summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authormakefu <makefu@tsp>2015-08-14 14:00:18 +0000
committermakefu <makefu@tsp>2015-08-14 14:00:18 +0000
commitd35de37b0d2b9d5d567a530726aa01f2ec686bf3 (patch)
tree8bcccdb27a1c0087668cd9d63bb294e71f4cb79a
parentc36ea0e029772649e33a727a9be15986cbb1fed2 (diff)
parentb8b2575d8313cfd0696a121cee1b8738faff6638 (diff)
Merge remote-tracking branch 'cd/master'
-rw-r--r--Zhosts/eulerwalk11
-rw-r--r--Zhosts/tmpd11
-rw-r--r--krebs/3modules/default.nix10
-rw-r--r--krebs/3modules/exim-retiolum.nix182
-rw-r--r--krebs/3modules/exim-smarthost.nix219
-rw-r--r--lass/1systems/mors.nix3
-rw-r--r--lass/1systems/uriel.nix18
-rw-r--r--lass/2configs/downloading.nix67
-rw-r--r--lass/2configs/fastpoke-pages.nix10
-rw-r--r--lass/2configs/wordpress.nix59
-rw-r--r--lass/3modules/folderPerms.nix104
-rw-r--r--tv/1systems/cd.nix54
-rw-r--r--tv/1systems/nomic.nix2
-rw-r--r--tv/1systems/wu.nix2
-rw-r--r--tv/2configs/exim-smarthost.nix475
15 files changed, 643 insertions, 584 deletions
diff --git a/Zhosts/eulerwalk b/Zhosts/eulerwalk
new file mode 100644
index 000000000..b6dbf43e0
--- /dev/null
+++ b/Zhosts/eulerwalk
@@ -0,0 +1,11 @@
+Subnet = 10.243.176.249
+Subnet = 42:7429:4e08:14cf:fb5d:9c17:76e5:ddcb
+
+-----BEGIN RSA PUBLIC KEY-----
+MIIBCgKCAQEAv0GyX62KaykRkN9f6ZgtAOPk1rr+ZFG6Il24crrkIJgx0He+VVjr
+XgXE7EaVwNjNm/7nIhGGWbCzravDIrRzQXzY+IQIzXwSPKv0WZkqFHZj122SIt9L
+QKtkGnECA136uH3AqbXoxhsz2FnuDunZ6gKAi6XIlq5Qr2Nyv0qKKaM0zTZZ4pI5
+PqsNfV6r2gc3jo/tOuxVgG86dMAEHLMdwjdBE6/49daGXyhsGG7Gh93c8UlyFKyt
+r6LC+4Oc1MCMtCbxsmE/iZWJtpUHAcQDzTcAynP916xg1PBLhczfWFCPR0LXOQGe
+MYSv34G0gZqPmkNJryi1MEFZ61zo/SiO9wIDAQAB
+-----END RSA PUBLIC KEY-----
diff --git a/Zhosts/tmpd b/Zhosts/tmpd
new file mode 100644
index 000000000..52db6b258
--- /dev/null
+++ b/Zhosts/tmpd
@@ -0,0 +1,11 @@
+Subnet = 10.243.235.99
+Subnet = 42:cd60:2f4b:3382:b9ba:74d7:5a13:ceb7
+
+-----BEGIN RSA PUBLIC KEY-----
+MIIBCgKCAQEAwSNjd1jYjsx+8JDRUV9QXhyMOrAIOMtKUGo/+Ufr+jHIY7h2BlQS
+6Jy7xjZv6zmHhEenhWs+P4qUCASXJPtZ7URgelA4NgkfVMsbgUQDM6VDZr0JwYXq
+csmp/9vxWRRbaNifG9x5+N50tMh9E5rMmDCV9ySWr3DAvDQckKAjfMtys2EWajW2
+sM02mXtMPAy5QgKNRvSbIVDnRjJyZpCkc5xNhv2rl7k+6RZltcec4IarIlnu5nv5
+f1cTAlPaWwGuyyXZeyFbzD0IAGJeWzCkt8+F8kOobRXJQbgDqYWLdH5BXagxBX4g
+VpDZTwdWU6oGph8m4kCg4vJCW1/XYOU1aQIDAQAB
+-----END RSA PUBLIC KEY-----
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index d77d00c05..a0d4f0157 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -7,6 +7,7 @@ let
out = {
imports = [
./exim-retiolum.nix
+ ./exim-smarthost.nix
./github-hosts-sync.nix
./git.nix
./nginx.nix
@@ -309,9 +310,11 @@ let
users = addNames {
lass = {
pubkey = readFile ../../Zpubkeys/lass.ssh.pub;
+ mail = "lass@mors.retiolum";
};
uriel = {
