diff --git a/flake.lock b/flake.lock index b22336e..60c6d13 100644 --- a/flake.lock +++ b/flake.lock @@ -10,11 +10,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1770165109, - "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=", + "lastModified": 1762618334, + "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=", "owner": "ryantm", "repo": "agenix", - "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb", + "rev": "fcdea223397448d35d9b31f798479227e80183f6", "type": "github" }, "original": { @@ -47,11 +47,11 @@ ] }, "locked": { - "lastModified": 1770681688, - "narHash": "sha256-bGVEgZMxmw9N+IKp5nG+2nyKFezdPWYDxyxXkYW+d2M=", + "lastModified": 1769889994, + "narHash": "sha256-uEn3WcpPHe3sMJMgIJ0XW3f4/+TRzZpNgv4vu5/gjmA=", "owner": "9001", "repo": "copyparty", - "rev": "e5d0a0572da507acfe774e0f86ad541f5daab97f", + "rev": "9b436eb52e5cfe7a0a8e59dd9f1a37351f3a2abd", "type": "github" }, "original": { @@ -89,11 +89,11 @@ "utils": "utils" }, "locked": { - "lastModified": 1770019181, - "narHash": "sha256-hwsYgDnby50JNVpTRYlF3UR/Rrpt01OrxVuryF40CFY=", + "lastModified": 1766051518, + "narHash": "sha256-znKOwPXQnt3o7lDb3hdf19oDo0BLP4MfBOYiWkEHoik=", "owner": "serokell", "repo": "deploy-rs", - "rev": "77c906c0ba56aabdbc72041bf9111b565cdd6171", + "rev": "d5eff7f948535b9c723d60cd8239f8f11ddc90fa", "type": "github" }, "original": { @@ -141,15 +141,15 @@ "flake-compat_2": { "flake": false, "locked": { - "lastModified": 1767039857, - "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=", - "owner": "NixOS", + "lastModified": 1761588595, + "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=", + "owner": "edolstra", "repo": "flake-compat", - "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab", + "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5", "type": "github" }, "original": { - "owner": "NixOS", + "owner": "edolstra", "repo": "flake-compat", "type": "github" } @@ -182,11 +182,11 @@ ] }, "locked": { - "lastModified": 1769939035, - "narHash": "sha256-Fok2AmefgVA0+eprw2NDwqKkPGEI5wvR+twiZagBvrg=", + "lastModified": 1763988335, + "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "a8ca480175326551d6c4121498316261cbb5b260", + "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce", "type": "github" }, "original": { @@ -245,11 +245,11 @@ ] }, "locked": { - "lastModified": 1770654520, - "narHash": "sha256-mg5WZMIPGsFu9MxSrUcuJUPMbfMsF77el5yb/7rc10k=", + "lastModified": 1769978395, + "narHash": "sha256-gj1yP3spUb1vGtaF5qPhshd2j0cg4xf51pklDsIm19Q=", "owner": "nix-community", "repo": "home-manager", - "rev": "6c4fdbe1ad198fac36c320fd45c5957324a80b8e", + "rev": "984708c34d3495a518e6ab6b8633469bbca2f77a", "type": "github" }, "original": { @@ -288,11 +288,11 @@ "nixpkgs": "nixpkgs_2" }, "locked": { - "lastModified": 1770659507, - "narHash": "sha256-RVZno9CypFN3eHxfULKN1K7mb/Cq0HkznnWqnshxpWY=", + "lastModified": 1766321686, + "narHash": "sha256-icOWbnD977HXhveirqA10zoqvErczVs3NKx8Bj+ikHY=", "owner": "simple-nixos-mailserver", "repo": "nixos-mailserver", - "rev": "781e833633ebc0873d251772a74e4400a73f5d78", + "rev": "7d433bf89882f61621f95082e90a4ab91eb0bdd3", "type": "gitlab" }, "original": { @@ -335,11 +335,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1770631810, - "narHash": "sha256-b7iK/x+zOXbjhRqa+XBlYla4zFvPZyU5Ln2HJkiSnzc=", + "lastModified": 1769302137, + "narHash": "sha256-QEDtctEkOsbx8nlFh4yqPEOtr4tif6KTqWwJ37IM2ds=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "2889685785848de940375bf7fea5e7c5a3c8d502", + "rev": "a351494b0e35fd7c0b7a1aae82f0afddf4907aa8", "type": "github" }, "original": { @@ -383,11 +383,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1770562336, - "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=", + "lastModified": 1769789167, + "narHash": "sha256-kKB3bqYJU5nzYeIROI82Ef9VtTbu4uA3YydSk/Bioa8=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "d6c71932130818840fc8fe9509cf50be8c64634f", + "rev": "62c8382960464ceb98ea593cb8321a2cf8f9e3e5", "type": "github" }, "original": { @@ -399,11 +399,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1770650459, - "narHash": "sha256-hGeOnueXorzwDD1V9ldZr+y+zad4SNyqMnQsa/mIlvI=", + "lastModified": 1764374374, + "narHash": "sha256-naS7hg/D1yLKSZoENx9gvsPLFiNEOTcqamJSu0OEvCA=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "fff0554c67696d76a0cdd9cfe14403fbdbf1f378", + "rev": "6a49303095abc094ee77dc243a9e351b642e8e75", "type": "github" }, "original": { @@ -415,11 +415,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1770562336, - "narHash": "sha256-ub1gpAONMFsT/GU2hV6ZWJjur8rJ6kKxdm9IlCT0j84=", + "lastModified": 1769789167, + "narHash": "sha256-kKB3bqYJU5nzYeIROI82Ef9VtTbu4uA3YydSk/Bioa8=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "d6c71932130818840fc8fe9509cf50be8c64634f", + "rev": "62c8382960464ceb98ea593cb8321a2cf8f9e3e5", "type": "github" }, "original": { @@ -533,11 +533,11 @@ "nixpkgs": "nixpkgs_4" }, "locked": { - "lastModified": 1770707140, - "narHash": "sha256-3ZRA2+o5p1+FKWx988WbwB1SQ2Mz5aL95zxhL5iD+O0=", + "lastModified": 1769922110, + "narHash": "sha256-/0Cl75Yy4mQOWNfr2ZR5aYZlFc2geH7NUkwiwiKUNhg=", "owner": "0xc000022070", "repo": "zen-browser-flake", - "rev": "db14437f8667f7f09784e2a4e73c105bdc1c7023", + "rev": "dc3cb779f0fae72b3ebffd60a2272095f8848eda", "type": "github" }, "original": { diff --git a/hosts/zora/default.nix b/hosts/zora/default.nix index 6d3d543..a9352bc 100644 --- a/hosts/zora/default.nix +++ b/hosts/zora/default.nix @@ -13,6 +13,7 @@ ./users.nix ../../users/lyes + ../../users/lyes/server ../../modules ../../modules/server diff --git a/hosts/zora/reverse-proxy.nix b/hosts/zora/reverse-proxy.nix index 5c597fd..f4e6501 100644 --- a/hosts/zora/reverse-proxy.nix +++ b/hosts/zora/reverse-proxy.nix @@ -3,7 +3,7 @@ { security.acme = { acceptTerms = true; - defaults.email = "security@lyes.eu"; + defaults.email = "root.security@lyes.eu"; }; services.nginx = { diff --git a/modules/server/baba/default.nix b/modules/server/baba/default.nix index 34a0220..fa7940c 100644 --- a/modules/server/baba/default.nix +++ b/modules/server/baba/default.nix @@ -15,12 +15,12 @@ extraAppsEnable = true; extraApps = { - inherit (config.services.nextcloud.package.packages.apps) mail calendar contacts cospend user_oidc notes richdocuments tasks news dav_push repod gpoddersync phonetrack music; - # gpoddersync = pkgs.fetchNextcloudApp { - # hash = "sha256-EQVs1fe0ierjqFZ5+KVc1Yj67zrwjLBAzY5A+QsC7AU="; - # url = "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.13.2r/gpoddersync.tar.gz"; - # license = "agpl3Only"; - # }; + inherit (config.services.nextcloud.package.packages.apps) mail calendar contacts user_oidc notes richdocuments tasks news dav_push repod phonetrack music; + gpoddersync = pkgs.fetchNextcloudApp { + hash = "sha256-EQVs1fe0ierjqFZ5+KVc1Yj67zrwjLBAzY5A+QsC7AU="; + url = "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.13.2r/gpoddersync.tar.gz"; + license = "agpl3Only"; + }; }; config = { diff --git a/modules/server/link/default.nix b/modules/server/link/default.nix index a76f5e3..b2627d7 100644 --- a/modules/server/link/default.nix +++ b/modules/server/link/default.nix @@ -14,7 +14,7 @@ in # package = pkgs.kanidmWithSecretProvisioning_1_7; enableServer = true; - serverSettings = { + server.settings = { bindaddress = "127.0.0.1:${port}"; ldapbindaddress = "0.0.0.0:636"; domain = hostname; diff --git a/modules/server/taf/default.nix b/modules/server/taf/default.nix index ca0c361..c4a461d 100644 --- a/modules/server/taf/default.nix +++ b/modules/server/taf/default.nix @@ -1,5 +1,20 @@ -{ config, ... }: +{ config, lib, ... }: +let + alias = '' + @lyes.eu lyes + lyes@mail.lyes.eu lyes + abuse@taf.lyes.eu lyes + abuse@mail.lyes.eu lyes + abuse@minish.fr lyes + abuse@minish.link lyes + postmaster@taf.lyes.eu lyes + postmaster@mail.lyes.eu lyes + postmaster@minish.fr lyes + postmaster@minish.link lyes + ''; + aliasFile = lib.toFile "alias" alias; +in { mailserver = { enable = true; @@ -7,7 +22,10 @@ fqdn = "taf.lyes.eu"; domains = [ "lyes.eu" + "taf.lyes.eu" "mail.lyes.eu" + "minish.fr" + "minish.link" ]; localDnsResolver = false; @@ -15,175 +33,85 @@ # debug.all = true; - # ldap = { - # enable = true; + ldap = { + enable = true; - # uris = [ "ldaps://auth.lyes.eu:636" ]; - # searchBase = "dc=auth,dc=lyes,dc=eu"; - # searchScope = "sub"; + uris = [ "ldaps://auth.lyes.eu:636" ]; + searchBase = "dc=auth,dc=lyes,dc=eu"; + searchScope = "sub"; - # bind = { - # # dn = "dn=token,dc=auth,dc=lyes,dc=eu"; - # dn = "dn=token"; - # passwordFile = config.age.secrets.taf-token.path; - # }; + bind = { + # dn = "dn=token,dc=auth,dc=lyes,dc=eu"; + dn = "dn=token"; + passwordFile = config.age.secrets.taf-token.path; + }; - # dovecot = { - # userFilter = "(name=%u)"; - # passFilter = "(name=%u)"; - # }; + dovecot = { + userFilter = "(&(memberof=taf_users)(mail=%u))"; + passFilter = "(&(memberof=taf_users)(mail=%u))"; + }; - # postfix = { - # filter = "(name=%s)"; - # mailAttribute = "mail"; - # uidAttribute = "name"; - # }; - # }; - - loginAccounts = { - "lyes@mail.lyes.eu" = { - hashedPasswordFile = config.age.secrets.lyes-mail-passwd.path; - aliases = [ - "@lyes.eu" - ]; - quota = "1T"; - sieveScript = '' - require ["include", "fileinto", "mailbox", "copy", "regex", "variables", "imap4flags"]; - - include :personal "hiddensieve"; - - # lyes.eu filters - if address :is :domain "X-Original-To" "lyes.eu" { - # If the mail comes from my crans mailbox - if address :is :localpart "X-Original-To" "crans" { - # Aurore Support - if header :contains "List-Id" "" { - fileinto :create "Crans.aurore.support"; - } - # Mailman moderation request - elsif address :matches :all "To" "*-owner@lists.crans.org" { - fileinto :create "Crans.moderation"; - } - # Crans Bureau - elsif anyof ( - header :contains "List-Id" "", - header :contains "List-Id" "", - header :contains "List-Id" "" - ) { - fileinto :create "Crans.crans.bureau"; - } - # Crans CA - elsif header :contains "List-Id" "" { - fileinto :create "Crans.crans.ca"; - } - # Crans Root Postmaster - elsif address :is :all "To" "postmaster@crans.org" { - addflag "\\Seen"; - fileinto :create "Crans.crans.root.postmaster"; - } - # Crans Root Mailer - elsif address :is :all "From" "MAILER-DAEMON@crans.org" { - fileinto :create "Crans.crans.root.mailer"; - } - # Crans Nounou - elsif anyof ( - header :contains "List-Id" "", - header :contains "List-Id" "", - address :is :all "To" "contact@crans.org", - address :is :all "From" "contact@crans.org" - ) { - fileinto :create "Crans.crans.nounou"; - } - # Crans Root - elsif anyof ( - address :is :all "To" "root@crans.org", - address :is :all "From" "root@crans.org", - address :is :all "From" "www-data@crans.org" - ) { - fileinto :create "Crans.crans.root"; - } - # Crans Gitlab - elsif address :is :all "From" "gitlab@crans.org" { - fileinto :create "Crans.crans.gitlab"; - } - # Crans Wiki - elsif address :is :all "From" "wiki@crans.org" { - fileinto :create "Crans.crans.wiki"; - } - # Aurore CA - elsif header :contains "List-Id" "" { - fileinto :create "Crans.aurore.ca"; - } - # BDL - elsif anyof ( - header :contains "List-Id" "", - header :contains "List-Id" "" - ) { - fileinto :create "Crans.asso.bdl"; - } - # Med - elsif anyof ( - header :contains "List-Id" "", - header :contains "List-Id" "" - ) { - fileinto :create "Crans.asso.med"; - } - # NL BDE - elsif header :contains "List-Id" "" { - fileinto :create "Crans.asso.nl.bde"; - } - # NL BDA - elsif header :contains "List-Id" "" { - fileinto :create "Crans.asso.nl.bda"; - } - # Any other associative mail - elsif anyof ( - header :contains "List-Id" "", - header :contains "List-Id" "", - header :matches "List-Id" "<*.lists.crans.org>" - ) { - fileinto :create "Crans.asso"; - } - # Otherwise it's for the generic mailbox - else { - fileinto :create "Crans"; - } - } - - # Otherwise it's for my different accounts - # It's automatically sorted using the localpart - elsif address :localpart :regex "X-Original-To" "^(([a-zA-Z]+\\.)*([a-zA-Z]+))(-([a-zA-Z0-9_.\\-]*))?''$" { - set :lower "sub_folder" "''${1}"; - set "mbox_candidate" "INBOX.''${sub_folder}"; - fileinto :create "''${mbox_candidate}"; - } - - # Other unknown origin - else { - fileinto :create "INBOX.other"; - } - } - - # It's destined to my main inbox - elsif address :is "X-Original-To" "lyes@mail.lyes.eu" { - fileinto :create "INBOX"; - } - - # Other unknown origin - else { - fileinto :create "INBOX.other"; - } - ''; + postfix = { + filter = "(&(memberof=taf_users)(mail=%s))"; + mailAttribute = "mail"; + uidAttribute = "name"; }; }; + # fullTextSearch = { + # enable = true; + # autoIndex = true; + # enforced = "body"; + # }; + + # loginAccounts = { + # "lyes@mail.lyes.eu" = { + # # hashedPasswordFile = config.age.secrets.lyes-mail-passwd.path; + # # aliases = [ + # # "@lyes.eu" + # # ]; + # # quota = "1T"; + # }; + # }; + # extraVirtualAliases = { - # "@lyes.eu" = "lyes@mail.lyes.eu"; + # "@lyes.eu" = "lyes"; + # "abuse@mail.lyes.eu" = "lyes"; + # # "abuse@minish.fr" = "lyes"; + # # "abuse@minish.link" = "lyes"; + # "postmaster@mail.lyes.eu" = "lyes"; + # # "postmaster@minish.fr" = "lyes"; + # # "postmaster@minish.link" = "lyes"; # }; x509.useACMEHost = config.mailserver.fqdn; }; + services.postfix = { + mapFiles."valias" = lib.mkForce aliasFile; + mapFiles."vaccounts" = lib.mkForce aliasFile; + virtual = lib.mkForce alias; + + settings = { + main = { + # local_recipient_maps = ""; + # virtual_alias_maps = lib.mkForce "ldap:/run/postfix/ldap-virtual-mailbox-map.cf"; + + maximal_queue_lifetime = "31d"; + + relay_domains = [ + "skaven.org" + "agreg.info" + ]; + + smtpd_recipient_restrictions = [ + "permit_mynetworks" + "permit_sasl_authenticated" + ]; + }; + }; + }; + # services.dovecot2.extraConfig = '' # userdb { # driver = ldap @@ -200,7 +128,10 @@ # } # ''; - services.dovecot2.sieve.extensions = [ "imap4flags" ]; + services.dovecot2 = { + # enableQuota = lib.mkForce false; + sieve.extensions = [ "imap4flags" ]; + }; services.roundcube = { enable = true; @@ -217,21 +148,12 @@ age.secrets = { taf-token = { - owner = "postfix"; file = ../../../secrets/zora/services/taf-token.age; }; - lyes-mail-passwd = { - owner = "postfix"; - file = ../../../secrets/lyes/mail-passwd.age; - }; - - lyes-hidden-sieve = { - file = ../../../secrets/lyes/hidden-sieve.age; - path = "/var/sieve/lyes@mail.lyes.eu/scripts/hiddensieve.sieve"; - owner = "virtualMail"; - group = "virtualMail"; - mode = "660"; - }; + # lyes-mail-passwd = { + # owner = "postfix"; + # file = ../../../secrets/lyes/mail-passwd.age; + # }; }; } diff --git a/secrets.nix b/secrets.nix index be69f5d..743eef3 100644 --- a/secrets.nix +++ b/secrets.nix @@ -8,7 +8,7 @@ in { # Lyes "secrets/lyes/mail-passwd.age".publicKeys = [ lyes zora ]; - "secrets/lyes/hidden-sieve.age".publicKeys = [ lyes zora ]; + "secrets/lyes/sieve.age".publicKeys = [ lyes zora ]; # Zora "secrets/zora/services/kanidm-admin-password.age".publicKeys = all; diff --git a/secrets/lyes/hidden-sieve.age b/secrets/lyes/hidden-sieve.age deleted file mode 100644 index 18607ae..0000000 Binary files a/secrets/lyes/hidden-sieve.age and /dev/null differ diff --git a/secrets/lyes/sieve.age b/secrets/lyes/sieve.age new file mode 100644 index 0000000..6c16f07 Binary files /dev/null and b/secrets/lyes/sieve.age differ diff --git a/users/lyes/server/default.nix b/users/lyes/server/default.nix new file mode 100644 index 0000000..45d468a --- /dev/null +++ b/users/lyes/server/default.nix @@ -0,0 +1,8 @@ +{ ... }: + +{ + imports = + [ + ./sieve.nix + ]; +} diff --git a/users/lyes/server/sieve.nix b/users/lyes/server/sieve.nix new file mode 100644 index 0000000..ae0d258 --- /dev/null +++ b/users/lyes/server/sieve.nix @@ -0,0 +1,13 @@ +{ ... }: + +{ + age.secrets = { + lyes-sieve = { + file = ../../../secrets/lyes/sieve.age; + path = "/var/sieve/lyes@taf.lyes.eu/default.sieve"; + owner = "virtualMail"; + group = "virtualMail"; + mode = "660"; + }; + }; +}