Migrate mailserver to ponyo

common/network/pia-wireguard.nix

@@ -32,11 +32,11 @@ in {
       type = lib.types.str;
       default = "piaw";
     };
-    # forwardedPort = lib.mkOption {
+    forwardedPort = lib.mkOption {
-    #   type = lib.types.port;
+      type = lib.types.port;
-    #   description = "The port to redirect port forwarded TCP VPN traffic too";
+      description = "The port to redirect port forwarded TCP VPN traffic too";
-    #   default = 15050;
+      default = 15050;
-    # };
+    };
     # TODO allow disabling this
     portForwarding = lib.mkEnableOption "Enables PIA port fowarding";
 

common/server/default.nix

@@ -14,5 +14,7 @@
     ./radio.nix
     ./samba.nix
     ./owncast.nix
+    ./mailserver.nix
+    ./nextcloud.nix
   ];
 }

common/server/gitea.nix

@@ -14,11 +14,8 @@ in {
       domain = cfg.hostname;
       rootUrl = "https://${cfg.hostname}/";
       appName = cfg.hostname;
-      ssh.enable = true;
       # lfs.enable = true;
       dump.enable = true;
-      cookieSecure = true;
-      disableRegistration = true;
       settings = {
         other = {
           SHOW_FOOTER_VERSION = false;
@@ -26,6 +23,12 @@ in {
         ui = {
           DEFAULT_THEME = "arc-green";
         };
+        service = {
+          DISABLE_REGISTRATION = true;
+        };
+        session = {
+          COOKIE_SECURE = true;
+        };
       };
     };
     services.nginx.enable = true;

common/server/mailserver.nix

@@ -0,0 +1,72 @@
+{ config, pkgs, lib, ... }:
+
+
+let
+  cfg = config.mailserver;
+in {
+  config = lib.mkIf cfg.enable {
+    mailserver = {
+      fqdn = "mail.neet.dev";
+      dkimKeyBits = 2048;
+      indexDir = "/var/lib/mailindex";
+      enableManageSieve = true;
+      fullTextSearch.enable = true;
+      fullTextSearch.indexAttachments = true;
+      fullTextSearch.memoryLimit = 500;
+      domains = [
+        "neet.space" "neet.dev" "neet.cloud"
+        "runyan.org" "runyan.rocks"
+        "thunderhex.com" "tar.ninja"
+        "bsd.ninja" "bsd.rocks"
+      ];
+      loginAccounts = {
+        "jeremy@runyan.org" = {
+          hashedPasswordFile = "/run/agenix/email-pw";
+          aliases = [
+            "@neet.space" "@neet.cloud" "@neet.dev"
+            "@runyan.org" "@runyan.rocks"
+            "@thunderhex.com" "@tar.ninja"
+            "@bsd.ninja" "@bsd.rocks"
+          ];
+        };
+      };
+      rejectRecipients = [
+        "george@runyan.org"
+        "joslyn@runyan.org"
+        "damon@runyan.org"
+        "jonas@runyan.org"
+      ];
+      certificateScheme = 3; # use let's encrypt for certs
+    };
+    age.secrets.email-pw.file = ../../secrets/email-pw.age;
+
+    # sendmail to use xxx@domain instead of xxx@mail.domain
+    services.postfix.origin = "$mydomain";
+
+    # relay sent mail through mailgun
+    # https://www.howtoforge.com/community/threads/different-smtp-relays-for-different-domains-in-postfix.82711/#post-392620
+    services.postfix.config = {
+      smtp_sasl_auth_enable = "yes";
+      smtp_sasl_security_options = "noanonymous";
+      smtp_sasl_password_maps = "hash:/var/lib/postfix/conf/sasl_relay_passwd";
+      smtp_use_tls = "yes";
+      sender_dependent_relayhost_maps = "hash:/var/lib/postfix/conf/sender_relay";
+      smtp_sender_dependent_authentication = "yes";
+    };
+    services.postfix.mapFiles.sender_relay = let
+      relayHost = "[smtp.mailgun.org]:587";
+    in pkgs.writeText "sender_relay" ''
+      @neet.space ${relayHost}
+      @neet.cloud ${relayHost}
+      @neet.dev ${relayHost}
+      @runyan.org ${relayHost}
+      @runyan.rocks ${relayHost}
+      @thunderhex.com ${relayHost}
+      @tar.ninja ${relayHost}
+      @bsd.ninja ${relayHost}
+      @bsd.rocks ${relayHost}
+    '';
+    services.postfix.mapFiles.sasl_relay_passwd = "/run/agenix/sasl_relay_passwd";
+    age.secrets.sasl_relay_passwd.file = ../../secrets/sasl_relay_passwd.age;
+  };
+}