pubkey = readFile ../../Zpubkeys/uriel.ssh.pub;
+ mail = "uriel@mors.retiolum";
};
};
};
@@ -455,6 +458,13 @@ let
cd = {
cores = 2;
dc = "tv"; #dc = "cac";
+ extraZones = {
+ "de.krebsco" = ''
+ mx23 IN A ${elemAt nets.internet.addrs4 0}
+ cd IN A ${elemAt nets.internet.addrs4 0}
+ krebsco.de. IN MX 5 mx23
+ '';
+ };
nets = rec {
internet = {
addrs4 = ["162.219.7.216"];
diff --git a/krebs/3modules/exim-retiolum.nix b/krebs/3modules/exim-retiolum.nix
index 71c091917..e1315d8c8 100644
--- a/krebs/3modules/exim-retiolum.nix
+++ b/krebs/3modules/exim-retiolum.nix
@@ -8,11 +8,7 @@ let
out = {
options.krebs.exim-retiolum = api;
config =
- # This configuration makes only sense for retiolum-enabled hosts.
- # TODO modular configuration
- mkIf cfg.enable (
- #assert config.krebs.retiolum.enable;
- imp);
+ mkIf cfg.enable imp;
};
api = {
@@ -20,121 +16,125 @@ let
};
imp = {
- services.exim = {
- enable = true;
- config = ''
- primary_hostname = ${retiolumHostname}
- domainlist local_domains = @ : localhost
- domainlist relay_to_domains = *.retiolum
- hostlist relay_from_hosts = <; 127.0.0.1 ; ::1
+ services.exim =
+ # This configuration makes only sense for retiolum-enabled hosts.
+ # TODO modular configuration
+ assert config.krebs.retiolum.enable;
+ {
+ enable = true;
+ config = ''
+ primary_hostname = ${retiolumHostname}
+ domainlist local_domains = @ : localhost
+ domainlist relay_to_domains = *.retiolum
+ hostlist relay_from_hosts = <; 127.0.0.1 ; ::1
- acl_smtp_rcpt = acl_check_rcpt
- acl_smtp_data = acl_check_data
+ acl_smtp_rcpt = acl_check_rcpt
+ acl_smtp_data = acl_check_data
- host_lookup = *
- rfc1413_hosts = *
- rfc1413_query_timeout = 5s
+ host_lookup = *
+ rfc1413_hosts = *
+ rfc1413_query_timeout = 5s
- log_file_path = syslog
- syslog_timestamp = false
- syslog_duplication = false
+ log_file_path = syslog
+ syslog_timestamp = false
+ syslog_duplication = false
- begin acl
+ begin acl
- acl_check_rcpt:
- accept hosts = :
- control = dkim_disable_verify
+ acl_check_rcpt:
+ accept hosts = :
+ control = dkim_disable_verify
- deny message = Restricted characters in address
- domains = +local_domains
- local_parts = ^[.] : ^.*[@%!/|]
+ deny message = Restricted characters in address
+ domains = +local_domains
+ local_parts = ^[.] : ^.*[@%!/|]
- deny message = Restricted characters in address
- domains = !+local_domains
- local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
+ deny message = Restricted characters in address
+ domains = !+local_domains
+ local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
- accept local_parts = postmaster
- domains = +local_domains
+ accept local_parts = postmaster
+ domains = +local_domains
- #accept
- # hosts = *.retiolum
- # domains = *.retiolum
- # control = dkim_disable_verify
