nixos-config/machines/vueko/configuration.nix

100 lines
2.2 KiB
Nix
Raw Normal View History

# SPDX-FileCopyrightText: 2021-2024 Simon Bruder <simon@sbruder.de>
#
# SPDX-License-Identifier: AGPL-3.0-or-later
2021-02-06 12:18:55 +01:00
{ config, lib, pkgs, ... }:
2021-05-01 16:30:48 +02:00
{
imports = [
./hardware-configuration.nix
../../modules
2023-04-27 21:08:38 +02:00
./services/fuuko-proxy.nix # FIXME!
./services/media.nix
./services/restic.nix
];
sbruder = {
2021-03-05 16:00:10 +01:00
nginx.hardening.enable = true;
restic.system.enable = true;
wireguard.home.enable = true;
2021-02-05 15:35:42 +01:00
full = false;
infovhost.enable = true;
2021-02-06 12:18:55 +01:00
mailserver = {
enable = true;
fqdn = "vueko.sbruder.de";
domains = [
2023-08-17 13:51:45 +02:00
"jufeli.de"
2021-02-06 12:18:55 +01:00
"kegelschiene.net"
2022-09-13 09:11:02 +02:00
"psycho-power-papagei.de"
2023-11-15 23:42:58 +01:00
"salespointframework.org"
2021-02-06 12:18:55 +01:00
"sbruder.de"
];
2023-05-31 12:38:28 +02:00
autoconfig.enable = true;
2021-02-06 12:18:55 +01:00
users = import ./secrets/mail-users.nix;
};
};
networking.hostName = "vueko";
2023-04-27 21:08:38 +02:00
system.stateVersion = "22.11";
2021-02-06 12:18:55 +01:00
2021-02-10 14:22:00 +01:00
# sadly, too many (legitimate) mail servers have broken dnssec on reverse
# lookups
services.resolved.dnssec = "false";
2021-02-06 12:18:55 +01:00
services.nginx = {
enable = true;
virtualHosts = {
"vueko.sbruder.de" = {
enableACME = true;
forceSSL = true;
2021-02-14 19:49:05 +01:00
default = true;
2021-02-14 19:49:05 +01:00
root = pkgs.sbruder.imprint;
2023-04-29 12:27:35 +02:00
locations."/rspamd/".proxyPass = "http://127.0.0.1:11334/";
2021-02-06 12:18:55 +01:00
};
"vueko.vpn.sbruder.de" = {
# Allow prometheus metrics to be fetched from VPN without authentication
locations."/rspamd/metrics" = {
proxyPass = "http://127.0.0.1:11334/metrics";
extraConfig = ''
proxy_set_header X-Forwarded-For 127.0.0.1;
'';
};
};
2021-02-06 12:18:55 +01:00
"dav.sbruder.de" = {
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "http://localhost:5232";
};
};
};
networking.firewall.allowedTCPPorts = [
80 # HTTP
443 # HTTPS
];
services.radicale = {
enable = true;
settings = {
2021-02-06 12:18:55 +01:00
auth = {
type = "htpasswd";
htpasswd_encryption = "bcrypt";
htpasswd_filename = toString (pkgs.writeText
"radicale-htpasswd"
(lib.concatMapStringsSep
"\n"
({ address, passwordHash, ... }: "${address}:${passwordHash}")
config.sbruder.mailserver.users));
};
};
};
}