From cabd210aa645977a6174cdeb70634d974949fc46 Mon Sep 17 00:00:00 2001 From: Dennis Frieberg Date: Sun, 31 Mar 2024 21:47:33 +0200 Subject: [PATCH 01/17] [#33] Refactored existing network config --- nixos/machines/ghatanothoa/configuration.nix | 3 +- nixos/machines/ghatanothoa/network.nix | 16 ------- nixos/modules/vmNetwork.nix | 48 ++++++++++++++++++++ 3 files changed, 50 insertions(+), 17 deletions(-) delete mode 100644 nixos/machines/ghatanothoa/network.nix create mode 100644 nixos/modules/vmNetwork.nix diff --git a/nixos/machines/ghatanothoa/configuration.nix b/nixos/machines/ghatanothoa/configuration.nix index 207e37f..8364bea 100644 --- a/nixos/machines/ghatanothoa/configuration.nix +++ b/nixos/machines/ghatanothoa/configuration.nix @@ -4,7 +4,7 @@ ../../modules/jitsi.nix ../../roles ../../roles/vm.nix - ./network.nix + ../../modules/vmNetwork.nix ]; services.mathebau-jitsi = { @@ -14,5 +14,6 @@ # System configuration here networking.hostName = "ghatanothoa"; + vmNetwork.ipv4 = "192.168.0.25"; system.stateVersion = "23.11"; } diff --git a/nixos/machines/ghatanothoa/network.nix b/nixos/machines/ghatanothoa/network.nix deleted file mode 100644 index 2a1f4ae..0000000 --- a/nixos/machines/ghatanothoa/network.nix +++ /dev/null @@ -1,16 +0,0 @@ -# We sohuld put that config somewhere in roles and give it a parameter or something, -# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways -# depend on the same thing -{ - imports = []; - networking = { - interfaces.enX0.ipv4.addresses = [ - { - address = "192.168.0.25"; - prefixLength = 16; - } - ]; - defaultGateway = "192.168.0.152"; - nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; - }; -} diff --git a/nixos/modules/vmNetwork.nix b/nixos/modules/vmNetwork.nix new file mode 100644 index 0000000..133d101 --- /dev/null +++ b/nixos/modules/vmNetwork.nix @@ -0,0 +1,48 @@ +{ + lib, + config, + ... +}: let + inherit + (lib) + mkOption + types + last + init + ; + inherit + (lib.strings) + splitString + concatStringsSep + toInt + ; + cfg = config.vmNetwork; +in { + imports = []; + + options.vmNetwork = { + ipv4 = mkOption { + type = types.str; + description = "the ipv4 adress of this machine"; + }; + }; + + config = { + networking = { + interfaces.enX0.ipv4.addresses = [ + { + address = cfg.ipv4; + prefixLength = 16; + } + ]; + defaultGateway = let + addr = splitString "." cfg.ipv4; + addrInit = init addr; + addrLastInt = builtins.toString (toInt (last addr) + 127); + in + concatStringsSep "." (addrInit ++ [addrLastInt]); + # https://www.hrz.tu-darmstadt.de/services/it_services/nameserver_dns/index.de.jsp + nameservers = ["130.83.22.63" "130.83.22.60" "130.83.56.60"]; + }; + }; +} From e91f417a29f96f7c3969aa62b5a74dfbcdab6c18 Mon Sep 17 00:00:00 2001 From: Gonne Date: Tue, 2 Apr 2024 18:33:50 +0200 Subject: [PATCH 02/17] Move secrets to machine config --- nixos/machines/bragi/configuration.nix | 9 ++++++++- nixos/modules/borgbackup.nix | 6 ------ 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/nixos/machines/bragi/configuration.nix b/nixos/machines/bragi/configuration.nix index f74fbb9..dd2ecdc 100644 --- a/nixos/machines/bragi/configuration.nix +++ b/nixos/machines/bragi/configuration.nix @@ -1,4 +1,4 @@ -{ +{config, ...}: { imports = [ ./hardware-configuration.nix ../../roles @@ -12,4 +12,11 @@ # System configuration here networking.hostName = "bragi"; system.stateVersion = "23.11"; + + sops.secrets.backupKey = { + sopsFile = ./backupKey.yaml; + owner = config.users.users.fsaccount.name; + inherit (config.users.users.fsaccount) group; + mode = "0400"; + }; } diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index b5cbe40..ca81cc2 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -161,11 +161,5 @@ in { } ]; }; - sops.secrets.backupKey = { - sopsFile = ../machines/bragi/backupKey.yaml; - owner = config.users.users.fsaccount.name; - inherit (config.users.users.fsaccount) group; - mode = "0400"; - }; }; } From 7bc8261cb64ea251e8ef3aea39a8d7a8958965fe Mon Sep 17 00:00:00 2001 From: Gonne Date: Tue, 2 Apr 2024 18:34:16 +0200 Subject: [PATCH 03/17] Also sync deletion of files from fsaccount before taking the backup --- nixos/modules/borgbackup.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index ca81cc2..784981c 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -121,7 +121,7 @@ in { jobs.fsaccount = { preHook = '' mkdir -p /home/fsaccount/sicherung # Create if it does not exist - ${pkgs.rsync}/bin/rsync -e 'ssh -i /run/secrets/backupKey' -r fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung + ${pkgs.rsync}/bin/rsync --rsh='ssh -i /run/secrets/backupKey' --recursive --delete fachschaft@gw1.mathematik.tu-darmstadt.de:/home/fachschaft/* /home/fsaccount/sicherung ''; paths = "/home/fsaccount/sicherung"; encryption.mode = "none"; # Otherwise the key is next to the backup or we have human interaction. From e69c8c6efbcaccc1cb002ffe5710823d848eb300 Mon Sep 17 00:00:00 2001 From: Gonne Date: Tue, 2 Apr 2024 18:46:41 +0200 Subject: [PATCH 04/17] Remove obsolete DNS resolver --- nixos/machines/bragi/network.