summaryrefslogtreecommitdiffstats
path: root/krebs
diff options
context:
space:
mode:
Diffstat (limited to 'krebs')
-rw-r--r--krebs/3modules/default.nix98
-rw-r--r--krebs/3modules/exim-smarthost.nix219
-rw-r--r--krebs/4lib/types.nix11
-rw-r--r--krebs/5pkgs/default.nix1
-rw-r--r--krebs/5pkgs/posix-array.nix31
5 files changed, 344 insertions, 16 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 467cc4459..a0d4f0157 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -7,6 +7,7 @@ let
out = {
imports = [
./exim-retiolum.nix
+ ./exim-smarthost.nix
./github-hosts-sync.nix
./git.nix
./nginx.nix
@@ -184,7 +185,42 @@ let
) host.nets
) cfg.hosts
));
- }
+
+ # krebs.hosts.bob = rec {
+ # addrs4 = "10.0.0.1";
+ # extraZones = {
+ # # extraZones
+ # "krebsco.de" = ''
+ # krebsco.de. IN MX 10 mx1
+ # mx1 IN A ${addrs4}
+ # '';
+ # "dickbutt.de" = ''
+ # dickbutt.de. IN NS ns
+ # ns IN A ${addrs4}
+ # ''
+ # }
+ # }
+ # krebs.hosts.khan = rec {
+ # addrs4 = "10.0.0.2";
+ # extraZones = {
+ # "krebsco.de" = ''
+ # khan.krebsco.de IN A ${addrs4}
+ # };
+ # }
+ #
+ # =>
+ # "zone/krebsco.de".text = ''
+ # krebsco.de. IN MX 10 mx1
+ # mx1 IN A 10.0.0.1
+ # khan.krebsco.de IN A 10.0.0.2
+ # '';
+
+
+ environment.etc = mapAttrs'
+ (name: value:
+ nameValuePair (("zones/" + name)) ({ text=value;}))
+ cfg.hosts.pigstarter.extraZones;
+ }
];
lass-imp = {
@@ -274,9 +310,11 @@ let
users = addNames {
lass = {
pubkey = readFile ../../Zpubkeys/lass.ssh.pub;
+ mail = "lass@mors.retiolum";
};
uriel = {
pubkey = readFile ../../Zpubkeys/uriel.ssh.pub;
+ mail = "uriel@mors.retiolum";
};
};
};
@@ -335,9 +373,47 @@ let
};
};
};
- pigstarter = {
+ pornocauster = {
+ cores = 2;
+ dc = "makefu"; #x220
+ nets = {
+ retiolum = {
+ addrs4 = ["10.243.0.91"];
+ addrs6 = ["42:0b2c:d90e:e717:03dc:9ac1:7c30:a4db"];
+ aliases = [
+ "pornocauster.retiolum"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIICCgKCAgEAwW+RjRcp3uarkfXZ+FcCYY2GFcfI595GDpLRuiS/YQAB3JZEirHi
+ HFhDJN80fZ9qHqtq9Af462xSx+cIb282TxAqCM1Z9buipOcYTYo0m8xIqkT10dB3
+ mR87B+Ed1H6G3J6isdwEb9ZMegyGIIeyR53FJQYMZXjxdJbAmGMDKqjZSk1D5mo+
+ n5Vx3lGzTuDy84VyphfO2ypG48RHCxHUAx4Yt3o84LKoiy/y5E66jaowCOjZ6SqG
+ R0cymuhoBhMIk2xAXk0Qn7MZ1AOm9N7Wru7FXyoLc7B3+Gb0/8jXOJciysTG7+Gr
+ Txza6fJvq2FaH8iBnfezSELmicIYhc8Ynlq4xElcHhQEmRTQavVe/LDhJ0i6xJSi
+ aOu0njnK+9xK+MyDkB7n8dO1Iwnn7aG4n3CjVBB4BDO08lrovD3zdpDX0xhWgPRo
+ ReOJ3heRO/HsVpzxKlqraKWoHuOXXcREfU9cj3F6CRd0ECOhqtFMEr6TnuSc8GaE
+ KCKxY1oN45NbEFOCv2XKd2wEZFH37LFO6xxzSRr1DbVuKRYIPjtOiFKpwN1TIT8v
+ XGzTT4TJpBGnq0jfhFwhVjfCjLuGj29MCkvg0nqObQ07qYrjdQI4W1GnGOuyXkvQ
+ teyxjUXYbp0doTGxKvQaTWp+JapeEaJPN2MDOhrRFjPrzgo3aW9+97UCAwEAAQ==
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ };
