Informis.land is functioning again.
This commit is contained in:
root@procul
@@ -0,0 +1,229 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
hostname = "procul";
|
||||
host-ipv4 = "172.86.179.18";
|
||||
domain = config.fudo.hosts.${hostname}.domain;
|
||||
site = config.fudo.hosts.${hostname}.site;
|
||||
host-fqdn = "${hostname}.${domain}";
|
||||
|
||||
local-networks = config.fudo.domains.${domain}.local-networks
|
||||
++ config.fudo.sites.${site}.local-networks;
|
||||
|
||||
acme-private-key = hostname: "/var/lib/acme/${hostname}/key.pem";
|
||||
acme-certificate = hostname: "/var/lib/acme/${hostname}/fullchain.pem";
|
||||
acme-ca = "/etc/nixos/static/letsencryptauthorityx3.pem";
|
||||
|
||||
local-packages = with pkgs; [ ldns.examples ];
|
||||
|
||||
in {
|
||||
networking = {
|
||||
dhcpcd.enable = false;
|
||||
useDHCP = false;
|
||||
|
||||
enableIPv6 = true;
|
||||
|
||||
# FIXME: this isn't the right place
|
||||
search = [ domain ];
|
||||
nameservers = [ "127.0.0.1" ];
|
||||
defaultGateway = "172.86.179.17";
|
||||
|
||||
interfaces = {
|
||||
extif0 = {
|
||||
ipv4.addresses = [{
|
||||
address = host-ipv4;
|
||||
prefixLength = 29;
|
||||
}];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = local-packages;
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
users.users = {
|
||||
gituser = {
|
||||
isSystemUser = true;
|
||||
group = "nogroup";
|
||||
};
|
||||
};
|
||||
|
||||
fudo = {
|
||||
client.dns = {
|
||||
enable = true;
|
||||
ipv4 = true;
|
||||
ipv6 = true;
|
||||
user = "fudo-client";
|
||||
external-interface = "extif0";
|
||||
password-file = "/srv/client/secure/client.passwd";
|
||||
};
|
||||
|
||||
auth.kdc = {
|
||||
enable = true;
|
||||
realm = "INFORMIS.LAND";
|
||||
bind-addresses = [ host-ipv4 "127.0.0.1" ];
|
||||
acl = {
|
||||
"niten" = { perms = [ "add" "change-password" "list" ]; };
|
||||
"*/root" = { perms = [ "all" ]; };
|
||||
};
|
||||
};
|
||||
|
||||
secure-dns-proxy = {
|
||||
enable = true;
|
||||
upstream-dns =
|
||||
[ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
|
||||
bootstrap-dns = "1.1.1.1";
|
||||
listen-ips = [ "127.0.0.1" ];
|
||||
listen-port = 53;
|
||||
allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
|
||||
};
|
||||
|
||||
# networks."informis.land" = {
|
||||
# hosts = {
|
||||
# procul = {
|
||||
# ipv4-address = host-ipv4;
|
||||
# };
|
||||
# };
|
||||
|
||||
# verbatim-dns-records = [
|
||||
# ''_kerberos IN TXT "INFORMIS.LAND"''
|
||||
# ''@ IN TXT "v=spf1 mx ip4:${host-ipv4}/29 -all"''
|
||||
# ''@ IN SPF "v=spf1 mx ip4:${host-ipv4}/29 -all"''
|
||||
# ];
|
||||
# };
|
||||
|
||||
dns = {
|
||||
enable = true;
|
||||
identity = "procul.informis.land";
|
||||
nameservers = {
|
||||
ns1 = {
|
||||
ipv4-address = host-ipv4;
|
||||
description = "Primary Informis Nameserver";
|
||||
};
|
||||
ns2 = {
|
||||
ipv4-address = host-ipv4;
|
||||
description = "Secondary Informis Nameserver";
|
||||
};
|
||||
};
|
||||
|
||||
listen-ips = [ host-ipv4 ];
|
||||
|
||||
domains = {
|
||||
"informis.land" = {
|
||||
dnssec = true;
|
||||
default-host = host-ipv4;
|
||||
gssapi-realm = "INFORMIS.LAND";
|
||||
mx = [ "smtp.informis.land" ];
|
||||
network-definition = config.fudo.networks."informis.land";
|
||||
dmarc-report-address = "dmarc-report@informis.land";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
mail-server = {
|
||||
enable = true;
|
||||
debug = true;
|
||||
|
||||
domain = domain;
|
||||
hostname = "${host-fqdn}";
|
||||
monitoring = false;
|
||||
mail-user = "mailuser";
|
||||
mail-user-id = 525;
|
||||
mail-group = "mailgroup";
|
||||
clamav.enable = true;
|
||||
dkim.signing = true;
|
||||
|
||||
dovecot = {
|
||||
ssl-certificate = acme-certificate "imap.${domain}";
|
||||
ssl-private-key = acme-private-key "imap.${domain}";
|
||||
};
|
||||
|
||||
postfix = {
|
||||
ssl-certificate = acme-certificate "smtp.${domain}";
|
||||
ssl-private-key = acme-private-key "smtp.${domain}";
|
||||
};
|
||||
|
||||
# This should NOT include the primary domain
|
||||
local-domains = [
|
||||
host-fqdn
|
||||
"smtp.${domain}"
|
||||
];
|
||||
|
||||
mail-directory = "/srv/mailserver/mail";
|
||||
state-directory = "/srv/mailserver/state";
|
||||
|
||||
trusted-networks = [