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nixos/machines/bragi/network.nix b/nixos/machines/bragi/network.nix index b113b50..af70cb7 100644 --- a/nixos/machines/bragi/network.nix +++ b/nixos/machines/bragi/network.nix @@ -10,6 +10,7 @@ } ]; defaultGateway = "192.168.1.137"; - nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; + # https://www.hrz.tu-darmstadt.de/services/it_services/nameserver_dns/index.de.jsp + nameservers = ["130.83.22.63" "130.83.22.60" "130.83.56.60"]; }; } From 47fd90c602c28bf7248b283035f16b62a812839b Mon Sep 17 00:00:00 2001 From: Gonne Date: Sun, 14 Apr 2024 18:04:03 +0200 Subject: [PATCH 05/17] nix flake update --- flake.lock | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/flake.lock b/flake.lock index 4c3308e..3014bf6 100644 --- a/flake.lock +++ b/flake.lock @@ -21,11 +21,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1709336216, - "narHash": "sha256-Dt/wOWeW6Sqm11Yh+2+t0dfEWxoMxGBvv3JpIocFl9E=", + "lastModified": 1712014858, + "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "f7b3c975cf067e56e7cda6cb098ebe3fb4d74ca2", + "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d", "type": "github" }, "original": { @@ -74,11 +74,11 @@ "utils": "utils" }, "locked": { - "lastModified": 1710449465, - "narHash": "sha256-2orO8nfplp6uQJBFqKkj1iyNMC6TysmwbWwbb4osTag=", + "lastModified": 1713012165, + "narHash": "sha256-z/soXKDnz+w4Nw0LkRaM73YqolhSmIYy6cpg1F2ps8I=", "ref": "refs/heads/master", - "rev": "79c8cfcd5873a85559da6201b116fb38b490d030", - "revCount": 582, + "rev": "9f6635a0351c190179dc6904545f950108a23dd8", + "revCount": 583, "type": "git", "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git" }, @@ -89,11 +89,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1711703276, - "narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=", + "lastModified": 1714076141, + "narHash": "sha256-Drmja/f5MRHZCskS6mvzFqxEaZMeciScCTFxWVLqWEY=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "d8fe5e6c92d0d190646fb9f1056741a229980089", + "rev": "7bb2ccd8cdc44c91edba16c48d2c8f331fb3d856", "type": "github" }, "original": { @@ -106,11 +106,11 @@ "nixpkgs-lib": { "locked": { "dir": "lib", - "lastModified": 1709237383, - "narHash": "sha256-cy6ArO4k5qTx+l5o+0mL9f5fa86tYUX3ozE1S+Txlds=", + "lastModified": 1711703276, + "narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "1536926ef5621b09bba54035ae2bb6d806d72ac8", + "rev": "d8fe5e6c92d0d190646fb9f1056741a229980089", "type": "github" }, "original": { @@ -123,11 +123,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1711233294, - "narHash": "sha256-eEu5y4J145BYDw9o/YEmeJyqh8blgnZwuz9k234zuWc=", + "lastModified": 1713638189, + "narHash": "sha256-q7APLfB6FmmSMI1Su5ihW9IwntBsk2hWNXh8XtSdSIk=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "ac6bdf6181666ebb4f90dd20f31e2fa66ede6b68", + "rev": "74574c38577914733b4f7a775dd77d24245081dd", "type": "github" }, "original": { @@ -146,11 +146,11 @@ "nixpkgs-stable": [] }, "locked": { - "lastModified": 1711760932, - "narHash": "sha256-DqUTQ2iAAqSDwMhKBqvi24v0Oc7pD3LCK/0FCG//TdA=", + "lastModified": 1713954846, + "narHash": "sha256-RWFafuSb5nkWGu8dDbW7gVb8FOQOPqmX/9MlxUUDguw=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "c11e43aed6f17336c25cd120eac886b96c455731", + "rev": "6fb82e44254d6a0ece014ec423cb62d92435336f", "type": "github" }, "original": { @@ -177,11 +177,11 @@ "nixpkgs-stable": "nixpkgs-stable" }, "locked": { - "lastModified": 1711249319, - "narHash": "sha256-N+Pp3/8H+rd7cO71VNV/ovV/Kwt+XNeUHNhsmyTabdM=", + "lastModified": 1713892811, + "narHash": "sha256-uIGmA2xq41vVFETCF1WW4fFWFT2tqBln+aXnWrvjGRE=", "owner": "Mic92", "repo": "sops-nix", - "rev": "405987a66cce9a4a82f321f11b205982a7127c88", + "rev": "f1b0adc27265274e3b0c9b872a8f476a098679bd", "type": "github" }, "original": { From d1483131b8ff2345b0d0b2d9c24c5a61269c6db7 Mon Sep 17 00:00:00 2001 From: Gonne Date: Fri, 26 Apr 2024 18:10:24 +0200 Subject: [PATCH 06/17] Tausche Gonnes SSH-Key --- nixos/roles/admins.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/roles/admins.nix b/nixos/roles/admins.nix index 3215ccc..1bc6d4c 100644 --- a/nixos/roles/admins.nix +++ b/nixos/roles/admins.nix @@ -10,7 +10,7 @@ with lib; let gonne = { hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/"; keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS" + "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIAhwkSDISCWLN2GhHfxdZsVkK4J7JoEcPwtNbAesb+BZAAAABHNzaDo= Gonne" ]; }; }; From c739e6f48beea220d35e484b95f1cb9db279d6e3 Mon Sep 17 00:00:00 2001 From: Gonne Date: Wed, 12 Jun 2024 09:13:19 +0200 Subject: [PATCH 07/17] nix flake update --- flake.lock | 112 +++++++++++++++++++++-------------------------------- 1 file changed, 44 insertions(+), 68 deletions(-) diff --git a/flake.lock b/flake.lock index 3014bf6..5f8f1c1 100644 --- a/flake.lock +++ b/flake.lock @@ -21,11 +21,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1712014858, - "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=", + "lastModified": 1717285511, + "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d", + "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8", "type": "github" }, "original": { @@ -33,31 +33,13 @@ "type": "indirect" } }, - "flake-utils": { - "inputs": { - "systems": "systems_2" - }, - "locked": { - "lastModified": 1710146030, - "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, "impermanence": { "locked": { - "lastModified": 1708968331, - "narHash": "sha256-VUXLaPusCBvwM3zhGbRIJVeYluh2uWuqtj4WirQ1L9Y=", + "lastModified": 1717932370, + "narHash": "sha256-7C5lCpiWiyPoIACOcu2mukn/1JRtz6HC/1aEMhUdcw0=", "owner": "nix-community", "repo": "impermanence", - "rev": "a33ef102a02ce77d3e39c25197664b7a636f9c30", + "rev": "27979f1c3a0d3b9617a3563e2839114ba7d48d3f", "type": "github" }, "original": { @@ -71,14 +53,15 @@ "blobs": "blobs", "flake-compat": [], "nixpkgs": [], + "nixpkgs-24_05": "nixpkgs-24_05", "utils": "utils" }, "locked": { - "lastModified": 1713012165, - "narHash": "sha256-z/soXKDnz+w4Nw0LkRaM73YqolhSmIYy6cpg1F2ps8I=", + "lastModified": 1718084203, + "narHash": "sha256-Cx1xoVfSMv1XDLgKg08CUd1EoTYWB45VmB9XIQzhmzI=", "ref": "refs/heads/master", - "rev": "9f6635a0351c190179dc6904545f950108a23dd8", - "revCount": 583, + "rev": "29916981e7b3b5782dc5085ad18490113f8ff63b", + "revCount": 589, "type": "git", "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git" }, @@ -89,11 +72,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1714076141, - "narHash": "sha256-Drmja/f5MRHZCskS6mvzFqxEaZMeciScCTFxWVLqWEY=", + "lastModified": 