+ pigstarter = rec {
cores = 1;
- dc = "makefu"; #x200
+ dc = "frontrange"; #vps
+
+ extraZones = {
+ "de.krebsco" = ''
+ pigstarter.krebsco.de IN A ${elemAt nets.internet.addrs4 0}
+ krebsco.de. IN NS io
+ io IN A ${elemAt nets.internet.addrs4 0}
+ krebsco.de. IN MX 10 mx42
+ mx42 IN A ${elemAt nets.internet.addrs4 0}
+ '';
+ };
nets = {
internet = {
addrs4 = ["192.40.56.122"];
@@ -345,13 +421,6 @@ let
aliases = [
"pigstarter.internet"
];
- zones = [
- { "pigstarter.krebsco.de" = "A";}
- { "io.krebsco.de" = "NS";}
- { "io.krebsco.de" = "A";}
- { "mx42.krebsco.de" = "MX";}
- { "mx42.krebsco.de" = "A";}
- ];
};
retiolum = {
addrs4 = ["10.243.0.153"];
@@ -375,7 +444,7 @@ let
};
users = addNames {
makefu = {
- mail = "root@euer.krebsco.de";
+ mail = "root@tsp.retiolum";
pubkey = readFile ../../Zpubkeys/makefu_arch.ssh.pub;
};
};
@@ -389,6 +458,13 @@ let
cd = {
cores = 2;
dc = "tv"; #dc = "cac";
+ extraZones = {
+ "de.krebsco" = ''
+ mx23 IN A ${elemAt nets.internet.addrs4 0}
+ cd IN A ${elemAt nets.internet.addrs4 0}
+ krebsco.de. IN MX 5 mx23
+ '';
+ };
nets = rec {
internet = {
addrs4 = ["162.219.7.216"];
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
new file mode 100644
index 000000000..a564430ea
--- /dev/null
+++ b/krebs/3modules/exim-smarthost.nix
@@ -0,0 +1,219 @@
+{ config, pkgs, lib, ... }:
+
+with builtins;
+with lib;
+let
+ cfg = config.krebs.exim-smarthost;
+
+ out = {
+ options.krebs.exim-smarthost = api;
+ config = mkIf cfg.enable imp;
+ };
+
+ api = {
+ enable = mkEnableOption "krebs.exim-smarthost";
+
+ internet-aliases = mkOption {
+ type = types.listOf (types.submodule ({
+ options = {
+ from = mkOption {
+ type = types.str; # TODO e-mail address
+ };
+ to = mkOption {
+ type = types.str; # TODO e-mail address / TODO listOf
+ };
+ };
+ }));
+ };
+
+ relay_from_hosts = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+
+ primary_hostname = mkOption {
+ type = types.str;
+ default = "${config.networking.hostName}.retiolum";
+ };
+
+ sender_domains = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+
+ system-aliases = mkOption {
+ type = types.listOf (types.submodule ({
+ options = {
+ from = mkOption {
+ type = types.str; # TODO e-mail address
+ };
+ to = mkOption {
+ type = types.str; # TODO e-mail address / TODO listOf
+ };
+ };
+ }));
+ };
+ };
+
+ imp = {
+ services.exim = {
+ enable = true;
+ config = ''
+ primary_hostname = ${cfg.primary_hostname}
+
+ # HOST_REDIR contains the real destinations for "local_domains".
+ #HOST_REDIR = /etc/exim4/host_redirect
+
+
+ # Domains not listed in local_domains need to be deliverable remotely.
+ # XXX We abuse local_domains to mean "domains, we're the gateway for".