|
||||
"172.86.179.16/29"
|
||||
"127.0.0.0/16"
|
||||
];
|
||||
|
||||
alias-users = {
|
||||
root = ["niten"];
|
||||
postmaster = ["niten"];
|
||||
hostmaster = ["niten"];
|
||||
webmaster = ["niten"];
|
||||
system = ["niten"];
|
||||
admin = ["niten"];
|
||||
dmarc-report = ["niten"];
|
||||
};
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
ssl-certificate = (acme-certificate host-fqdn);
|
||||
ssl-private-key = (acme-private-key host-fqdn);
|
||||
keytab = "/srv/postgres/secure/postgres.keytab";
|
||||
local-networks = local-networks;
|
||||
|
||||
users = {
|
||||
gituser = {
|
||||
password-file = "/srv/git/secure/db.passwd";
|
||||
databases = {
|
||||
git = {
|
||||
access = "CONNECT";
|
||||
entity-access = {
|
||||
"ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
|
||||
"ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
databases = { git = { users = [ "niten" ]; }; };
|
||||
};
|
||||
|
||||
git = {
|
||||
enable = true;
|
||||
hostname = "git.informis.land";
|
||||
site-name = "informis git";
|
||||
user = "gituser";
|
||||
# admin-email = "viator@informis.land";
|
||||
repository-dir = /srv/git/repo;
|
||||
state-dir = /srv/git/state;
|
||||
database = {
|
||||
user = "gituser";
|
||||
password-file = /srv/git/secure/db.passwd;
|
||||
hostname = "127.0.0.1";
|
||||
name = "git";
|
||||
};
|
||||
ssh = {
|
||||
listen-ip = host-ipv4;
|
||||
listen-port = 2222;
|
||||
};
|
||||
};
|
||||
|
||||
acme = {
|
||||
enable = true;
|
||||
admin-address = "admin@${domain}";
|
||||
hostnames = [
|
||||
"informis.land"
|
||||
"imap.informis.land"
|
||||
"smtp.informis.land"
|
||||
"gemini.informis.land"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -4,5 +4,6 @@
|
||||
config.fudo.networks = {
|
||||
"rus.selby.ca" = import ./networks/rus.selby.ca.nix { inherit config lib; };
|
||||
"sea.fudo.org" = import ./networks/sea.fudo.org.nix { inherit config lib; };
|
||||
"informis.land" = import ./networks/informis.land.nix { inherit config lib; };
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,91 @@
|
||||
{ config, lib, ... }:
|
||||
|
||||
with lib;
|
||||
{
|
||||
mx = [ "smtp.informis.land" ];
|
||||
|
||||
aliases = {
|
||||
smtp = "procul.informis.land.";
|
||||
imap = "procul.informis.land.";
|
||||
gemini = "procul.informis.land.";
|
||||
git = "procul.informis.land.";
|
||||
};
|
||||
|
||||
verbatim-dns-records = let
|
||||
domain-name = config.fudo.hosts.${config.instance.hostname}.domain;
|
||||
# NOTE: we're assuming IPv4...
|
||||
domain-local-nets = map (network: "ip4:${network}") config.fudo.domains.${domain-name}.local-networks;
|
||||
local-net-string = concatStringsSep " " domain-local-nets;
|
||||
in [
|
||||
''@ IN TXT "v=spf1 mx ${local-net-string} -all"''
|
||||
''@ IN SPF "v=spf1 mx ${local-net-string} -all"''
|
||||
];
|
||||
|
||||
srv-records = {
|
||||
tcp = {
|
||||
domain = [{
|
||||
host = "ns1.informis.land";
|
||||
port = 53;
|
||||
}];
|
||||
ssh = [{
|
||||
host = "procul.informis.land";
|
||||
port = 22;
|
||||
}];
|
||||
submission = [{
|
||||
host = "procul.informis.land";
|
||||
port = 587;
|
||||
}];
|
||||
kerberos = [{
|
||||
host = "procul.informis.land";
|
||||
port = 88;
|
||||
}];
|
||||
kerberos-adm = [{
|
||||
host = "procul.informis.land";
|
||||
port = 749;
|
||||
}];
|
||||
imaps = [{
|
||||
host = "procul.informis.land";
|
||||
port = 993;
|
||||
priority = 0;
|
||||
}];
|
||||
pop3s = [{
|
||||
host = "procul.informis.land";
|
||||
port = 995;
|
||||
priority = 10;
|
||||
}];
|
||||
http = [{
|
||||
host = "procul.informis.land";
|
||||
port = 80;
|
||||
}];
|
||||
https = [{
|
||||
host = "procul.informis.land";
|
||||
port = 443;
|
||||
}];
|
||||
};
|
||||
|
||||
udp = {
|
||||
domain = [{
|
||||
host = "ns1.informis.land";
|
||||
port = 53;
|
||||
}];
|
||||
kerberos = [{
|
||||
host = "procul.informis.land";
|
||||
port = 88;
|
||||
}];
|
||||
kerberos-master = [{
|
||||
host = "procul.informis.land";
|
||||
port = 88;
|
||||
}];
|
||||
kpasswd = [{
|
||||
host = "procul.informis.land";
|
||||
port = 464;
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
hosts = {
|
||||
procul = {
|
||||
ipv4-address = "172.86.179.18";
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user