1717974879, + "narHash": "sha256-GTO3C88+5DX171F/gVS3Qga/hOs/eRMxPFpiHq2t+D8=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "7bb2ccd8cdc44c91edba16c48d2c8f331fb3d856", + "rev": "c7b821ba2e1e635ba5a76d299af62821cbcb09f3", "type": "github" }, "original": { @@ -103,31 +86,40 @@ "type": "github" } }, + "nixpkgs-24_05": { + "locked": { + "lastModified": 1717144377, + "narHash": "sha256-F/TKWETwB5RaR8owkPPi+SPJh83AQsm6KrQAlJ8v/uA=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "805a384895c696f802a9bf5bf4720f37385df547", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "ref": "nixos-24.05", + "type": "indirect" + } + }, "nixpkgs-lib": { "locked": { - "dir": "lib", - "lastModified": 1711703276, - "narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "d8fe5e6c92d0d190646fb9f1056741a229980089", - "type": "github" + "lastModified": 1717284937, + "narHash": "sha256-lIbdfCsf8LMFloheeE6N31+BMIeixqyQWbSr2vk79EQ=", + "type": "tarball", + "url": "https://github.com/NixOS/nixpkgs/archive/eb9ceca17df2ea50a250b6b27f7bf6ab0186f198.tar.gz" }, "original": { - "dir": "lib", - "owner": "NixOS", - "ref": "nixos-unstable", - "repo": "nixpkgs", - "type": "github" + "type": "tarball", + "url": "https://github.com/NixOS/nixpkgs/archive/eb9ceca17df2ea50a250b6b27f7bf6ab0186f198.tar.gz" } }, "nixpkgs-stable": { "locked": { - "lastModified": 1713638189, - "narHash": "sha256-q7APLfB6FmmSMI1Su5ihW9IwntBsk2hWNXh8XtSdSIk=", + "lastModified": 1717880976, + "narHash": "sha256-BRvSCsKtDUr83NEtbGfHLUOdDK0Cgbezj2PtcHnz+sQ=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "74574c38577914733b4f7a775dd77d24245081dd", + "rev": "4913a7c3d8b8d00cb9476a6bd730ff57777f740c", "type": "github" }, "original": { @@ -140,17 +132,16 @@ "pre-commit-hooks": { "inputs": { "flake-compat": [], - "flake-utils": "flake-utils", "gitignore": [], "nixpkgs": [], "nixpkgs-stable": [] }, "locked": { - "lastModified": 1713954846, - "narHash": "sha256-RWFafuSb5nkWGu8dDbW7gVb8FOQOPqmX/9MlxUUDguw=", + "lastModified": 1717664902, + "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "6fb82e44254d6a0ece014ec423cb62d92435336f", + "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1", "type": "github" }, "original": { @@ -177,11 +168,11 @@ "nixpkgs-stable": "nixpkgs-stable" }, "locked": { - "lastModified": 1713892811, - "narHash": "sha256-uIGmA2xq41vVFETCF1WW4fFWFT2tqBln+aXnWrvjGRE=", + "lastModified": 1718137936, + "narHash": "sha256-psA+1Q5fPaK6yI3vzlLINNtb6EeXj111zQWnZYyJS9c=", "owner": "Mic92", "repo": "sops-nix", - "rev": "f1b0adc27265274e3b0c9b872a8f476a098679bd", + "rev": "c279dec105dd53df13a5e57525da97905cc0f0d6", "type": "github" }, "original": { @@ -205,21 +196,6 @@ "type": "github" } }, - "systems_2": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, "utils": { "inputs": { "systems": "systems" From 495c5806531e0ba3a5cf2d5c38f39cd5f6932eb7 Mon Sep 17 00:00:00 2001 From: Gonne Date: Mon, 24 Jun 2024 09:50:31 +0200 Subject: [PATCH 08/17] nix flake update --- flake.lock | 74 +++++++++++++++--------------------------------------- 1 file changed, 20 insertions(+), 54 deletions(-) diff --git a/flake.lock b/flake.lock index 5f8f1c1..f8ac567 100644 --- a/flake.lock +++ b/flake.lock @@ -35,11 +35,11 @@ }, "impermanence": { "locked": { - "lastModified": 1717932370, - "narHash": "sha256-7C5lCpiWiyPoIACOcu2mukn/1JRtz6HC/1aEMhUdcw0=", + "lastModified": 1719091691, + "narHash": "sha256-AxaLX5cBEcGtE02PeGsfscSb/fWMnyS7zMWBXQWDKbE=", "owner": "nix-community", "repo": "impermanence", - "rev": "27979f1c3a0d3b9617a3563e2839114ba7d48d3f", + "rev": "23c1f06316b67cb5dabdfe2973da3785cfe9c34a", "type": "github" }, "original": { @@ -53,15 +53,14 @@ "blobs": "blobs", "flake-compat": [], "nixpkgs": [], - "nixpkgs-24_05": "nixpkgs-24_05", - "utils": "utils" + "nixpkgs-24_05": "nixpkgs-24_05" }, "locked": { - "lastModified": 1718084203, - "narHash": "sha256-Cx1xoVfSMv1XDLgKg08CUd1EoTYWB45VmB9XIQzhmzI=", + "lastModified": 1718697807, + "narHash": "sha256-Enla61WFisytTYbWygPynEbu8vozjeGc6Obkj2GRj7o=", "ref": "refs/heads/master", - "rev": "29916981e7b3b5782dc5085ad18490113f8ff63b", - "revCount": 589, + "rev": "290a995de5c3d3f08468fa548f0d55ab2efc7b6b", + "revCount": 591, "type": "git", "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git" }, @@ -72,11 +71,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1717974879, - "narHash": "sha256-GTO3C88+5DX171F/gVS3Qga/hOs/eRMxPFpiHq2t+D8=", + "lastModified": 1719075281, + "narHash": "sha256-CyyxvOwFf12I91PBWz43iGT1kjsf5oi6ax7CrvaMyAo=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "c7b821ba2e1e635ba5a76d299af62821cbcb09f3", + "rev": "a71e967ef3694799d0c418c98332f7ff4cc5f6af", "type": "github" }, "original": { @@ -115,11 +114,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1717880976, - "narHash": "sha256-BRvSCsKtDUr83NEtbGfHLUOdDK0Cgbezj2PtcHnz+sQ=", + "lastModified": 1719099622, + "narHash": "sha256-YzJECAxFt+U5LPYf/pCwW/e1iUd2PF21WITHY9B/BAs=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "4913a7c3d8b8d00cb9476a6bd730ff57777f740c", + "rev": "5e8e3b89adbd0be63192f6e645e0a54080004924", "type": "github" }, "original": { @@ -137,11 +136,11 @@ "nixpkgs-stable": [] }, "locked": { - "lastModified": 1717664902, - "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=", + "lastModified": 1718879355, + "narHash": "sha256-RTyqP4fBX2MdhNuMP+fnR3lIwbdtXhyj7w7fwtvgspc=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1", + "rev": "8cd35b9496d21a6c55164d8547d9d5280162b07a", "type": "github" }, "original": { @@ -168,11 +167,11 @@ "nixpkgs-stable": "nixpkgs-stable" }, "locked": { - "lastModified": 1718137936, - "narHash": "sha256-psA+1Q5fPaK6yI3vzlLINNtb6EeXj111zQWnZYyJS9c=", + "lastModified": 1719111739, + "narHash": "sha256-kr2QzRrplzlCP87ddayCZQS+dhGW98kw2zy7+jUXtF4=", "owner": "Mic92", "repo": "sops-nix", - "rev": "c279dec105dd53df13a5e57525da97905cc0f0d6", + "rev": "5e2e9421e9ed2b918be0a441c4535cfa45e04811", "type": "github" }, "original": { @@ -180,39 +179,6 @@ "repo": "sops-nix", "type": "github" } - }, - "systems": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } - }, - "utils": { - "inputs": { - "systems": "systems" - }, - "locked": { - "lastModified": 1709126324, - "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "d465f4819400de7c8d874d50b982301f28a84605", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } } }, "root": "root", From 367cbeed0a808677640c1d293c38b60e75b4bd8f Mon Sep 17 00:00:00 2001 From: Gonne Date: Mon, 1 Jul 2024 21:32:35 +0200 Subject: [PATCH 09/17] nix flake update Especially contains https://github.com/NixOS/nixpkgs/pull/323753 --- flake.lock | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/flake.lock b/flake.lock index f8ac567..0e858d1 100644 --- a/flake.lock +++ b/flake.lock @@ -21,11 +21,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1717285511, - "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=", + "lastModified": 1719745305, + "narHash": "sha256-xwgjVUpqSviudEkpQnioeez1Uo2wzrsMaJKJClh+Bls=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8", + "rev": "c3c5ecc05edc7dafba779c6c1a61cd08ac6583e9", "type": "github" }, "original": { @@ -71,11 +71,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1719075281, - "narHash": "sha256-CyyxvOwFf12I91PBWz43iGT1kjsf5oi6ax7CrvaMyAo=", + "lastModified": 1719690277, + "narHash": "sha256-0xSej1g7eP2kaUF+JQp8jdyNmpmCJKRpO12mKl/36Kc=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a71e967ef3694799d0c418c98332f7ff4cc5f6af", + "rev": "2741b4b489b55df32afac57bc4bfd220e8bf617e", "type": "github" }, "original": { @@ -114,11 +114,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1719099622, - "narHash": "sha256-YzJECAxFt+U5LPYf/pCwW/e1iUd2PF21WITHY9B/BAs=", + "lastModified": 1719663039, + "narHash": "sha256-tXlrgAQygNIy49LDVFuPXlWD2zTQV9/F8pfoqwwPJyo=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "5e8e3b89adbd0be63192f6e645e0a54080004924", + "rev": "4a1e673523344f6ccc84b37f4413ad74ea19a119", "type": "github" }, "original": { @@ -136,11 +136,11 @@ "nixpkgs-stable": [] }, "locked": { - "lastModified": 1718879355, - "narHash": "sha256-RTyqP4fBX2MdhNuMP+fnR3lIwbdtXhyj7w7fwtvgspc=", + "lastModified": 1719259945, + "narHash": "sha256-F1h+XIsGKT9TkGO3omxDLEb/9jOOsI6NnzsXFsZhry4=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "8cd35b9496d21a6c55164d8547d9d5280162b07a", + "rev": "0ff4381bbb8f7a52ca4a851660fc7a437a4c6e07", "type": "github" }, "original": { @@ -167,11 +167,11 @@ "nixpkgs-stable": "nixpkgs-stable" }, "locked": { - "lastModified": 1719111739, - "narHash": "sha256-kr2QzRrplzlCP87ddayCZQS+dhGW98kw2zy7+jUXtF4=", + "lastModified": 1719716556, + "narHash": "sha256-KA9gy2Wkv76s4A8eLnOcdKVTygewbw3xsB8+awNMyqs=", "owner": "Mic92", "repo": "sops-nix", - "rev": "5e2e9421e9ed2b918be0a441c4535cfa45e04811", + "rev": "b5974d4331fb6c893e808977a2e1a6d34b3162d6", "type": "github" }, "original": { From e5a9653f39849092c5f5a282f90f3d2cf837cd85 Mon Sep 17 00:00:00 2001 From: Gonne Date: Tue, 2 Jul 2024 15:52:10 +0200 Subject: [PATCH 10/17] nix flake update In particular contains https://github.com/NixOS/nixpkgs/pull/323753 (This time for real) --- flake.lock | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/flake.lock b/flake.lock index 0e858d1..96ee64c 100644 --- a/flake.lock +++ b/flake.lock @@ -21,11 +21,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1719745305, - "narHash": "sha256-xwgjVUpqSviudEkpQnioeez1Uo2wzrsMaJKJClh+Bls=", + "lastModified": 1719877454, + "narHash": "sha256-g5N1yyOSsPNiOlFfkuI/wcUjmtah+nxdImJqrSATjOU=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "c3c5ecc05edc7dafba779c6c1a61cd08ac6583e9", + "rev": "4e3583423212f9303aa1a6337f8dffb415920e4f", "type": "github" }, "original": { @@ -71,11 +71,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1719690277, - "narHash": "sha256-0xSej1g7eP2kaUF+JQp8jdyNmpmCJKRpO12mKl/36Kc=", + "lastModified": 1719848872, + "narHash": "sha256-H3+EC5cYuq+gQW8y0lSrrDZfH71LB4DAf+TDFyvwCNA=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "2741b4b489b55df32afac57bc4bfd220e8bf617e", + "rev": "00d80d13810dbfea8ab4ed1009b09100cca86ba8", "type": "github" }, "original": { @@ -102,14 +102,14 @@ }, "nixpkgs-lib": { "locked": { - "lastModified": 1717284937, - "narHash": "sha256-lIbdfCsf8LMFloheeE6N31+BMIeixqyQWbSr2vk79EQ=", + "lastModified": 1719876945, + "narHash": "sha256-Fm2rDDs86sHy0/1jxTOKB1118Q0O3Uc7EC0iXvXKpbI=", "type": "tarball", - "url": "https://github.com/NixOS/nixpkgs/archive/eb9ceca17df2ea50a250b6b27f7bf6ab0186f198.tar.gz" + "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz" }, "original": { "type": "tarball", - "url": "https://github.com/NixOS/nixpkgs/archive/eb9ceca17df2ea50a250b6b27f7bf6ab0186f198.tar.gz" + "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz" } }, "nixpkgs-stable": { @@ -167,11 +167,11 @@ "nixpkgs-stable": "nixpkgs-stable" }, "locked": { - "lastModified": 1719716556, - "narHash": "sha256-KA9gy2Wkv76s4A8eLnOcdKVTygewbw3xsB8+awNMyqs=", + "lastModified": 1719873517, + "narHash": "sha256-D1dxZmXf6M2h5lNE1m6orojuUawVPjogbGRsqSBX+1g=", "owner": "Mic92", "repo": "sops-nix", - "rev": "b5974d4331fb6c893e808977a2e1a6d34b3162d6", + "rev": "a11224af8d824935f363928074b4717ca2e280db", "type": "github" }, "original": { From 575343c8444331308ff3b8a139019586f60573c8 Mon Sep 17 00:00:00 2001 From: Gonne Date: Sat, 20 Apr 2024 12:28:29 +0200 Subject: [PATCH 11/17] Unify hook settings and fix warning trace: warning: The option `settings.statix' defined in `/nix/store/plj05iykqma26y930qjf75zxp2qx02sl-source/flake.nix, via option perSystem' has been renamed to `hooks.statix.settings'. --- flake-module.nix | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/flake-module.nix b/flake-module.nix index 82bf10f..0cb9369 100644 --- a/flake-module.nix +++ b/flake-module.nix @@ -26,14 +26,15 @@ in { check.enable = true; settings = { - # for some reason statix takes it config differently than all the other hooks. - settings.statix = { - format = "stderr"; - ignore = generatedFiles; - }; hooks = { nil.enable = true; - statix.enable = true; + statix = { + enable = true; + settings = { + format = "stderr"; + ignore = generatedFiles; + }; + }; deadnix = { enable = true; excludes = generatedFiles; From 0550754cddd668d0e80e88d732013f266ce1a007 Mon Sep 17 00:00:00 2001 From: Gonne Date: Fri, 27 Sep 2024 18:33:58 +0200 Subject: [PATCH 12/17] nix flake update Allows insecure package jitsi-meet (see https://github.com/NixOS/nixpkgs/pull/334638) --- flake-module.nix | 5 +++++ flake.lock | 54 ++++++++++++++++++++++++------------------------ 2 files changed, 32 insertions(+), 27 deletions(-) diff --git a/flake-module.nix b/flake-module.nix index 0cb9369..c30fff4 100644 --- a/flake-module.nix +++ b/flake-module.nix @@ -15,6 +15,7 @@ perSystem = { config, pkgs, + system, ... }: { devShells.default = config.pre-commit.devShell; @@ -49,6 +50,10 @@ # Per-system attributes can be defined here. The self' and inputs' # module parameters provide easy access to attributes of the same # system. + _module.args.pkgs = import inputs.nixpkgs { + inherit system; + config.permittedInsecurePackages = ["jitsi-meet-1.0.8043"]; + }; }; # Equivalent to inputs'.nixpkgs.legacyPackages.hello; diff --git a/flake.lock b/flake.lock index 96ee64c..dc1839f 100644 --- a/flake.lock +++ b/flake.lock @@ -21,11 +21,11 @@ "nixpkgs-lib": "nixpkgs-lib" }, "locked": { - "lastModified": 1719877454, - "narHash": "sha256-g5N1yyOSsPNiOlFfkuI/wcUjmtah+nxdImJqrSATjOU=", + "lastModified": 1727826117, + "narHash": "sha256-K5ZLCyfO/Zj9mPFldf3iwS6oZStJcU4tSpiXTMYaaL0=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "4e3583423212f9303aa1a6337f8dffb415920e4f", + "rev": "3d04084d54bedc3d6b8b736c70ef449225c361b1", "type": "github" }, "original": { @@ -35,11 +35,11 @@ }, "impermanence": { "locked": { - "lastModified": 1719091691, - "narHash": "sha256-AxaLX5cBEcGtE02PeGsfscSb/fWMnyS7zMWBXQWDKbE=", + "lastModified": 1727649413, + "narHash": "sha256-FA53of86DjFdeQzRDVtvgWF9o52rWK70VHGx0Y8fElQ=", "owner": "nix-community", "repo": "impermanence", - "rev": "23c1f06316b67cb5dabdfe2973da3785cfe9c34a", + "rev": "d0b38e550039a72aff896ee65b0918e975e6d48e", "type": "github" }, "original": { @@ -56,11 +56,11 @@ "nixpkgs-24_05": "nixpkgs-24_05" }, "locked": { - "lastModified": 1718697807, - "narHash": "sha256-Enla61WFisytTYbWygPynEbu8vozjeGc6Obkj2GRj7o=", + "lastModified": 1722877200, + "narHash": "sha256-qgKDNJXs+od+1UbRy62uk7dYal3h98I4WojfIqMoGcg=", "ref": "refs/heads/master", - "rev": "290a995de5c3d3f08468fa548f0d55ab2efc7b6b", - "revCount": 591, + "rev": "af7d3bf5daeba3fc28089b015c0dd43f06b176f2", + "revCount": 593, "type": "git", "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git" }, @@ -71,11 +71,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1719848872, - "narHash": "sha256-H3+EC5cYuq+gQW8y0lSrrDZfH71LB4DAf+TDFyvwCNA=", + "lastModified": 1728492678, + "narHash": "sha256-9UTxR8eukdg+XZeHgxW5hQA9fIKHsKCdOIUycTryeVw=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "00d80d13810dbfea8ab4ed1009b09100cca86ba8", + "rev": "5633bcff0c6162b9e4b5f1264264611e950c8ec7", "type": "github" }, "original": { @@ -102,28 +102,28 @@ }, "nixpkgs-lib": { "locked": { - "lastModified": 1719876945, - "narHash": "sha256-Fm2rDDs86sHy0/1jxTOKB1118Q0O3Uc7EC0iXvXKpbI=", + "lastModified": 1727825735, + "narHash": "sha256-0xHYkMkeLVQAMa7gvkddbPqpxph+hDzdu1XdGPJR+Os=", "type": "tarball", - "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz" + "url": "https://github.com/NixOS/nixpkgs/archive/fb192fec7cc7a4c26d51779e9bab07ce6fa5597a.tar.gz" }, "original": { "type": "tarball", - "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz" + "url": "https://github.com/NixOS/nixpkgs/archive/fb192fec7cc7a4c26d51779e9bab07ce6fa5597a.tar.gz" } }, "nixpkgs-stable": { "locked": { - "lastModified": 1719663039, - "narHash": "sha256-tXlrgAQygNIy49LDVFuPXlWD2zTQV9/F8pfoqwwPJyo=", + "lastModified": 1728156290, + "narHash": "sha256-uogSvuAp+1BYtdu6UWuObjHqSbBohpyARXDWqgI12Ss=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "4a1e673523344f6ccc84b37f4413ad74ea19a119", + "rev": "17ae88b569bb15590549ff478bab6494dde4a907", "type": "github" }, "original": { "owner": "NixOS", - "ref": "release-23.11", + "ref": "release-24.05", "repo": "nixpkgs", "type": "github" } @@ -136,11 +136,11 @@ "nixpkgs-stable": [] }, "locked": { - "lastModified": 1719259945, - "narHash": "sha256-F1h+XIsGKT9TkGO3omxDLEb/9jOOsI6NnzsXFsZhry4=", + "lastModified": 1728727368, + "narHash": "sha256-7FMyNISP7K6XDSIt1NJxkXZnEdV3HZUXvFoBaJ/qdOg=", "owner": "cachix", "repo": "pre-commit-hooks.nix", - "rev": "0ff4381bbb8f7a52ca4a851660fc7a437a4c6e07", + "rev": "eb74e0be24a11a1531b5b8659535580554d30b28", "type": "github" }, "original": { @@ -167,11 +167,11 @@ "nixpkgs-stable": "nixpkgs-stable" }, "locked": { - "lastModified": 1719873517, - "narHash": "sha256-D1dxZmXf6M2h5lNE1m6orojuUawVPjogbGRsqSBX+1g=", + "lastModified": 1728345710, + "narHash": "sha256-lpunY1+bf90ts+sA2/FgxVNIegPDKCpEoWwOPu4ITTQ=", "owner": "Mic92", "repo": "sops-nix", - "rev": "a11224af8d824935f363928074b4717ca2e280db", + "rev": "06535d0e3d0201e6a8080dd32dbfde339b94f01b", "type": "github" }, "original": { From 1ab6e5d86835fec123c1a4c7d120cbfab1ede00a Mon Sep 17 00:00:00 2001 From: Gonne Date: Mon, 5 Feb 2024 21:36:51 +0100 Subject: [PATCH 13/17] Setze Mailman-Maschine auf --- nixos/machines/lobon/configuration.nix | 21 ++++++ .../machines/lobon/hardware-configuration.nix | 30 +++++++++ nixos/modules/mailman.nix | 67 +++++++++++++++++++ 3 files changed, 118 insertions(+) create mode 100644 nixos/machines/lobon/configuration.nix create mode 100644 nixos/machines/lobon/hardware-configuration.nix create