+ #accept
+ # hosts = *.retiolum
+ # domains = *.retiolum
+ # control = dkim_disable_verify
- #require verify = sender
+ #require verify = sender
- accept hosts = +relay_from_hosts
- control = submission
- control = dkim_disable_verify
+ accept hosts = +relay_from_hosts
+ control = submission
+ control = dkim_disable_verify
- accept authenticated = *
- control = submission
- control = dkim_disable_verify
+ accept authenticated = *
+ control = submission
+ control = dkim_disable_verify
- require message = relay not permitted
- domains = +local_domains : +relay_to_domains
+ require message = relay not permitted
+ domains = +local_domains : +relay_to_domains
- require verify = recipient
+ require verify = recipient
- accept
+ accept
- acl_check_data:
- accept
+ acl_check_data:
+ accept
- begin routers
+ begin routers
- retiolum:
- driver = manualroute
- domains = ! ${retiolumHostname} : *.retiolum
- transport = remote_smtp
- route_list = ^.* $0 byname
- no_more
+ retiolum:
+ driver = manualroute
+ domains = ! ${retiolumHostname} : *.retiolum
+ transport = remote_smtp
+ route_list = ^.* $0 byname
+ no_more
- nonlocal:
- debug_print = "R: nonlocal for $local_part@$domain"
- driver = redirect
- domains = ! +local_domains
- allow_fail
- data = :fail: Mailing to remote domains not supported
- no_more
+ nonlocal:
+ debug_print = "R: nonlocal for $local_part@$domain"
+ driver = redirect
+ domains = ! +local_domains
+ allow_fail
+ data = :fail: Mailing to remote domains not supported
+ no_more
- local_user:
- # debug_print = "R: local_user for $local_part@$domain"
- driver = accept
- check_local_user
- # local_part_suffix = +* : -*
- # local_part_suffix_optional
- transport = home_maildir
- cannot_route_message = Unknown user
+ local_user:
+ # debug_print = "R: local_user for $local_part@$domain"
+ driver = accept
+ check_local_user
+ # local_part_suffix = +* : -*
+ # local_part_suffix_optional
+ transport = home_maildir
+ cannot_route_message = Unknown user
- begin transports
+ begin transports
- remote_smtp:
- driver = smtp
+ remote_smtp:
+ driver = smtp
- home_maildir:
- driver = appendfile
- maildir_format
- directory = $home/Maildir
- directory_mode = 0700
- delivery_date_add
- envelope_to_add
- return_path_add
- # group = mail
- # mode = 0660
+ home_maildir:
+ driver = appendfile
+ maildir_format
+ directory = $home/Maildir
+ directory_mode = 0700
+ delivery_date_add
+ envelope_to_add
+ return_path_add
+ # group = mail
+ # mode = 0660
- begin retry
- *.retiolum * F,42d,1m
- * * F,2h,15m; G,16h,1h,1.5; F,4d,6h
+ begin retry
+ *.retiolum * F,42d,1m
+ * * F,2h,15m; G,16h,1h,1.5; F,4d,6h
- begin rewrite
+ begin rewrite
- begin authenticators
- '';
- };
+ begin authenticators
+ '';
+ };
};
