Merge branch 'master' of ssh://git.fudo.org:2222/fudosys/NixOS

config/fudo/mail-container.nix

@@ -160,22 +160,6 @@ in rec {
           };
         };
 
-        # users = {
-        #   users = {
-        #     ${container-mail-user} = {
-        #       isSystemUser = true;
-        #       uid = container-mail-user-id;
-        #       group = "mailer";
-        #     };
-        #   };
-
-        #   groups = {
-        #     ${container-mail-group} = {
-        #       members = ["mailer"];
-        #     };
-        #   };
-        # };
-
         fudo.mail-server = {
           enable = true;
           hostname = cfg.hostname;

config/fudo/mail/dovecot.nix

@@ -232,6 +232,10 @@ in {
           user = root
         }
 
+        service imap {
+          vsz_limit = 1024M
+        }
+
         namespace inbox {
           separator = "/"
           inbox = yes

config/fudo/mail/postfix.nix

@@ -130,7 +130,7 @@ in {
       virtual = ''
         ${make-user-aliases cfg.user-aliases}
 
-        ${make-alias-users cfg.local-domains cfg.alias-users}
+        ${make-alias-users ([cfg.domain] ++ cfg.local-domains) cfg.alias-users}
       '';
 
       sslCert = cfg.postfix.ssl-certificate;

config/fudo/prometheus.nix

@@ -111,6 +111,8 @@ in {
 
       webExternalUrl = "https://${cfg.hostname}";
 
+      listenAddress = "127.0.0.1:9090";
+
       scrapeConfigs = [
         {
           job_name = "docker";

config/fudo/system.nix

@@ -20,6 +20,12 @@ in {
       default = [];
       example = ["redis.service"];
     };
+
+    tmpOnTmpfs = mkOption {
+      type = types.bool;
+      description = "Put tmp filesystem on tmpfs (needs enough RAM).";
+      default = true;
+    };
   };
 
   config = mkIf cfg.disableTransparentHugePages {

config/fudo/vpn.nix

@@ -0,0 +1,73 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+let
+  cfg = config.fudo.vpn;
+
+  peerOpts = { peer-name, ... }: {
+    options = with types; {
+      public-key = mkOption {
+        type = str;
+        description = "Peer public key.";
+      };
+
+      allowed-ips = mkOption {
+        type = listOf str;
+        description = "List of allowed IP ranges from which this peer can connect.";
+        example = [ "10.100.0.0/16" ];
+        default = [];
+      };
+    };
+  };
+
+in {
+  options.fudo.vpn = with types; {
+    enable = mkEnableOption "Enable Fudo VPN";
+
+    ips = mkOption {
+      type = str;
+      description = "IP range to assign this interface.";
+      default = "10.100.0.0/16";
+    };
+
+    private-key-file = mkOption {
+      type = str;
+      description = "Path to the secret key (generated with wg [genkey/pubkey]).";
+      example = "/path/to/secret.key";
+    };
+
+    listen-port = mkOption {
+      type = port;
+      description = "Port on which to listen for incoming connections.";
+      default = 51820;
+    };
+
+    peers = mkOption {
+      type = loaOf (submodule peerOpts);
+      description = "A list of peers allowed to connect.";
+      default = {};
+      example = {
+        peer0 = {
+          public-key = "xyz";
+          allowed-ips = ["10.100.1.0/24"];
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.wireguard = {
+      enable = true;
+      interfaces.wgtun0 = {
+        generatePrivateKeyFile = false;
+        ips = [ cfg.ips ];
+        listenPort = cfg.listen-port;
+        peers = mapAttrsToList (peer-name: peer-config: {
+          publicKey = peer-config.public-key;
+          allowedIPs = peer-config.allowed-ips;
+        }) cfg.peers;
+        privateKeyFile = cfg.private-key-file;
+      };
+    };
+  };
+}

config/local.nix

@@ -23,6 +23,7 @@ with lib;
     ./fudo/secure-dns-proxy.nix
     ./fudo/slynk.nix
     ./fudo/system.nix
+    ./fudo/vpn.nix
     ./fudo/webmail.nix
 
     ./informis/cl-gemini.nix