attempt mailserver?

2026-01-02 18:05:01 +01:00
parent 33814b565d
commit e665bb0b14
6 changed files with 200 additions and 1 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -91,6 +91,22 @@
        "type": "github"
      }
    },
+    "blobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1604995301,
+        "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "blobs",
+        "type": "gitlab"
+      }
+    },
    "darwin": {
      "inputs": {
        "nixpkgs": [
@@ -130,6 +146,22 @@
      }
    },
    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
      "flake": false,
      "locked": {
        "lastModified": 1751685974,
@@ -224,6 +256,54 @@
        "type": "github"
      }
    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "nixos-mailserver",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixos-mailserver",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763988335,
+        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "nixos-mailserver",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
    "gnome-shell": {
      "flake": false,
      "locked": {
@@ -332,6 +412,29 @@
        "type": "github"
      }
    },
+    "nixos-mailserver": {
+      "inputs": {
+        "blobs": "blobs",
+        "flake-compat": "flake-compat",
+        "git-hooks": "git-hooks",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1766321686,
+        "narHash": "sha256-icOWbnD977HXhveirqA10zoqvErczVs3NKx8Bj+ikHY=",
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "rev": "7d433bf89882f61621f95082e90a4ab91eb0bdd3",
+        "type": "gitlab"
+      },
+      "original": {
+        "owner": "simple-nixos-mailserver",
+        "repo": "nixos-mailserver",
+        "type": "gitlab"
+      }
+    },
    "nixpkgs": {
      "locked": {
        "lastModified": 1766651565,
@@ -432,7 +535,7 @@
    },
    "nvf": {
      "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": "flake-compat_2",
        "flake-parts": "flake-parts_2",
        "mnw": "mnw",
        "ndg": "ndg",
@@ -480,6 +583,7 @@
        "agenix": "agenix",
        "home-manager": "home-manager_2",
        "impermanence": "impermanence",
+        "nixos-mailserver": "nixos-mailserver",
        "nixpkgs": "nixpkgs",
        "noshell": "noshell",
        "nur": "nur",
--- a/flake.nix
+++ b/flake.nix
@@ -9,6 +9,10 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
    impermanence.url = "github:nix-community/impermanence";
+    nixos-mailserver = {
+      url = "gitlab:simple-nixos-mailserver/nixos-mailserver";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    noshell = {
      url = "github:viperML/noshell";
@@ -35,6 +39,7 @@
    agenix,
    home-manager,
    impermanence,
+    nixos-mailserver,
    nixpkgs,
    noshell,
    nur,
@@ -56,6 +61,7 @@
            ./secrets.nix
            impermanence.nixosModules.impermanence
            agenix.nixosModules.default
+            nixos-mailserver.nixosModule
            phoenix.nixosModules.default
          ];
      };
--- a/machines/109-199-104-83/configuration.nix
+++ b/machines/109-199-104-83/configuration.nix
@@ -2,8 +2,86 @@
  config,
  modulesPath,
  machine,
+  pkgs,
  ...