# TODO get the hostname from somewhere else.
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
new file mode 100644
index 000000000..a564430ea
--- /dev/null
+++ b/krebs/3modules/exim-smarthost.nix
@@ -0,0 +1,219 @@
+{ config, pkgs, lib, ... }:
+
+with builtins;
+with lib;
+let
+ cfg = config.krebs.exim-smarthost;
+
+ out = {
+ options.krebs.exim-smarthost = api;
+ config = mkIf cfg.enable imp;
+ };
+
+ api = {
+ enable = mkEnableOption "krebs.exim-smarthost";
+
+ internet-aliases = mkOption {
+ type = types.listOf (types.submodule ({
+ options = {
+ from = mkOption {
+ type = types.str; # TODO e-mail address
+ };
+ to = mkOption {
+ type = types.str; # TODO e-mail address / TODO listOf
+ };
+ };
+ }));
+ };
+
+ relay_from_hosts = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+
+ primary_hostname = mkOption {
+ type = types.str;
+ default = "${config.networking.hostName}.retiolum";
+ };
+
+ sender_domains = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+
+ system-aliases = mkOption {
+ type = types.listOf (types.submodule ({
+ options = {
+ from = mkOption {
+ type = types.str; # TODO e-mail address
+ };
+ to = mkOption {
+ type = types.str; # TODO e-mail address / TODO listOf
+ };
+ };
+ }));
+ };
+ };
+
+ imp = {
+ services.exim = {
+ enable = true;
+ config = ''
+ primary_hostname = ${cfg.primary_hostname}
+
+ # HOST_REDIR contains the real destinations for "local_domains".
+ #HOST_REDIR = /etc/exim4/host_redirect
+
+
+ # Domains not listed in local_domains need to be deliverable remotely.
+ # XXX We abuse local_domains to mean "domains, we're the gateway for".
+ domainlist local_domains = @ : localhost
+ domainlist relay_to_domains =
+ hostlist relay_from_hosts = <;${concatStringsSep ";" (
+ [
+ "127.0.0.1"
+ "::1"
+ ]
+ ++
+ cfg.relay_from_hosts
+ )}
+
+ acl_smtp_rcpt = acl_check_rcpt
+ acl_smtp_data = acl_check_data
+
+ never_users = root
+
+ host_lookup = *
+
+ rfc1413_hosts = *
+ rfc1413_query_timeout = 5s
+
+ log_selector = -queue_run +address_rewrite +all_parents +queue_time
+ log_file_path = syslog
+ syslog_timestamp = false
+ syslog_duplication = false
+
+ begin acl
+
+ acl_check_rcpt:
+ accept hosts = :
+ control = dkim_disable_verify
+
+ deny message = Restricted characters in address
+ domains = +local_domains
+ local_parts = ^[.] : ^.*[@%!/|]
+
+ deny message = Restricted characters in address
+ domains = !+local_domains
+ local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
+
+ accept local_parts = postmaster
+ domains = +local_domains
+
+ accept hosts = +relay_from_hosts
+ control = submission
+ control = dkim_disable_verify
+
+ accept authenticated = *
+ control = submission
+ control = dkim_disable_verify
+
+ accept message = relay not permitted 2
+ recipients = lsearch;${lsearch.internet-aliases}
+
+ require message = relay not permitted
+ domains = +local_domains : +relay_to_domains
+
+ require
+ message = unknown user
+ verify = recipient/callout
+
+ accept
+
+
+ acl_check_data:
+ warn
+ sender_domains = ${concatStringsSep ":" cfg.sender_domains}
+ set acl_m_special_dom = $sender_address_domain
+
+ accept
+
+
+ begin routers
+
+ # feature RETIOLUM_MAIL
+ retiolum:
+ debug_print = "R: retiolum for $local_part@$domain"
+ driver = manualroute
+ domains = ! ${cfg.primary_hostname} : *.retiolum
+ transport = retiolum_smtp
+ route_list = ^.* $0 byname
+ no_more
+
+ internet_aliases:
+ debug_print = "R: internet_aliases for $local_part@$domain"
+ driver = redirect
+ data = ''${lookup{$local_part@$domain}lsearch{${lsearch.internet-aliases}}}
+
+ dnslookup:
+ debug_print = "R: dnslookup for $local_part@$domain"
+ driver = dnslookup
+ domains = ! +local_domains
+ transport = remote_smtp
+ ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
+ no_more
+
+ system_aliases:
+ debug_print = "R: system_aliases for $local_part@$domain"
+ driver = redirect
+ data = ''${lookup{$local_part}lsearch{${lsearch.system-aliases}}}
+
+ local_user:
+ debug_print = "R: local_user for $local_part@$domain"
+ driver = accept
+ check_local_user
+ transport = home_maildir
+ cannot_route_message = Unknown user
+
+ begin transports
+
+ retiolum_smtp:
+ driver = smtp
+ retry_include_ip_address = false
+
+ remote_smtp:
+ driver = smtp
+ helo_data = ''${if eq{$acl_m_special_dom}{} \
+ {$primary_hostname} \
+ {$acl_m_special_dom} }
+
+ home_maildir:
+ driver = appendfile
+ maildir_format
+ maildir_use_size_file
+ directory = $home/Mail
+ directory_mode = 0700
+ delivery_date_add
+ envelope_to_add
+ return_path_add
+
+ begin retry
+ *.retiolum * F,42d,1m
+ * * F,2h,15m; G,16h,1h,1.5; F,4d,6h
+
+ begin rewrite
+ begin authenticators
+ '';
+ };
+ };
+
+
+ lsearch = mapAttrs (name: set: toFile name (to-lsearch set)) {
+ inherit (cfg) internet-aliases;
+ inherit (cfg) system-aliases;
+ };
+
+ to-lsearch = concatMapStringsSep "\n" ({ from, to, ... }: "${from}: ${to}");
+
+in
+out
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index e7edcccea..e7f8d5276 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -20,6 +20,7 @@
../2configs/new-repos.nix
#../../2configs/tv/synaptics.nix
../2configs/retiolum.nix
+ ../2configs/wordpress.nix
];
krebs.build = {
@@ -29,7 +30,7 @@
deps = {
nixpkgs = {
url = https://github.com/Lassulus/nixpkgs;
- rev = "1879a011925c561f0a7fd4043da0768bbff41d0b";
+ rev = "961fd7b7a0f88dde7dac2f7a4c05ee4e1a25381d";
};
secrets = {
url = "/home/lass/secrets/${config.krebs.build.host.name}";
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 74d995560..041b891b6 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -3,15 +3,15 @@
with builtins;
{
imports = [
- ../../2configs/lass/desktop-base.nix
- ../../2configs/lass/browsers.nix
- ../../2configs/lass/games.nix
- ../../2configs/lass/pass.nix
- ../../2configs/lass/urxvt.nix
- ../../2configs/lass/bird.nix
- ../../2configs/lass/new-repos.nix
- ../../2configs/lass/chromium-patched.nix
- ../../2configs/lass/retiolum.nix
+ ../2configs/desktop-base.nix
+ ../2configs/browsers.nix
+ ../2configs/games.nix
+ ../2configs/pass.nix
+ ../2configs/urxvt.nix
+ ../2configs/bird.nix
+ ../2configs/new-repos.nix
+ ../2configs/chromium-patched.nix
+ ../2configs/retiolum.nix
{
users.extraUsers = {
root = {
diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix
new file mode 100644
index 000000000..e6d31a6c4
--- /dev/null
+++ b/lass/2configs/downloading.nix
@@ -0,0 +1,67 @@
+{ config, pkgs, ... }:
+
+{
+ imports = [
+ ../3modules/iptables.nix