+ domainlist local_domains = @ : localhost
+ domainlist relay_to_domains =
+ hostlist relay_from_hosts = <;${concatStringsSep ";" (
+ [
+ "127.0.0.1"
+ "::1"
+ ]
+ ++
+ cfg.relay_from_hosts
+ )}
+
+ acl_smtp_rcpt = acl_check_rcpt
+ acl_smtp_data = acl_check_data
+
+ never_users = root
+
+ host_lookup = *
+
+ rfc1413_hosts = *
+ rfc1413_query_timeout = 5s
+
+ log_selector = -queue_run +address_rewrite +all_parents +queue_time
+ log_file_path = syslog
+ syslog_timestamp = false
+ syslog_duplication = false
+
+ begin acl
+
+ acl_check_rcpt:
+ accept hosts = :
+ control = dkim_disable_verify
+
+ deny message = Restricted characters in address
+ domains = +local_domains
+ local_parts = ^[.] : ^.*[@%!/|]
+
+ deny message = Restricted characters in address
+ domains = !+local_domains
+ local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
+
+ accept local_parts = postmaster
+ domains = +local_domains
+
+ accept hosts = +relay_from_hosts
+ control = submission
+ control = dkim_disable_verify
+
+ accept authenticated = *
+ control = submission
+ control = dkim_disable_verify
+
+ accept message = relay not permitted 2
+ recipients = lsearch;${lsearch.internet-aliases}
+
+ require message = relay not permitted
+ domains = +local_domains : +relay_to_domains
+
+ require
+ message = unknown user
+ verify = recipient/callout
+
+ accept
+
+
+ acl_check_data:
+ warn
+ sender_domains = ${concatStringsSep ":" cfg.sender_domains}
+ set acl_m_special_dom = $sender_address_domain
+
+ accept
+
+
+ begin routers
+
+ # feature RETIOLUM_MAIL
+ retiolum:
+ debug_print = "R: retiolum for $local_part@$domain"
+ driver = manualroute
+ domains = ! ${cfg.primary_hostname} : *.retiolum
+ transport = retiolum_smtp
+ route_list = ^.* $0 byname
+ no_more
+
+ internet_aliases:
+ debug_print = "R: internet_aliases for $local_part@$domain"
+ driver = redirect
+ data = ''${lookup{$local_part@$domain}lsearch{${lsearch.internet-aliases}}}
+
+ dnslookup:
+ debug_print = "R: dnslookup for $local_part@$domain"
+ driver = dnslookup
+ domains = ! +local_domains
+ transport = remote_smtp
+ ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
+ no_more
+
+ system_aliases:
+ debug_print = "R: system_aliases for $local_part@$domain"
+ driver = redirect
+ data = ''${lookup{$local_part}lsearch{${lsearch.system-aliases}}}
+
+ local_user:
+ debug_print = "R: local_user for $local_part@$domain"
+ driver = accept
+ check_local_user
+ transport = home_maildir
+ cannot_route_message = Unknown user
+
+ begin transports
+
+ retiolum_smtp:
+ driver = smtp
+ retry_include_ip_address = false
+
+ remote_smtp:
+ driver = smtp
+ helo_data = ''${if eq{$acl_m_special_dom}{} \
+ {$primary_hostname} \
+ {$acl_m_special_dom} }
+
+ home_maildir:
+ driver = appendfile
+ maildir_format
+ maildir_use_size_file
+ directory = $home/Mail
+ directory_mode = 0700
+ delivery_date_add
+ envelope_to_add
+ return_path_add
+
+ begin retry
+ *.retiolum * F,42d,1m
+ * * F,2h,15m; G,16h,1h,1.5; F,4d,6h
+
+ begin rewrite
+ begin authenticators
+ '';
+ };
+ };
+
+
+ lsearch = mapAttrs (name: set: toFile name (to-lsearch set)) {
+ inherit (cfg) internet-aliases;
+ inherit (cfg) system-aliases;
+ };
+
+ to-lsearch = concatMapStringsSep "\n" ({ from, to, ... }: "${from}: ${to}");
+
+in
+out
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 975c36b08..f767d20fe 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -21,6 +21,12 @@ types // rec {
apply = x: assert hasAttr "retiolum" x; x;
};
+ extraZones = mkOption {
+ default = {};
+ # TODO: string is either MX, NS, A or AAAA
+ type = with types; attrsOf string;
+ };
+
secure = mkOption {
type = bool;
default = false;
@@ -74,11 +80,6 @@ types // rec {
}));
default = null;
};
- zones = mkOption {
- default = [];
- # TODO: string is either MX, NS, A or AAAA
- type = with types; listOf (attrsOf str);
- };
};
});
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index 5de84f66c..89872f1eb 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -12,4 +12,5 @@ pkgs //
github-hosts-sync = callPackage ./github-hosts-sync.nix {};
github-known_hosts = callPackage ./github-known_hosts.nix {};
hashPassword = callPackage ./hashPassword.nix {};
+ posix-array = callPackage ./posix-array.nix {};
}
diff --git a/krebs/5pkgs/posix-array.nix b/krebs/5pkgs/posix-array.nix
new file mode 100644
index 000000000..456a3cc11
--- /dev/null
+++ b/krebs/5pkgs/posix-array.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchgit, ... }:
+
+with stdenv; stdenv.mkDerivation rec {
+ name = "posix-array";
+ version = "1.0.0";
+
+ src = fetchgit {
+ url = https://github.com/makefu/array.git;
+ rev = "refs/tags/${version}";
+ sha256 = "0yzwlhdg1rgc4p64ny7gj30l7z6vikhskhppsa2qj7s9gm2gz938";
+ };
+
+ phases = [
+ "unpackPhase"
+ "installPhase"
+ ];
+
+ installPhase = ''
+ mkdir -p "$out/bin"
+ cp -a ./array $out/bin
+ rm *
+ '';
+
+ meta = {
+ description = "Posix-compliant array implementation";
+ url = https://github.com/makefu/array;
+ license = licenses.wtfpl;
+ platforms = platforms.unix;
+ maintainers = with maintainers; [ makefu ];
+ };
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-27 05:57:54 +0000