From e665bb0b1488bfa2d5e75f11354d0c7b02d76d36 Mon Sep 17 00:00:00 2001 From: andromeda Date: Fri, 2 Jan 2026 18:05:01 +0100 Subject: [PATCH] attempt mailserver? --- flake.lock | 106 +++++++++++++++++++++- flake.nix | 6 ++ machines/109-199-104-83/configuration.nix | 78 ++++++++++++++++ pub-keys.nix | 1 + secrets/secret3.age | 9 ++ secrets/secrets.nix | 1 + 6 files changed, 200 insertions(+), 1 deletion(-) create mode 100644 secrets/secret3.age diff --git a/flake.lock b/flake.lock index 7a57004..2927be9 100644 --- a/flake.lock +++ b/flake.lock @@ -91,6 +91,22 @@ "type": "github" } }, + "blobs": { + "flake": false, + "locked": { + "lastModified": 1604995301, + "narHash": "sha256-wcLzgLec6SGJA8fx1OEN1yV/Py5b+U5iyYpksUY/yLw=", + "owner": "simple-nixos-mailserver", + "repo": "blobs", + "rev": "2cccdf1ca48316f2cfd1c9a0017e8de5a7156265", + "type": "gitlab" + }, + "original": { + "owner": "simple-nixos-mailserver", + "repo": "blobs", + "type": "gitlab" + } + }, "darwin": { "inputs": { "nixpkgs": [ @@ -130,6 +146,22 @@ } }, "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1761588595, + "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_2": { "flake": false, "locked": { "lastModified": 1751685974, @@ -224,6 +256,54 @@ "type": "github" } }, + "git-hooks": { + "inputs": { + "flake-compat": [ + "nixos-mailserver", + "flake-compat" + ], + "gitignore": "gitignore", + "nixpkgs": [ + "nixos-mailserver", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1763988335, + "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=", + "owner": "cachix", + "repo": "git-hooks.nix", + "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "git-hooks.nix", + "type": "github" + } + }, + "gitignore": { + "inputs": { + "nixpkgs": [ + "nixos-mailserver", + "git-hooks", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, "gnome-shell": { "flake": false, "locked": { @@ -332,6 +412,29 @@ "type": "github" } }, + "nixos-mailserver": { + "inputs": { + "blobs": "blobs", + "flake-compat": "flake-compat", + "git-hooks": "git-hooks", + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1766321686, + "narHash": "sha256-icOWbnD977HXhveirqA10zoqvErczVs3NKx8Bj+ikHY=", + "owner": "simple-nixos-mailserver", + "repo": "nixos-mailserver", + "rev": "7d433bf89882f61621f95082e90a4ab91eb0bdd3", + "type": "gitlab" + }, + "original": { + "owner": "simple-nixos-mailserver", + "repo": "nixos-mailserver", + "type": "gitlab" + } + }, "nixpkgs": { "locked": { "lastModified": 1766651565, @@ -432,7 +535,7 @@ }, "nvf": { "inputs": { - "flake-compat": "flake-compat", + "flake-compat": "flake-compat_2", "flake-parts": "flake-parts_2", "mnw": "mnw", "ndg": "ndg", @@ -480,6 +583,7 @@ "agenix": "agenix", "home-manager": "home-manager_2", "impermanence": "impermanence", + "nixos-mailserver": "nixos-mailserver", "nixpkgs": "nixpkgs", "noshell": "noshell", "nur": "nur", diff --git a/flake.nix b/flake.nix index d123880..8e53f66 100644 --- a/flake.nix +++ b/flake.nix @@ -9,6 +9,10 @@ inputs.nixpkgs.follows = "nixpkgs"; }; impermanence.url = "github:nix-community/impermanence"; + nixos-mailserver = { + url = "gitlab:simple-nixos-mailserver/nixos-mailserver"; + inputs.nixpkgs.follows = "nixpkgs"; + }; nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; noshell = { url = "github:viperML/noshell"; @@ -35,6 +39,7 @@ agenix, home-manager, impermanence, + nixos-mailserver, nixpkgs, noshell, nur, @@ -56,6 +61,7 @@ ./secrets.nix impermanence.nixosModules.impermanence agenix.nixosModules.default + nixos-mailserver.nixosModule phoenix.nixosModules.default ]; }; diff --git a/machines/109-199-104-83/configuration.nix