Jörg Thalheim
a17e2fe029
All checks were successful
buildbot/nix-build .#checks.x86_64-linux.devShell-clan-merge Build done.
buildbot/nix-build .#checks.x86_64-linux.package-clan-merge Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-merge Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-default Build done.
buildbot/nix-build .#checks.x86_64-linux.package-job-flake-update-clan-homepage Build done.
buildbot/nix-build .#checks.x86_64-linux.package-action-ensure-tea-login Build done.
buildbot/nix-build .#checks.x86_64-linux.treefmt Build done.
buildbot/nix-build .#checks.x86_64-linux.package-action-create-pr Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gitea Build done.
buildbot/nix-build .#checks.x86_64-linux.nixos-web01 Build done.
buildbot/nix-build .#checks.x86_64-linux.package-action-flake-update Build done.
buildbot/nix-build .#checks.x86_64-linux.package-job-flake-update-clan-core Build done.
buildbot/nix-build .#checks.x86_64-linux.package-action-flake-update-pr-clan Build done.
buildbot/nix-build .#checks.x86_64-linux.package-job-flake-update-clan-infra Build done.
buildbot/nix-eval Build done.
55 lines
1.6 KiB
Nix
55 lines
1.6 KiB
Nix
{ config, pkgs, ... }:
|
|
let
|
|
mailPassword =
|
|
{ service }:
|
|
{
|
|
secret."${service}-password" = { };
|
|
secret."${service}-password-hash" = { };
|
|
generator.path = with pkgs; [
|
|
coreutils
|
|
xkcdpass
|
|
mkpasswd
|
|
];
|
|
generator.script = ''
|
|
xkcdpass -n 4 -d - > $secrets/${service}-password
|
|
cat $secrets/${service}-password | mkpasswd -s -m bcrypt > $secrets/${service}-password-hash
|
|
'';
|
|
};
|
|
in
|
|
{
|
|
mailserver = {
|
|
enable = true;
|
|
fqdn = "mail.clan.lol";
|
|
domains = [ "clan.lol" ];
|
|
enablePop3 = true;
|
|
certificateScheme = "acme-nginx";
|
|
# kresd sucks unfortunally (fails when one NS server is not working, instead of trying other ones)
|
|
localDnsResolver = false;
|
|
|
|
loginAccounts."golem@clan.lol".hashedPasswordFile =
|
|
config.clan.core.facts.services.golem-mail.secret.golem-password-hash.path;
|
|
loginAccounts."gitea@clan.lol".hashedPasswordFile =
|
|
config.clan.core.facts.services.gitea-mail.secret.gitea-password-hash.path;
|
|
};
|
|
|
|
services.unbound = {
|
|
enable = true;
|
|
settings.server = {
|
|
prefetch = "yes";
|
|
prefetch-key = true;
|
|
qname-minimisation = true;
|
|
# Too many broken dnssec setups even at big companies such as amazon.
|
|
# Breaks my email setup. Better rely on tls for security.
|
|
val-permissive-mode = "yes";
|
|
};
|
|
};
|
|
|
|
# use local unbound as dns resolver
|
|
networking.nameservers = [ "127.0.0.1" ];
|
|
|
|
security.acme.acceptTerms = true;
|
|
|
|
clan.core.facts.services.golem-mail = mailPassword { service = "golem"; };
|
|
clan.core.facts.services.gitea-mail = mailPassword { service = "gitea"; };
|
|
}
|