From 5bc6d6a99674d50d197bb62268c85bdc7b620ed2 Mon Sep 17 00:00:00 2001 From: chayleaf Date: Wed, 17 May 2023 06:29:03 +0700 Subject: [PATCH] bikeshedding --- system/flake.nix | 2 +- system/hosts/nixserver/default.nix | 65 ++++----------------------- system/hosts/nixserver/fdroid.nix | 3 ++ system/hosts/nixserver/mailserver.nix | 56 +++++++++++++++++++++++ system/hosts/nixserver/matrix.nix | 4 +- system/hosts/nixserver/maubot.nix | 5 ++- system/hosts/nixserver/mumble.nix | 2 +- system/hosts/nixserver/options.nix | 13 ++---- system/modules/common.nix | 2 +- 9 files changed, 80 insertions(+), 72 deletions(-) create mode 100644 system/hosts/nixserver/mailserver.nix diff --git a/system/flake.nix b/system/flake.nix index 30d0e78..4896261 100644 --- a/system/flake.nix +++ b/system/flake.nix @@ -36,7 +36,7 @@ inherit nixpkgs; }; lib = nixpkgs.lib // { - quotePotentialIpV6 = addr: + quoteListenAddr = addr: if nixpkgs.lib.hasInfix ":" addr then "[${addr}]" else addr; }; specialArgs = { diff --git a/system/hosts/nixserver/default.nix b/system/hosts/nixserver/default.nix index cfc69b6..d953cb9 100644 --- a/system/hosts/nixserver/default.nix +++ b/system/hosts/nixserver/default.nix @@ -34,6 +34,7 @@ in { ./matrix.nix ./fdroid.nix ./mumble.nix + ./mailserver.nix ]; system.stateVersion = "22.11"; @@ -75,11 +76,7 @@ in { path = /persist; directories = [ { directory = /var/www/${cfg.domainName}; } - { directory = /var/lib/maubot; } - { directory = /var/lib/fdroid; } - { directory = config.mailserver.dkimKeyDirectory; } - { directory = config.mailserver.mailDirectory; } - { directory = /home/user; } + { directory = /home/${config.common.mainUsername}; } { directory = /root; } { directory = /nix; } ]; @@ -109,12 +106,12 @@ in { allowedUDPPorts = [ # dns 53 853 - # wireguard - # 5553 ]; }; # UNBOUND + users.users.${config.common.mainUsername}.extraGroups = [ config.services.unbound.group ]; + services.unbound = { enable = true; package = pkgs.unbound-with-systemd.override { @@ -166,8 +163,6 @@ in { startWhenNeeded = false; }; - users.users.user.extraGroups = [ config.services.unbound.group ]; - services.postgresql.enable = true; services.postgresql.package = pkgs.postgresql_13; @@ -203,7 +198,7 @@ in { }); services.searx.runInUwsgi = true; services.searx.uwsgiConfig = let inherit (config.services.searx) settings; in { - socket = "${lib.quotePotentialIpV6 settings.server.bind_address}:${toString settings.server.port}"; + socket = "${lib.quoteListenAddr settings.server.bind_address}:${toString settings.server.port}"; }; services.searx.environmentFile = /var/lib/searx/searx.env; services.searx.settings = { @@ -239,9 +234,9 @@ in { services.nginx.virtualHosts."search.${cfg.domainName}" = let inherit (config.services.searx) settings; in { enableACME = true; forceSSL = true; - # locations."/".proxyPass = "http://${lib.quotePotentialIpV6 settings.server.bind_address}:${toString settings.server.port}"; + # locations."/".proxyPass = "http://${lib.quoteListenAddr settings.server.bind_address}:${toString settings.server.port}"; locations."/".extraConfig = '' - uwsgi_pass "${lib.quotePotentialIpV6 settings.server.bind_address}:${toString settings.server.port}"; + uwsgi_pass "${lib.quoteListenAddr settings.server.bind_address}:${toString settings.server.port}"; include ${config.services.nginx.package}/conf/uwsgi_params; ''; }; @@ -295,55 +290,11 @@ in { globalRedirect = cfg.domainName; }; - # MAILSERVER - # roundcube - services.nginx.virtualHosts."mail.${cfg.domainName}" = { - enableACME = true; - }; - services.roundcube = { - enable = true; - package = pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login ]); - dicts = with pkgs.aspellDicts; [ en ru ]; - hostName = "mail.${cfg.domainName}"; - maxAttachmentSize = 100; - plugins = [ "persistent_login" ]; - }; - mailserver = { - enable = true; - fqdn = "mail.