 }: {
+  # mailserver config
+  mailserver = {
+    enable = true;
+    stateVersion = 3;
+    fqdn = "mail.galaxious.de";
+    domains = ["galaxious.de"];
+    x509.useACMEHost = config.mailserver.fqdn;
+    loginAccounts = {
+      "test@galaxious.de" = {
+        hashedPasswordFile = builtins.toString config.age.secrets.secret3.path;
+      };
+    };
+  };
+
+  # wildcard cert config
+  # systemctl start galaxious.de.service & journalctl -fu acme-galaxious.de.service
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "security@example.com";
+    certs."mail.galaxious.de" = {
+      domain = "mail.galaxious.de";
+      dnsProvider = "rfc2136";
+      environmentFile = "/var/lib/secrets/certs.secret";
+      dnsPropagationCheck = false;
+    };
+  };
+  services.bind = {
+    enable = true;
+    extraConfig = ''
+      include "/var/lib/secrets/dnskeys.conf";
+    '';
+    zones = [
+      rec {
+        name = "galaxious.de";
+        file = "/var/db/bind/${name}";
+        master = true;
+        extraConfig = "allow-update { key rfc2136key.galaxious.de; };";
+      }
+    ];
+  };
+  systemd.services.dns-rfc2136-conf = {
+    requiredBy = [
+      "acme-galaxious.de.service"
+      "bind.service"
+    ];
+    before = [
+      "acme-galaxious.de.service"
+      "bind.service"
+    ];
+    unitConfig = {
+      ConditionPathExists = "!/var/lib/secrets/dnskeys.conf";
+    };
+    serviceConfig = {
+      Type = "oneshot";
+      UMask = 77;
+    };
+    path = [pkgs.bind];
+    script = ''
+      mkdir -p /var/lib/secrets
+      chmod 755 /var/lib/secrets
+      tsig-keygen rfc2136key.galaxious.de > /var/lib/secrets/dnskeys.conf
+      chown named:root /var/lib/secrets/dnskeys.conf
+      chmod 400 /var/lib/secrets/dnskeys.conf
+
+      # extract secret value from the dnskeys.conf
+      while read x y; do if [ "$x" = "secret" ]; then secret="''${y:1:''${#y}-3}"; fi; done < /var/lib/secrets/dnskeys.conf
+
+      cat > /var/lib/secrets/certs.secret << EOF
+      RFC2136_NAMESERVER='127.0.0.1:53'
+      RFC2136_TSIG_ALGORITHM='hmac-sha256.'
+      RFC2136_TSIG_KEY='rfc2136key.galaxious.de'
+      RFC2136_TSIG_SECRET='$secret'
+      EOF
+      chmod 400 /var/lib/secrets/certs.secret
+    '';
+  };
+
  system.stateVersion = "25.11";
  nix.settings.experimental-features = ["flakes" "nix-command"];
  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
--- a/pub-keys.nix
+++ b/pub-keys.nix
@@ -3,6 +3,7 @@
    secret0.file = ./secrets/secret0.age;
    secret1.file = ./secrets/secret1.age;
    secret2.file = ./secrets/secret2.age;
+    secret3.file = ./secrets/secret3.age;
  };
  pub-keys = {
    ssh = {
--- a/secrets/secret3.age
+++ b/secrets/secret3.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 mT2fyg cUa93hQI9YjBLTG0L6NsQlvKWdzcH430HKa2GdTrR1Q
+8TSbI0gZyhEIAAuCyRHRLsLVHuQj1EsKXV5MHGsmkc8
+-> ssh-ed25519 UHxfvA UuD65gpfUz/1TgFdwuidcaHgsU/SeSDl33JnkJw2Z00
+F6/s0vRDzs0yEHjd5q/N+IaOJ6XS5x0o6yCbZkhLg2w
+-> ssh-ed25519 Xoin5w AcTxV1ov0tYiFr8vctKAEbdyIhCHADw+8bqXlK7WWH4
+ezCrCyfZNkTPHLXusMNbahN4nomFONyQyaBY3eb6vJw
+--- Jt5iP2xl8dHdS2l4upIvNaImL192xfrmYQ7VMwkdEVI
+x<EFBFBD>r<EFBFBD>"<22><>N<EFBFBD><4E><EFBFBD>/<2F><><EFBFBD>ُ,<04><>ݱ[<5B>A^<5E><><EFBFBD><EFBFBD>=Ni<04>~<7E><><EFBFBD>p<70><7F><EFBFBD><06>0<EFBFBD><30>W<EFBFBD><57>S<>b5<62><35><EFBFBD><EFBFBD>B<EFBFBD><42>Խ*n<0B>+E<><45>ph<70>`h!%Z<><5A><EFBFBD>M\<1B><><EFBFBD>y<>}Mwe<77><65>:;
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -7,4 +7,5 @@ in {
  "secret0.age".publicKeys = [andromeda lenovo];
  "secret1.age".publicKeys = [andromeda lenovo];
  "secret2.age".publicKeys = [andromeda lenovo _109-199-104-83];
+  "secret3.age".publicKeys = [andromeda lenovo _109-199-104-83];
 }