+ ../3modules/folderPerms.nix
+ ];
+
+ users.extraUsers = {
+ download = {
+ name = "download";
+ home = "/var/download";
+ createHome = true;
+ extraGroups = [
+ "download"
+ ];
+ };
+
+ transmission = {
+ extraGroups = [
+ "download"
+ ];
+ };
+ };
+
+ users.extraGroups = {
+ download = {
+ members = [
+ "download"
+ "transmission"
+ ];
+ };
+ };
+
+ services.transmission = {
+ enable = true;
+ settings = {
+ download-dir = "/var/download/finished";
+ incomplete-dir = "/var/download/incoming";
+ incomplete-dir-enabled = true;
+
+ rpc-authentication-required = true;
+ rpc-whitelist-enabled = false;
+ rpc-username = "download";
+ #add rpc-password in secrets
+ rpc-password = "test123";
+ };
+ };
+
+ lass.iptables = {
+ enable = true;
+ tables.filter.INPUT.rules = [
+ { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; }
+ ];
+ };
+
+ lass.folderPerms = {
+ enable = true;
+ permissions = [
+ {
+ path = "/var/download";
+ permission = "775";
+ owner = "transmission:download";
+ }
+ ];
+ };
+}
diff --git a/lass/2configs/fastpoke-pages.nix b/lass/2configs/fastpoke-pages.nix
index 9c80fa77a..1c8106a88 100644
--- a/lass/2configs/fastpoke-pages.nix
+++ b/lass/2configs/fastpoke-pages.nix
@@ -20,8 +20,8 @@ let
# 10.243.206.102 ${domain}
#'';
users.extraUsers = {
- "${domain}" = {
- name = "${domain}";
+ ${domain} = {
+ name = domain;
home = "/var/lib/http/${domain}";
createHome = true;
};
@@ -90,9 +90,9 @@ in {
};
};
- services.postgresql = {
- enable = true;
- };
+ #services.postgresql = {
+ # enable = true;
+ #};
#config.services.vsftpd = {
# enable = true;
diff --git a/lass/2configs/wordpress.nix b/lass/2configs/wordpress.nix
new file mode 100644
index 000000000..9458deb38
--- /dev/null
+++ b/lass/2configs/wordpress.nix
@@ -0,0 +1,59 @@
+{ config, pkgs, ... }:
+
+{
+ containers.wordpress = {
+ privateNetwork = true;
+ hostAddress = "192.168.101.1";
+ localAddress = "192.168.101.2";
+
+ config = {
+ imports = [
+ ../3modules/iptables.nix
+ ];
+
+ lass.iptables = {
+ enable = true;
+ tables = {
+ filter.INPUT.policy = "DROP";
+ filter.FORWARD.policy = "DROP";
+ filter.INPUT.rules = [
+ { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; }
+ { predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; }
+ { predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; }
+ { predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; }
+ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; }
+ ];
+ };
+ };
+
+ environment.systemPackages = with pkgs; [
+ iptables
+ ];
+
+ services.postgresql = {
+ enable = true;
+ package = pkgs.postgresql;
+ };
+
+ services.httpd = {
+ enable = true;
+ adminAddr = "root@apanowicz.de";
+ extraModules = [
+ { name = "php5"; path = "${pkgs.php}/modules/libphp5.so"; }
+ ];
+ virtualHosts = [
+ {
+ hostName = "wordpress";
+ serverAliases = [ "wordpress" "www.wordpress" ];
+
+ extraSubservices = [
+ {
+ serviceName = "wordpress";
+ }
+ ];
+ }
+ ];
+ };
+ };
+ };
+}
diff --git a/lass/3modules/folderPerms.nix b/lass/3modules/folderPerms.nix
new file mode 100644
index 000000000..bb0320327
--- /dev/null
+++ b/lass/3modules/folderPerms.nix
@@ -0,0 +1,104 @@
+{ config, lib, pkgs, ... }:
+
+#TODO: implement recursive mode maybe?