${cfg.domainName}"; - domains = [ cfg.domainName ]; - certificateScheme = 1; - certificateFile = config.security.acme.certs."mail.${cfg.domainName}".directory + "/fullchain.pem"; - keyFile = config.security.acme.certs."mail.${cfg.domainName}".directory + "/key.pem"; - localDnsResolver = false; - recipientDelimiter = "-"; - lmtpSaveToDetailMailbox = "no"; - hierarchySeparator = "/"; - }; - - # Only allow local connections to noreply account - mailserver.loginAccounts."noreply@${cfg.domainName}" = { - # password is set in private.nix - hashedPassword = cfg.hashedNoreplyPassword; - sendOnly = true; - }; - services.dovecot2.extraConfig = - let - passwd = builtins.toFile "dovecot2-local-passwd" '' - noreply@${cfg.domainName}:{plain}${cfg.unhashedNoreplyPassword}::::::allow_nets=local,127.0.0.0/8,::1 - ''; - in '' - passdb { - driver = passwd-file - args = ${passwd} - } - ''; - # GITEA services.nginx.virtualHosts."git.${cfg.domainName}" = let inherit (config.services.gitea) settings; in { enableACME = true; forceSSL = true; - locations."/".proxyPass = "http://${lib.quotePotentialIpV6 settings.server.HTTP_ADDR}:${toString settings.server.HTTP_PORT}"; + locations."/".proxyPass = "http://${lib.quoteListenAddr settings.server.HTTP_ADDR}:${toString settings.server.HTTP_PORT}"; }; services.gitea = { enable = true; diff --git a/system/hosts/nixserver/fdroid.nix b/system/hosts/nixserver/fdroid.nix index dbb89d9..a7d0111 100644 --- a/system/hosts/nixserver/fdroid.nix +++ b/system/hosts/nixserver/fdroid.nix @@ -5,6 +5,9 @@ let cfg = config.server; in { + impermanence.directories = [ + { directory = /var/lib/fdroid; user = "fdroid"; group = "fdroid"; mode = "0755"; } + ]; services.nginx.virtualHosts."${cfg.domainName}" = { locations."/fdroid/".alias = "/var/lib/fdroid/repo/"; }; diff --git a/system/hosts/nixserver/mailserver.nix b/system/hosts/nixserver/mailserver.nix new file mode 100644 index 0000000..238dbeb --- /dev/null +++ b/system/hosts/nixserver/mailserver.nix @@ -0,0 +1,56 @@ +{ config +, pkgs +, ... }: + +let + cfg = config.server; +in { + impermanence.directories = [ + { directory = config.mailserver.dkimKeyDirectory; user = "opendkim"; group = "opendkim"; mode = "0755"; } + { directory = config.mailserver.mailDirectory; user = "virtualMail"; group = "virtualMail"; mode = "0700"; } + ]; + + # roundcube + # TODO: fix sending mail via roundcube + services.nginx.virtualHosts."mail.${cfg.domainName}" = { + enableACME = true; + }; + services.roundcube = { + enable = true; + package = pkgs.roundcube.withPlugins (plugins: [ plugins.persistent_login ]); + dicts = with pkgs.aspellDicts; [ en ru ]; + hostName = "mail.${cfg.domainName}"; + maxAttachmentSize = 100; + plugins = [ "persistent_login" ]; + }; + mailserver = { + enable = true; + fqdn = "mail.${cfg.domainName}"; + domains = [ cfg.domainName ]; + certificateScheme = 1; + certificateFile = config.security.acme.certs."mail.${cfg.domainName}".directory + "/fullchain.pem"; + keyFile = config.security.acme.certs."mail.${cfg.domainName}".directory + "/key.pem"; + localDnsResolver = false; + recipientDelimiter = "-"; + lmtpSaveToDetailMailbox = "no"; + hierarchySeparator = "/"; + }; + + # Only allow local connections to noreply account + mailserver.loginAccounts."noreply@${cfg.domainName}" = { + # password is set in private.nix + hashedPassword = cfg.hashedNoreplyPassword; + sendOnly = true; + }; + services.dovecot2.extraConfig = + let + passwd = builtins.toFile "dovecot2-local-passwd" '' + noreply@${cfg.domainName}:{plain}${cfg.unhashedNoreplyPassword}::::::allow_nets=local,127.0.0.0/8,::1 + ''; + in '' + passdb { + driver = passwd-file + args = ${passwd} + } + ''; +} diff --git a/system/hosts/nixserver/matrix.nix b/system/hosts/nixserver/matrix.nix index 697b604..029db3e 100644 --- a/system/hosts/nixserver/matrix.nix +++ b/system/hosts/nixserver/matrix.nix @@ -39,7 +39,7 @@ in { locations = { "= /.well-known/matrix/server".extraConfig = matrixServerConfigResponse; "= /.well-known/matrix/client".extraConfig = matrixClientConfigResponse; - "/".proxyPass = "http://${lib.quotePotentialIpV6 matrixAddr}:${toString matrixPort}"; + "/".proxyPass = "http://${lib.quoteListenAddr matrixAddr}:${toString matrixPort}"; }; }; @@ -47,7 +47,7 @@ in { systemd.services.heisenbridge.after = [ "matrix-synapse.service" ]; services.heisenbridge = { enable = true; - homeserver = "http://${lib.quotePotentialIpV6 matrixAddr}:${toString matrixPort}/"; + homeserver = "http://${lib.quoteListenAddr matrixAddr}:${toString matrixPort}/"; }; # so synapse can read the registration users.groups.heisenbridge.members = [ "matrix-synapse" ]; diff --git a/system/hosts/nixserver/maubot.nix b/system/hosts/nixserver/maubot.nix index 1a141f6..5816785 100644 --- a/system/hosts/nixserver/maubot.nix +++ b/system/hosts/nixserver/maubot.nix @@ -9,9 +9,12 @@ let maubotAddr = "127.0.0.1"; maubotPort = 29316; in { + impermanence.directories = [ + { directory = /var/lib/maubot; user = "maubot"; group = "maubot"; mode = "0755"; } + ]; services.nginx.virtualHosts."matrix.${cfg.domainName}".locations = { "/_matrix/maubot/" = { - proxyPass = "http://${lib.quotePotentialIpV6 maubotAddr}:${toString maubotPort}"; + proxyPass = "http://${lib.quoteListenAddr maubotAddr}:${toString maubotPort}"; proxyWebsockets = true; }; }; diff --git a/system/hosts/nixserver/mumble.nix b/system/hosts/nixserver/mumble.nix index bc6b45b..b017c32 100644 --- a/system/hosts/nixserver/mumble.nix +++ b/system/hosts/nixserver/mumble.nix @@ -33,7 +33,7 @@ in { forceSSL = true; globalRedirect = cfg.domainName; locations."/music".extraConfig = "return 301 https://mumble.${cfg.domainName}/music/;"; - locations."/music/".proxyPass = "http://${lib.quotePotentialIpV6 settings.webinterface.listening_addr}:${toString settings.webinterface.listening_port}/"; + locations."/music/".proxyPass = "http://${lib.quoteListenAddr settings.webinterface.listening_addr}:${toString settings.webinterface.listening_port}/"; }; services.botamusique = { diff --git a/system/hosts/nixserver/options.nix b/system/hosts/nixserver/options.nix index 11d3875..d7fc0e3 100644 --- a/system/hosts/nixserver/options.nix +++ b/system/hosts/nixserver/options.nix @@ -12,7 +12,7 @@ lanCidrV4 = mkOption { type = types.str; description = "LAN mask (IPv4)"; - example = "192.168.1.0/96"; + example = "192.168.1.0/24"; default = "0.0.0.0/0"; }; lanCidrV6 = mkOption { @@ -33,19 +33,14 @@ example = "fd01:abcd::2"; default = null; }; - noreplyPassword = mkOption { - type = types.str; - description = "noreply (only available via localhost) account password"; - default = "totallysafe"; - }; hashedNoreplyPassword = mkOption { type = types.str; - description = "hashed noreply password via mkpasswd -sm bcrypt"; + description = "hashed noreply password via mkpasswd -sm bcrypt for external access"; }; unhashedNoreplyPassword = mkOption { type = types.str; - description = "unhashed noreply password. \ - This should preferably be different from the password that is hashed for better security (yes, really)"; + description = "unhashed noreply password for internal access only. \ + This should be different from the password that is hashed for better security"; }; pizzabotMagic = mkOption { type = types.str; diff --git a/system/modules/common.nix b/system/modules/common.nix index 5712d16..1a88092 100644 --- a/system/modules/common.nix +++ b/system/modules/common.nix @@ -10,7 +10,7 @@ workstation = mkOption { type = types.bool; default = false; - description = "whether this device is a workstation (meaning a device for personal use rather than a server)"; + description = "whether this device is a workstation (meaning a device for personal use rather than a server/embedded device)"; }; mainUsername = mkOption { type = types.str;