common/server/nextcloud.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, lib, ... }:
+
+
+let
+  cfg = config.services.nextcloud;
+in {
+  config = lib.mkIf cfg.enable {
+    services.nextcloud = {
+      https = true;
+      package = pkgs.nextcloud23;
+      hostName = "neet.cloud";
+      config.dbtype = "sqlite";
+      config.adminuser = "jeremy";
+      config.adminpassFile = "/run/agenix/nextcloud-pw";
+      autoUpdateApps.enable = true;
+    };
+    age.secrets.nextcloud-pw = {
+      file = ../../secrets/nextcloud-pw.age;
+      owner = "nextcloud";
+    };
+    services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+}

machines/liza/configuration.nix

@@ -10,88 +10,4 @@
   networking.hostName = "liza";
 
   networking.interfaces.enp1s0.useDHCP = true;
-
-  mailserver = {
-    enable = true;
-    fqdn = "mail.neet.dev";
-    dkimKeyBits = 2048;
-    indexDir = "/var/lib/mailindex";
-    enableManageSieve = true;
-    fullTextSearch.enable = true;
-    fullTextSearch.indexAttachments = true;
-    fullTextSearch.memoryLimit = 500;
-    domains = [
-      "neet.space" "neet.dev" "neet.cloud"
-      "runyan.org" "runyan.rocks"
-      "thunderhex.com" "tar.ninja"
-      "bsd.ninja" "bsd.rocks"
-    ];
-    loginAccounts = {
-      "jeremy@runyan.org" = {
-        hashedPasswordFile = "/run/agenix/email-pw";
-        aliases = [
-          "@neet.space" "@neet.cloud" "@neet.dev"
-          "@runyan.org" "@runyan.rocks"
-          "@thunderhex.com" "@tar.ninja"
-          "@bsd.ninja" "@bsd.rocks"
-        ];
-      };
-    };
-    rejectRecipients = [
-      "george@runyan.org"
-      "joslyn@runyan.org"
-      "damon@runyan.org"
-      "jonas@runyan.org"
-    ];
-    certificateScheme = 3; # use let's encrypt for certs
-  };
-  age.secrets.email-pw.file = ../../secrets/email-pw.age;
-
-  # sendmail to use xxx@domain instead of xxx@mail.domain
-  services.postfix.origin = "$mydomain";
-
-  # relay sent mail through mailgun
-  # https://www.howtoforge.com/community/threads/different-smtp-relays-for-different-domains-in-postfix.82711/#post-392620
-  services.postfix.config = {
-    smtp_sasl_auth_enable = "yes";
-    smtp_sasl_security_options = "noanonymous";
-    smtp_sasl_password_maps = "hash:/var/lib/postfix/conf/sasl_relay_passwd";
-    smtp_use_tls = "yes";
-    sender_dependent_relayhost_maps = "hash:/var/lib/postfix/conf/sender_relay";
-    smtp_sender_dependent_authentication = "yes";
-  };
-  services.postfix.mapFiles.sender_relay = let
-    relayHost = "[smtp.mailgun.org]:587";
-  in pkgs.writeText "sender_relay" ''
-    @neet.space ${relayHost}
-    @neet.cloud ${relayHost}
-    @neet.dev ${relayHost}
-    @runyan.org ${relayHost}
-    @runyan.rocks ${relayHost}
-    @thunderhex.com ${relayHost}
-    @tar.ninja ${relayHost}
-    @bsd.ninja ${relayHost}
-    @bsd.rocks ${relayHost}
-  '';
-  services.postfix.mapFiles.sasl_relay_passwd = "/run/agenix/sasl_relay_passwd";
-  age.secrets.sasl_relay_passwd.file = ../../secrets/sasl_relay_passwd.age;
-
-  services.nextcloud = {
-    enable = true;
-    https = true;
-    package = pkgs.nextcloud22;
-    hostName = "neet.cloud";
-    config.dbtype = "sqlite";
-    config.adminuser = "jeremy";
-    config.adminpassFile = "/run/agenix/nextcloud-pw";
-    autoUpdateApps.enable = true;
-  };
-  age.secrets.nextcloud-pw = {
-    file = ../../secrets/nextcloud-pw.age;
-    owner = "nextcloud";
-  };
-  services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
-    enableACME = true;
-    forceSSL = true;
-  };
 }

machines/ponyo/configuration.nix

@@ -11,10 +11,11 @@
 
   services.zerotierone.enable = true;
 
+  mailserver.enable = true;
+
   services.gitea = {
     enable = true;
     hostname = "git.neet.dev";
-    disableRegistration = true;
   };
 
   services.thelounge = {