+# enable different mods for files and folders
+
+let
+ inherit (pkgs)
+ writeScript
+ ;
+
+ inherit (lib)
+ concatMapStringsSep
+ concatStringsSep
+ mkEnableOption
+ mkIf
+ mkOption
+ types
+ ;
+
+ cfg = config.lass.folderPerms;
+
+ out = {
+ options.lass.folderPerms = api;
+ config = mkIf cfg.enable imp;
+ };
+
+ api = {
+ enable = mkEnableOption "folder permissions";
+ permissions = mkOption {
+ type = with types; listOf (submodule ({
+ options = {
+ path = mkOption {
+ type = str;
+ };
+ permission = mkOption {
+ type = nullOr str;
+ example = "755";
+ description = ''
+ basically anything that chmod takes as permission
+ '';
+ default = null;
+ };
+ owner = mkOption {
+ type = nullOr str;
+ example = "root:root";
+ description = ''
+ basically anything that chown takes as owner
+ '';
+ default = null;
+ };
+ };
+ }));
+ };
+ };
+
+ imp = {
+ systemd.services.lass-folderPerms = {
+ description = "lass-folderPerms";
+ wantedBy = [ "multi-user.target" ];
+
+ path = with pkgs; [
+ coreutils
+ ];
+
+ restartIfChanged = true;
+
+ serviceConfig = {
+ type = "simple";
+ RemainAfterExit = true;
+ Restart = "always";
+ ExecStart = "@${startScript}";
+ };
+ };
+ };
+
+ startScript = writeScript "lass-folderPerms" ''
+ ${concatMapStringsSep "\n" writeCommand cfg.permissions}
+ '';
+
+ writeCommand = fperm:
+ concatStringsSep "\n" [
+ (buildPermission fperm)
+ (buildOwner fperm)
+ ];
+
+ buildPermission = perm:
+ #TODO: create folder maybe
+ #TODO: check if permission is valid
+ if (perm.permission == null) then
+ ""
+ else
+ "chmod ${perm.permission} ${perm.path}"
+ ;
+
+ buildOwner = perm:
+ #TODO: create folder maybe
+ #TODO: check if owner/group valid
+ if (perm.owner == null) then
+ ""
+ else
+ "chown ${perm.owner} ${perm.path}"
+ ;
+
+in out
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 54292eb83..659b95065 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -30,7 +30,6 @@ in
../2configs/CAC-CentOS-7-64bit.nix
../2configs/base.nix
../2configs/consul-server.nix
- ../2configs/exim-smarthost.nix
../2configs/git.nix
{
imports = [ ../2configs/charybdis.nix ];
@@ -46,6 +45,59 @@ in
};
}
{
+ krebs.exim-smarthost = {
+ enable = true;
+ primary_hostname = "${config.networking.hostName}.retiolum";
+ sender_domains = [
+ "shackspace.de"
+ "viljetic.de"
+ ];
+ relay_from_hosts = [
+ "10.243.13.37"
+ ];
+ internet-aliases = with config.krebs.users; [
+ { from = "tomislav@viljetic.de"; to = tv.mail; }
+
+ # (mindestens) lisp-stammtisch und elli haben die:
+ { from = "tv@viljetic.de"; to = tv.mail; }
+
+ { from = "tv@destroy.dyn.shackspace.de"; to = tv.mail; }
+
+ { from = "mirko@viljetic.de"; to = mv.mail; }
+
+ # TODO killme (wo wird die benutzt?)
+ { from = "tv@cd.retiolum"; to = tv.mail; }
+
+ # TODO lists@smtp.retiolum [consul]
+ { from = "postmaster@krebsco.de"; to = tv.mail; }
+
+ { from = "spam@krebsco.de";
+ to = pkgs.lib.concatStringsSep "," [
+ tv.mail
+ "lass@mors.retiolum"
+ makefu.mail
+ ];
+ }
+ ];
+ system-aliases = [
+ { from = "mailer-daemon"; to = "postmaster"; }
+ { from = "postmaster"; to = "root"; }
+ { from = "nobody"; to = "root"; }
+ { from = "hostmaster"; to = "root"; }
+ { from = "usenet"; to = "root"; }
+ { from = "news"; to = "root"; }
+ { from = "webmaster"; to = "root"; }
+ { from = "www"; to = "root"; }
+ { from = "ftp"; to = "root"; }
+ { from = "abuse"; to = "root"; }
+ { from = "noc"; to = "root"; }
+ { from = "security"; to = "root"; }
+ { from = "root"; to = "tv"; }
+ { from = "mirko"; to = "mv"; }
+ ];
+ };
+ }
+ {
krebs.github-hosts-sync.enable = true;
tv.iptables.input-internet-accept-new-tcp =
singleton config.krebs.github-hosts-sync.port;
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 896c1ad29..6418cdc5e 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -38,7 +38,7 @@ with lib;
};
}
{
- krebs.exim-retiolum = true;
+ krebs.exim-retiolum.enable = true;
}
{
krebs.nginx = {
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index a5cbde3ec..20dbca12f 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -165,7 +165,7 @@ in
};
}
{
- krebs.exim-retiolum = true;
+ krebs.exim-retiolum.ena