b/machines/109-199-104-83/configuration.nix index 32f9ffa..f5ff048 100644 --- a/machines/109-199-104-83/configuration.nix +++ b/machines/109-199-104-83/configuration.nix @@ -2,8 +2,86 @@ config, modulesPath, machine, + pkgs, ... }: { + # mailserver config + mailserver = { + enable = true; + stateVersion = 3; + fqdn = "mail.galaxious.de"; + domains = ["galaxious.de"]; + x509.useACMEHost = config.mailserver.fqdn; + loginAccounts = { + "test@galaxious.de" = { + hashedPasswordFile = builtins.toString config.age.secrets.secret3.path; + }; + }; + }; + + # wildcard cert config + # systemctl start galaxious.de.service & journalctl -fu acme-galaxious.de.service + security.acme = { + acceptTerms = true; + defaults.email = "security@example.com"; + certs."mail.galaxious.de" = { + domain = "mail.galaxious.de"; + dnsProvider = "rfc2136"; + environmentFile = "/var/lib/secrets/certs.secret"; + dnsPropagationCheck = false; + }; + }; + services.bind = { + enable = true; + extraConfig = '' + include "/var/lib/secrets/dnskeys.conf"; + ''; + zones = [ + rec { + name = "galaxious.de"; + file = "/var/db/bind/${name}"; + master = true; + extraConfig = "allow-update { key rfc2136key.galaxious.de; };"; + } + ]; + }; + systemd.services.dns-rfc2136-conf = { + requiredBy = [ + "acme-galaxious.de.service" + "bind.service" + ]; + before = [ + "acme-galaxious.de.service" + "bind.service" + ]; + unitConfig = { + ConditionPathExists = "!/var/lib/secrets/dnskeys.conf"; + }; + serviceConfig = { + Type = "oneshot"; + UMask = 77; + }; + path = [pkgs.bind]; + script = '' + mkdir -p /var/lib/secrets + chmod 755 /var/lib/secrets + tsig-keygen rfc2136key.galaxious.de > /var/lib/secrets/dnskeys.conf + chown named:root /var/lib/secrets/dnskeys.conf + chmod 400 /var/lib/secrets/dnskeys.conf + + # extract secret value from the dnskeys.conf + while read x y; do if [ "$x" = "secret" ]; then secret="''${y:1:''${#y}-3}"; fi; done < /var/lib/secrets/dnskeys.conf + + cat > /var/lib/secrets/certs.secret << EOF + RFC2136_NAMESERVER='127.0.0.1:53' + RFC2136_TSIG_ALGORITHM='hmac-sha256.' + RFC2136_TSIG_KEY='rfc2136key.galaxious.de' + RFC2136_TSIG_SECRET='$secret' + EOF + chmod 400 /var/lib/secrets/certs.secret + ''; + }; + system.stateVersion = "25.11"; nix.settings.experimental-features = ["flakes" "nix-command"]; imports = [(modulesPath + "/profiles/qemu-guest.nix")]; diff --git a/pub-keys.nix b/pub-keys.nix index 389786b..8bf4995 100644 --- a/pub-keys.nix +++ b/pub-keys.nix @@ -3,6 +3,7 @@ secret0.file = ./secrets/secret0.age; secret1.file = ./secrets/secret1.age; secret2.file = ./secrets/secret2.age; + secret3.file = ./secrets/secret3.age; }; pub-keys = { ssh = { diff --git a/secrets/secret3.age b/secrets/secret3.age new file mode 100644 index 0000000..290793d --- /dev/null +++ b/secrets/secret3.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 mT2fyg cUa93hQI9YjBLTG0L6NsQlvKWdzcH430HKa2GdTrR1Q +8TSbI0gZyhEIAAuCyRHRLsLVHuQj1EsKXV5MHGsmkc8 +-> ssh-ed25519 UHxfvA UuD65gpfUz/1TgFdwuidcaHgsU/SeSDl33JnkJw2Z00 +F6/s0vRDzs0yEHjd5q/N+IaOJ6XS5x0o6yCbZkhLg2w +-> ssh-ed25519 Xoin5w AcTxV1ov0tYiFr8vctKAEbdyIhCHADw+8bqXlK7WWH4 +ezCrCyfZNkTPHLXusMNbahN4nomFONyQyaBY3eb6vJw +--- Jt5iP2xl8dHdS2l4upIvNaImL192xfrmYQ7VMwkdEVI +xr"N/ُ,ݱ[A^=Ni~p0W Sb5BԽ*n +Eph`h!%ZM\y}Mwe:; \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 309c6ac..285a1ab 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -7,4 +7,5 @@ in { "secret0.age".publicKeys = [andromeda lenovo]; "secret1.age".publicKeys = [andromeda lenovo]; "secret2.age".publicKeys = [andromeda lenovo _109-199-104-83]; + "secret3.age".publicKeys = [andromeda lenovo _109-199-104-83]; }