VxoyyD+O8cOUiai8t9Q6Yyq4noY=", + "lastModified": 1706550542, + "narHash": "sha256-UcsnCG6wx++23yeER4Hg18CXWbgNpqNXcHIo5/1Y+hc=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "b0d36bd0a420ecee3bc916c91886caca87c894e9", + "rev": "97b17f32362e475016f942bbdfda4a4a72a8a652", "type": "github" }, "original": { @@ -155,11 +155,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1703950681, - "narHash": "sha256-veU5bE4eLOmi7aOzhE7LfZXcSOONRMay0BKv01WHojo=", + "lastModified": 1705957679, + "narHash": "sha256-Q8LJaVZGJ9wo33wBafvZSzapYsjOaNjP/pOnSiKVGHY=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "0aad9113182747452dbfc68b93c86e168811fa6c", + "rev": "9a333eaa80901efe01df07eade2c16d183761fa3", "type": "github" }, "original": { @@ -178,11 +178,11 @@ "nixpkgs-stable": [] }, "locked": { - "lastModified": 1703939133, - "narHash": "sha256-Gxe+mfOT6bL7wLC/tuT2F+V+Sb44jNr8YsJ3cyIl4Mo=", + "lastModified": 1706424699, + "narHash": "sha256-Q3RBuOpZNH2eFA1e+IHgZLAOqDD9SKhJ/sszrL8bQD4=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "9d3d7e18c6bc4473d7520200d4ddab12f8402d38", + "rev": "7c54e08a689b53c8a1e5d70169f2ec9e2a68ffaf", "type": "github" }, "original": { @@ -209,11 +209,11 @@ "nixpkgs-stable": "nixpkgs-stable" }, "locked": { - "lastModified": 1703991717, - "narHash": "sha256-XfBg2dmDJXPQEB8EdNBnzybvnhswaiAkUeeDj7fa/hQ=", + "lastModified": 1707015547, + "narHash": "sha256-YZr0OrqWPdbwBhxpBu69D32ngJZw8AMgZtJeaJn0e94=", "owner": "Mic92", "repo": "sops-nix", - "rev": "cfdbaf68d00bc2f9e071f17ae77be4b27ff72fa6", + "rev": "23f61b897c00b66855074db471ba016e0cda20dd", "type": "github" }, "original": { From 38a2c46575105a1ce6ea4a57d30029602fb9aba0 Mon Sep 17 00:00:00 2001 From: Gonne Date: Thu, 21 Mar 2024 16:58:39 +0100 Subject: [PATCH 3/4] Fix YAML-Format and add Gonne's keys --- .sops.yaml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.sops.yaml b/.sops.yaml index 825333b..6d555cf 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,16 +1,26 @@ keys: - &nerf age1rasjnr2tlv9y70sj0z0hwpgpxdc974wzg5umtx2pnc6z0p05u3js6r8sln + - &gonne age1xv5rfxkxg9jyqx5jg2j82cxv7w7ep4a3795p4yl5fuqf38f3m3eqfnefju - &nyarlathotep age1s99d0vlj5qlm287n98jratql5fypvjrxxal0k5jl2aw9dcc8kyvqw5yyt4 + - &bragi age1lqvgpmlemyg9095ujck64u59ma29656zs7a4yxgz4s6u5cld2ccss69jwe creation_rules: - - path_regex nixos/machines/nyarlathotep/.* + - path_regex: nixos/machines/nyarlathotep/.* key_groups: - age: - *nerf - *nyarlathotep + - *nerf + - *gonne + - *nyarlathotep + - path_regex: nixos/machines/bragi/.* + key_groups: + - age: + - *nerf + - *gonne + - *bragi # this is the catchall clause if nothing above machtes. Encrypt to users but not # to machines - key_groups: - age: - *nerf + - *nerf + - *gonne From 1b8909b6b4200c7bdb14a94d291996bb105a4159 Mon Sep 17 00:00:00 2001 From: Gonne Date: Mon, 5 Feb 2024 21:36:51 +0100 Subject: [PATCH 4/4] Setze Mailman-Maschine auf --- nixos/machines/lobon/configuration.nix | 20 ++++++ .../machines/lobon/hardware-configuration.nix | 30 +++++++++ nixos/machines/lobon/network.nix | 16 +++++ nixos/modules/mailman.nix | 67 +++++++++++++++++++ 4 files changed, 133 insertions(+) create mode 100644 nixos/machines/lobon/configuration.nix create mode 100644 nixos/machines/lobon/hardware-configuration.nix create mode 100644 nixos/machines/lobon/network.nix create mode 100644 nixos/modules/mailman.nix diff --git a/nixos/machines/lobon/configuration.nix b/nixos/machines/lobon/configuration.nix new file mode 100644 index 0000000..8c5252c --- /dev/null +++ b/nixos/machines/lobon/configuration.nix @@ -0,0 +1,20 @@ +{ + imports = [ + ./hardware-configuration.nix + ../../modules/mailman.nix + ../../roles + ../../roles/vm.nix + ./network.nix + ]; + + # System configuration here + + services.mathebau-mailman = { + enable = true; + hostName = "lists.mathebau.de"; + siteOwner = "root@mathebau.de"; + }; + + networking.hostName = "lobon"; + system.stateVersion = "23.11"; +} diff --git a/nixos/machines/lobon/hardware-configuration.nix b/nixos/machines/lobon/hardware-configuration.nix new file mode 100644 index 0000000..af20597 --- /dev/null +++ b/nixos/machines/lobon/hardware-configuration.nix @@ -0,0 +1,30 @@ +{ + lib, + pkgs, + ... +}: { + imports = []; + + fileSystems."/" = { + device = "root"; + fsType = "tmpfs"; + options = ["size=512M" "mode=755"]; + }; + fileSystems."/persist" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=persist"]; + neededForBoot = true; + }; + fileSystems."/boot" = { + device = "/dev/disk/by-label/boot"; + fsType = "ext4"; + }; + fileSystems."/nix" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=nix"]; + }; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/nixos/machines/lobon/network.nix b/nixos/machines/lobon/network.nix new file mode 100644 index 0000000..23ad3e8 --- /dev/null +++ b/nixos/machines/lobon/network.nix @@ -0,0 +1,16 @@ +# We sohuld put that config somewhere in roles and give it a parameter or something, +# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways +# depend on the same thing +{ + imports = []; + networking = { + interfaces.enX0.ipv4.addresses = [ + { + address = "192.168.0.22"; + prefixLength = 16; + } + ]; + defaultGateway = "192.168.0.149"; + nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; + }; +} diff --git a/nixos/modules/mailman.nix b/nixos/modules/mailman.nix new file mode 100644 index 0000000..7241703 --- /dev/null +++ b/nixos/modules/mailman.nix @@ -0,0 +1,67 @@ +# Adapted and simplified from https://nixos.wiki/wiki/Mailman +{ + config, + lib, + ... +}: let + inherit + (lib) + mkIf + mkEnableOption + mkOption + ; + inherit (lib.types) str; + cfg = config.services.mathebau-mailman; +in { + options.services.mathebau-mailman = { + enable = mkEnableOption "mathebau mailman service"; + hostName = mkOption { + type = str; + }; + siteOwner = mkOption { + type = str; + }; + }; + + config = mkIf cfg.enable { + services = { + postfix = { + enable = true; + relayDomains = ["hash:/var/lib/mailman/data/postfix_domains"]; + sslCert = config.security.acme.certs.${cfg.hostName}.directory + "/full.pem"; + sslKey = config.security.acme.certs.${cfg.hostName}.directory + "/key.pem"; + config = { + transport_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"]; + local_recipient_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"]; + proxy_interfaces = "130.83.2.184"; + smtputf8_enable = "no"; # HRZ does not know SMTPUTF8 + }; + relayHost = "mailout.hrz.tu-darmstadt.de"; # Relay to HRZ + }; + mailman = { + enable = true; + inherit (cfg) siteOwner; + hyperkitty.enable = true; + webHosts = [cfg.hostName]; + serve.enable = true; # + }; + nginx.virtualHosts.${cfg.hostName} = { + enableACME = true; + forceSSL = false; + }; + }; + + environment.persistence.${config.impermanence.name} = { + directories = [ + "/var/lib/acme" # Persist TLS keys and account + "/var/lib/mailman" + "/var/lib/mailman-web" + ]; + }; + + security.acme.defaults.email = cfg.siteOwner; + security.acme.acceptTerms = true; + + networking.firewall.allowedTCPPorts = [25 80 443]; + }; +}