mode 100644 nixos/modules/mailman.nix diff --git a/nixos/machines/lobon/configuration.nix b/nixos/machines/lobon/configuration.nix new file mode 100644 index 0000000..553bfe4 --- /dev/null +++ b/nixos/machines/lobon/configuration.nix @@ -0,0 +1,21 @@ +{ + imports = [ + ./hardware-configuration.nix + ../../modules/mailman.nix + ../../roles + ../../roles/vm.nix + ../../modules/vmNetwork.nix + ]; + + # System configuration here + + services.mathebau-mailman = { + enable = true; + hostName = "lists.mathebau.de"; + siteOwner = "root@mathebau.de"; + }; + + networking.hostName = "lobon"; + vmNetwork.ipv4 = "192.168.0.22"; + system.stateVersion = "23.11"; +} diff --git a/nixos/machines/lobon/hardware-configuration.nix b/nixos/machines/lobon/hardware-configuration.nix new file mode 100644 index 0000000..ce7112d --- /dev/null +++ b/nixos/machines/lobon/hardware-configuration.nix @@ -0,0 +1,30 @@ +{ + lib, + pkgs, + ... +}: { + imports = []; + + fileSystems."/" = { + device = "root"; + fsType = "tmpfs"; + options = ["size=1G" "mode=755"]; + }; + fileSystems."/persist" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=persist"]; + neededForBoot = true; + }; + fileSystems."/boot" = { + device = "/dev/disk/by-label/boot"; + fsType = "ext4"; + }; + fileSystems."/nix" = { + device = "/dev/disk/by-label/nixos"; + fsType = "btrfs"; + options = ["subvol=nix"]; + }; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/nixos/modules/mailman.nix b/nixos/modules/mailman.nix new file mode 100644 index 0000000..e4265a9 --- /dev/null +++ b/nixos/modules/mailman.nix @@ -0,0 +1,67 @@ +# Adapted and simplified from https://nixos.wiki/wiki/Mailman +{ + config, + lib, + ... +}: let + inherit + (lib) + mkIf + mkEnableOption + mkOption + ; + inherit (lib.types) nonEmptyStr; + cfg = config.services.mathebau-mailman; +in { + options.services.mathebau-mailman = { + enable = mkEnableOption "mathebau mailman service"; + hostName = mkOption { + type = nonEmptyStr; + }; + siteOwner = mkOption { + type = nonEmptyStr; + }; + }; + + config = mkIf cfg.enable { + services = { + postfix = { + enable = true; + relayDomains = ["hash:/var/lib/mailman/data/postfix_domains"]; + sslCert = config.security.acme.certs.${cfg.hostName}.directory + "/full.pem"; + sslKey = config.security.acme.certs.${cfg.hostName}.directory + "/key.pem"; + config = { + transport_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"]; + local_recipient_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"]; + proxy_interfaces = "130.83.2.184"; + smtputf8_enable = "no"; # HRZ does not know SMTPUTF8 + }; + relayHost = "mailout.hrz.tu-darmstadt.de"; # Relay to HRZ + }; + mailman = { + enable = true; + inherit (cfg) siteOwner; + hyperkitty.enable = true; + webHosts = [cfg.hostName]; + serve.enable = true; # + }; + nginx.virtualHosts.${cfg.hostName} = { + enableACME = true; + forceSSL = false; + }; + }; + + environment.persistence.${config.impermanence.name} = { + directories = [ + "/var/lib/acme" # Persist TLS keys and account + "/var/lib/mailman" + "/var/lib/mailman-web" + ]; + }; + + security.acme.defaults.email = cfg.siteOwner; + security.acme.acceptTerms = true; + + networking.firewall.allowedTCPPorts = [25 80 443]; + }; +} From b9b7a1fa587c0bfeb28ddf7df91cfc77995c1c8b Mon Sep 17 00:00:00 2001 From: Gonne Date: Sun, 31 Mar 2024 16:26:11 +0200 Subject: [PATCH 14/17] Add pushing to hrz allowlist --- .sops.yaml | 7 ++++ nixos/machines/lobon/allowlistPass.yaml | 39 ++++++++++++++++++++++ nixos/modules/mailman.nix | 44 +++++++++++++++++++++++-- 3 files changed, 87 insertions(+), 3 deletions(-) create mode 100644 nixos/machines/lobon/allowlistPass.yaml diff --git a/.sops.yaml b/.sops.yaml index 6f01614..bc5cfc6 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -4,6 +4,7 @@ keys: - &nyarlathotep age1s99d0vlj5qlm287n98jratql5fypvjrxxal0k5jl2aw9dcc8kyvqw5yyt4 - &bragi age1lqvgpmlemyg9095ujck64u59ma29656zs7a4yxgz4s6u5cld2ccss69jwe + - &lobon age12nz7dtc0m5wasxm4r9crtkgwnzvauyfp0xh0n8z8jld0arn9ea9qe0agvn creation_rules: - path_regex: nixos/machines/nyarlathotep/.* @@ -18,6 +19,12 @@ creation_rules: - *nerf - *gonne - *bragi + - path_regex: nixos/machines/lobon/.* + key_groups: + - age: + - *nerf + - *gonne + - *lobon # this is the catchall clause if nothing above machtes. Encrypt to users but not # to machines - key_groups: diff --git a/nixos/machines/lobon/allowlistPass.yaml b/nixos/machines/lobon/allowlistPass.yaml new file mode 100644 index 0000000..c8d4d98 --- /dev/null +++ b/nixos/machines/lobon/allowlistPass.yaml @@ -0,0 +1,39 @@ +allowlistPass: ENC[AES256_GCM,data:bb9jXSvWeDnZqqiY/IarwA==,iv:qeFAYvXYdh2uEleg8kpCd77u4PTbwM8ydEkbMhyPz1I=,tag:1/eysyZb2mJ0mYHXIrpihw==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1rasjnr2tlv9y70sj0z0hwpgpxdc974wzg5umtx2pnc6z0p05u3js6r8sln + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySVhjV0xXdGE2am85RVJh + NXJLRy92blkzeENuWHh3QSsxNHBXcUpibGxnCnVHUEVoYVgxbk5WSmxQRXNzMC9i + Y1g4MUFrNEVjVjJWM0xhU0JzTzNZTk0KLS0tIFIrdmhrbXFHb2VaQ1p2dDJMMmlR + Um5CcGlZanBBRzJKOVNZeWVPTmsrcVUK905uViHD7uZMVQHPfFraIHXYTHaT+ERl + ZvyRDdjjRCyxu0qcIpYVpPAmfGCo0++bXSRUX8rCp48YN20MbPNjgA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1xv5rfxkxg9jyqx5jg2j82cxv7w7ep4a3795p4yl5fuqf38f3m3eqfnefju + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLNkNpN2RlcHBuOUxoYmkx + QzdOM1E0cFBSc1I0NzVRbmhiUXhjM3dQOWhnCmlOQzJ3b2Q5NFJkb2haMDNGSFBv + SkdySWtRUzhic1FNeXhiUFBPRVNoWmcKLS0tIGNaVW5xUmxWOEtXVkRqVEJJSEVv + NFBWREFQbnFXclhiNW51M0ZsOEMxdnMKdOPVRbD42q7MRw1CX1M30Xdil7VFLDVD + G8j4sjxlDkcwQK/3WjZdBLXAzJcrvAp0okGzw8lymC812CXTSEfmxw== + -----END AGE ENCRYPTED FILE----- + - recipient: age12nz7dtc0m5wasxm4r9crtkgwnzvauyfp0xh0n8z8jld0arn9ea9qe0agvn + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKVVN2THloaU1pVnhtWDhm + TWpPaHNLSXlud0RLU3ovS0s4REtUTzQwMHhZClF5OFZQVHB2VG9BeThSYzVSMUFJ + VDNkT0Y1Y3RUemkwSmxlM0drUlNDR1UKLS0tIDYrcVhXMWJxR2dhcXhjdTQ3MjV1 + Y3lWbHdLOGRGamhRY0xoRnVJczc2aFUKWWAflRwoszNw5bEDTSaVI65FtQve/HrC + uY1JvYwXLq4m4hu76dyrplDpzb8ant/YAUXpG6F4U7nn9GiLBaoyUQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-03-31T14:34:54Z" + mac: ENC[AES256_GCM,data:sjWiO96NcFUT4L9mdBuQwt6Zl5cS16o73zes30SYJxzM1R3ZBIg9oOmhXxY9BC3yKjEb6bVuemj/bnnopSR/m3RPH7xfaYCBfz97Zgc4SGtoqLIra5OUCRpWnKSsD6Nf09Qss5Pbla9EIrI0kQt7fpf4iKLF7VJwrQryslnvfcM=,iv:ilnbLK6sttweEyqszVHxVnjbTq8jF5ZTO24OEIPMprE=,tag:3XgAlXMl/RIaUfkVwHJeBQ==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.8.1 diff --git a/nixos/modules/mailman.nix b/nixos/modules/mailman.nix index e4265a9..9f64466 100644 --- a/nixos/modules/mailman.nix +++ b/nixos/modules/mailman.nix @@ -2,6 +2,7 @@ { config, lib, + pkgs, ... }: let inherit @@ -36,7 +37,7 @@ in { proxy_interfaces = "130.83.2.184"; smtputf8_enable = "no"; # HRZ does not know SMTPUTF8 }; - relayHost = "mailout.hrz.tu-darmstadt.de"; # Relay to HRZ + relayHost = "mailout.hrz.tu-darmstadt.de"; # Relay to HRZ (see https://www.hrz.tu-darmstadt.de/services/it_services/email_infrastruktur/index.de.jsp) }; mailman = { enable = true; @@ -44,10 +45,12 @@ in { hyperkitty.enable = true; webHosts = [cfg.hostName]; serve.enable = true; # + # Don't include confirmation tokens in reply addresses, because we would need to send them to HRZ otherwise. + settings.mta.verp_confirmations = "no"; }; nginx.virtualHosts.${cfg.hostName} = { - enableACME = true; - forceSSL = false; + enableACME = true; # Get certificates (primarily for postfix) + forceSSL = false; # Don't use HTTPS behind the proxy }; }; @@ -63,5 +66,40 @@ in { security.acme.acceptTerms = true; networking.firewall.allowedTCPPorts = [25 80 443]; + + # Update HRZ allowlist + # For account details see https://www-cgi.hrz.tu-darmstadt.de/mail/ + # will stop working if no valid TUIDs are associated to our domain. + systemd.timers."mailAllowlist" = { + wantedBy = ["timers.target"]; + timerConfig = { + OnBootSec = "5m"; # Run every 5 minutes + OnUnitActiveSec = "5m"; + RandomizedDelaySec = "2m"; # prevent overload on regular intervals + Unit = "mailAllowlist.service"; + }; + }; + systemd.services."mailAllowlist" = { + description = "Allowlist update: Post the mail addresses used by mailman to the HRZ allowllist"; + script = '' + # Get the mail addresses' local-part + cut -d '@' -f 1 /var/lib/mailman/data/postfix_lmtp | grep -v '#' | grep "\S" > /tmp/addresses + # Post local-parts to HRZ + ${pkgs.curl}/bin/curl https://www-cgi.hrz.tu-darmstadt.de/mail/whitelist-update.php -F emaildomain=${cfg.hostName} -F password=$(cat /run/secrets/allowlistPass) -F emailliste=@/tmp/addresses -F meldungen=voll + # Cleanup + rm /tmp/addresses + ''; + serviceConfig = { + Type = "oneshot"; + User = "mailman"; + PrivateTmp = true; + }; + }; + sops.secrets.allowlistPass = { + sopsFile = ../machines/lobon/allowlistPass.yaml; + owner = "mailman"; + group = "mailman"; + mode = "0400"; + }; }; } From b50d7d0e6a83f5bbef3c269bb772a71a7a8338b0 Mon Sep 17 00:00:00 2001 From: Gonne Date: Sun, 31 Mar 2024 20:28:40 +0200 Subject: [PATCH 15/17] Mailman backups --- nixos/machines/lobon/backupKey.yaml | 39 ++++++++++++++++++++++++++ nixos/machines/lobon/configuration.nix | 15 ++++++++++ nixos/modules/borgbackup.nix | 7 +++++ nixos/modules/mailman.nix | 27 ++++++++++++++---- 4 files changed, 82 insertions(+), 6 deletions(-) create mode 100644 nixos/machines/lobon/backupKey.yaml diff --git a/nixos/machines/lobon/backupKey.yaml b/nixos/machines/lobon/backupKey.yaml new file mode 100644 index 0000000..3095894 --- /dev/null +++ b/nixos/machines/lobon/backupKey.yaml @@ -0,0 +1,39 @@ +backupKey: ENC[AES256_GCM,data:/PErHUVZDTyqK+GKI2inDoEBQpSmezeBTgXWnrthc8IPtUFn4Ur2CkDo+MqfiAlSn9vT2ksHmyS5qmoGANG01e1Cm50qpt/BdoC2hh15jOVuc0uUBNOq7f5YBVeYtbemwjPcmbF7dgUeRlEAvxhqtX3/ntzxSB1inew/SsEgPrU4Yl0FF+CHhqgbeB/NJOhQY29/3hBGwMksfTUDymUmX6pUgIN1M26crIKFCn5IyqAXl10F+zL4PThZPnhmks7Y8BsGUbKkiE6ghdaUjEjBjGOGgbaGAjolG+nJ17xyM1Pc2speT4E/3VgAC34dpaByveGcf2SfsXir0KavcI86mUkjzaNF9u7GjGO0Szn742/aqbdUoOkJl41unb0Enf2/D4Up3fy6LrUqVqrHIM4Dea9WLQd0poD0FWSN12IKh+ylkouMkmhwLXUXFzIHOePS92/MsPM+9fLhH4cU64qxr9UzmfYRnNBpAHrjlxdkK9WZ1Oj4mdtu6R20vYkYcMIQgU38FvSN6uWGvPxJj+Ij,iv:ghvgkC6qFO/0tvsc7igCoZy7am8eNsd21WYCSAKiZDs=,tag:MFnk/Nnw+cloN+x7sd4LLg==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1rasjnr2tlv9y70sj0z0hwpgpxdc974wzg5umtx2pnc6z0p05u3js6r8sln + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaNVExTHQrY2h1M3RZOEdU + Wm5kdDBHZ1NmZGpQU0VOYWtjOTdBVURQZkJnCmZzWTEvSWxvMFk4NlFOVnBDbm9q + Tncva0VyMGVDL29ZZ0YxeGE3RFBUS3cKLS0tIDluK05NMUNNM3pEUmlCNE9BV3lT + L0dPYTBwbjJzUmJnYktiM2JBME5LM3cKvPwth4DxQgFYhvr9vJLfeaiNc+UfAo4c + RdXPLkwtq3vksrU1IR54tHcUJ0yZiZ1HxxGp3PCPaXXJiUykllnJPw== + -----END AGE ENCRYPTED FILE----- + - recipient: age1epz92k2rkp43hkrg3u0jgkzhnkwx8y43kag7rvfzwl9wcddelvusyetxl7 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRdFV0OVA5VTBuOVhsL3lp + MFpDN2RHVDExck5vcWpDNDNPM2k3S1FqQUFFCjNreXdSbDFXOHJ4b21mNGlZb0xQ + YUh0WVNGN2o1aFVaaGpxbmk4aUQ4ZTAKLS0tIHhtci84Zk1zZlBOOHk4a3VKUlM1 + MXNZbWdpVEJiTTlIRERLYzBlNWxBMlUK4Z8JLlN5FOegfdg5njhHjbCwAm/f+kJS + buOHGWzWirW0ZibOP+fikzJwdIzIsX8v8tGaV89nQwf0hrxK0748Hg== + -----END AGE ENCRYPTED FILE----- + - recipient: age12nz7dtc0m5wasxm4r9crtkgwnzvauyfp0xh0n8z8jld0arn9ea9qe0agvn + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZa2pUZlZsVmhPU242d0Nj + bi9BSlJBU1Q1cFU4ZjA4NnlJNmdwaVFBc2xNCjJlSG5UaDFnSzFHZ01RVVNjOHY5 + L1JVUit6SThvbGRIU0loNmtZanllNXcKLS0tIFhMR1pxRmlGQWFEQURiRFJoMWJZ + dlExV2xTVWR6bWI3VCtSdU81SmtqYncKLFQczlIj89vzlfgE33w6ktotYFdxaWr9 + YyewbY8qZmOUGQ4xKlZmhojeMh/FEH8dGNEf1AxnKbuQdnW6lqGR/w== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-03-31T16:01:00Z" + mac: ENC[AES256_GCM,data:AawTzIXyX+3FyFpw8pXFeVJJtXN7ZpTFnUqhedC2vcbbNUzMMt1X0SaxtNNJ5chZI/tYHn59FT6zznl1eO4Xn29Zc2Up4dkT1BE4yqkEG0hiCFXrXMz/PaHfROzBhIWCVyF4fYj6MZKg1iBBxhWRqhJlQ1q4UVkoaITRUKpFJgs=,iv:3lTPOQ8VjmP3WNGbFK2yLU4Ks1KviNS/l7TH4SnvSUs=,tag:KUbAU6+76/Uxj2Wn9EnqnA==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.8.1 diff --git a/nixos/machines/lobon/configuration.nix b/nixos/machines/lobon/configuration.nix index 553bfe4..506d637 100644 --- a/nixos/machines/lobon/configuration.nix +++ b/nixos/machines/lobon/configuration.nix @@ -18,4 +18,19 @@ networking.hostName = "lobon"; vmNetwork.ipv4 = "192.168.0.22"; system.stateVersion = "23.11"; + + sops.secrets = { + allowlistPass = { + sopsFile = ./allowlistPass.yaml; + owner = "mailman"; + group = "mailman"; + mode = "0400"; + }; + backupKey = { + sopsFile = ./backupKey.yaml; + owner = "root"; + group = "root"; + mode = "0400"; + }; + }; } diff --git a/nixos/modules/borgbackup.nix b/nixos/modules/borgbackup.nix index 784981c..08724cc 100644 --- a/nixos/modules/borgbackup.nix +++ b/nixos/modules/borgbackup.nix @@ -83,6 +83,13 @@ in { path = "/var/lib/backups/ithaqua"; allowSubRepos = true; }; + lobon = { + authorizedKeysAppendOnly = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICEptjf1UWRlo6DG9alAIRwkSDUAVHwDKkHC6/DeYKzi Lobon Backup" + ]; + path = "/var/lib/backups/lobon"; + allowSubRepos = true; + }; sanctamariamaterdei = { authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH9Le5OI4ympQ0mQKYHmxgxGF598rzpD5VVpWK1mGfd8 Sanctamariamaterdei Backupsystem" diff --git a/nixos/modules/mailman.nix b/nixos/modules/mailman.nix index 9f64466..d106c0f 100644 --- a/nixos/modules/mailman.nix +++ b/nixos/modules/mailman.nix @@ -37,7 +37,7 @@ in { proxy_interfaces = "130.83.2.184"; smtputf8_enable = "no"; # HRZ does not know SMTPUTF8 }; - relayHost = "mailout.hrz.tu-darmstadt.de"; # Relay to HRZ (see https://www.hrz.tu-darmstadt.de/services/it_services/email_infrastruktur/index.de.jsp) + relayHost = "192.168.0.24"; # Relay to eihort which relays to HRZ (see https://www.hrz.tu-darmstadt.de/services/it_services/email_infrastruktur/index.de.jsp) }; mailman = { enable = true; @@ -60,6 +60,7 @@ in { "/var/lib/mailman" "/var/lib/mailman-web" ]; + files = ["/root/.ssh/known_hosts"]; # for the backup server bragi }; security.acme.defaults.email = cfg.siteOwner; @@ -95,11 +96,25 @@ in { PrivateTmp = true; }; }; - sops.secrets.allowlistPass = { - sopsFile = ../machines/lobon/allowlistPass.yaml; - owner = "mailman"; - group = "mailman"; - mode = "0400"; + + # Backups + services.borgbackup.jobs.mailman = { + paths = [ + "/var/lib/mailman/data" + "/var/lib/mailman-web" + ]; + encryption.mode = "none"; # Otherwise the key is next to the backup or we have human interaction. + environment = { + BORG_RSH = "ssh -i /run/secrets/backupKey"; + # “Borg ensures that backups are not created on random drives that ‘just happen’ to contain a Borg repository.” + # https://borgbackup.readthedocs.io/en/stable/deployment/automated-local.html + # We don't want this in order to not need to persist borg cache and simplify new deployments. + BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK = "yes"; + }; + repo = "borg@192.168.1.11:lobon"; # TODO for https://gitea.mathebau.de/Fachschaft/nixConfig/issues/33 + startAt = "daily"; + user = "root"; + group = "root"; }; }; } From ace96d5f7cbb45663d281689cd06c235a1f82278 Mon Sep 17 00:00:00 2001 From: Gonne Date: Thu, 4 Apr 2024 17:13:12 +0200 Subject: [PATCH 16/17] Restrict HRZ allowlist update service privileges --- nixos/modules/mailman.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/nixos/modules/mailman.nix b/nixos/modules/mailman.nix index d106c0f..597a2f1 100644 --- a/nixos/modules/mailman.nix +++ b/nixos/modules/mailman.nix @@ -93,7 +93,25 @@ in { serviceConfig = { Type = "oneshot"; User = "mailman"; + NoNewPrivileges = true; + # See https://www.man7.org/linux/man-pages/man5/systemd.exec.5.html PrivateTmp = true; + ProtectHome = true; + ReadOnlyPaths = "/"; + ReadWritePaths = "/tmp"; + InaccessiblePaths = "-/lost+found"; + PrivateDevices = true; + PrivateUsers = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + LockPersonality = true; + MemoryDenyWriteExecute = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; }; }; From e7154785dd58d4c949bb604b2e7772fec7636848 Mon Sep 17 00:00:00 2001 From: Gonne Date: Sat, 12 Oct 2024 13:56:34 +0200 Subject: [PATCH 17/17] Disable TLS behind proxies and relays --- nixos/modules/mailman.nix | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/nixos/modules/mailman.nix b/nixos/modules/mailman.nix index 597a2f1..5cfa63d 100644 --- a/nixos/modules/mailman.nix +++ b/nixos/modules/mailman.nix @@ -29,8 +29,6 @@ in { postfix = { enable = true; relayDomains = ["hash:/var/lib/mailman/data/postfix_domains"]; - sslCert = config.security.acme.certs.${cfg.hostName}.directory + "/full.pem"; - sslKey = config.security.acme.certs.${cfg.hostName}.directory + "/key.pem"; config = { transport_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"]; local_recipient_maps = ["hash:/var/lib/mailman/data/postfix_lmtp"]; @@ -48,25 +46,17 @@ in { # Don't include confirmation tokens in reply addresses, because we would need to send them to HRZ otherwise. settings.mta.verp_confirmations = "no"; }; - nginx.virtualHosts.${cfg.hostName} = { - enableACME = true; # Get certificates (primarily for postfix) - forceSSL = false; # Don't use HTTPS behind the proxy - }; }; environment.persistence.${config.impermanence.name} = { directories = [ - "/var/lib/acme" # Persist TLS keys and account "/var/lib/mailman" "/var/lib/mailman-web" ]; files = ["/root/.ssh/known_hosts"]; # for the backup server bragi }; - security.acme.defaults.email = cfg.siteOwner; - security.acme.acceptTerms = true; - - networking.firewall.allowedTCPPorts = [25 80 443]; + networking.firewall.allowedTCPPorts = [25 80]; # Update HRZ allowlist # For account details see https://www-cgi.hrz.tu-darmstadt.de/mail/