Add smtp to pretty much every service on the server
This commit is contained in:
Jimbo
parent
8eb0724768
commit
963e056b93
7 changed files with 277 additions and 93 deletions
|
|
@ -9,10 +9,13 @@ let
|
|||
bloxeldomain = ''bloxelcom.net'';
|
||||
|
||||
# IPs
|
||||
localspan = ''192.168.1'';
|
||||
pc = ''${localspan}.18'';
|
||||
server = ''${localspan}.17'';
|
||||
localspan = ''192.168.2'';
|
||||
pc = ''${localspan}.10'';
|
||||
server = ''${localspan}.11'';
|
||||
vm = ''${localspan}.70'';
|
||||
|
||||
# Secrets and passwords
|
||||
secrets = import ./secrets.nix;
|
||||
in
|
||||
|
||||
{
|
||||
|
|
@ -67,22 +70,36 @@ in
|
|||
# Disable Nano
|
||||
programs.nano.enable = false;
|
||||
|
||||
# Define a user account.
|
||||
# Define user account.
|
||||
users.users.jimbo = {
|
||||
isNormalUser = true;
|
||||
hashedPassword =
|
||||
"$6$gYpE.pG/zPXgin06$2kydjDfd0K62Dhf9P0PFvJhRNz6xIC/bHYaf/XYqyKcLyZNzPQpy8uy9tCRcSYlj1wwBhzVtTRyItwajOHCEj0";
|
||||
hashedPassword = secrets.jimboAccPassword;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDLe/HioxCOkszFQdm1vb3ZwuzLzsOThqHNvEI4IXeXZ JimPhone"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuCYrIZlD6LNpFh3XTYbXaPQWYysr1oZAX4DL3gF28l jimbo@DV-JHAMPTON"
|
||||
];
|
||||
extraGroups = [ "wheel" "docker" ];
|
||||
extraGroups = [ "wheel" "docker" "musicFolder" "nfsShare" ];
|
||||
uid = 1000;
|
||||
shell = pkgs.zsh;
|
||||
};
|
||||
|
||||
# Add Nginx to extra groups
|
||||
users.users.nginx.extraGroups = [ "turnserver" "virtualMail" ];
|
||||
# Add service users to extra groups
|
||||
users.users = {
|
||||
nginx = {
|
||||
extraGroups = [ "turnserver" "virtualMail" ];
|
||||
isSystemUser = true;
|
||||
};
|
||||
nextcloud = {
|
||||
extraGroups = [ "nfsShare" "musicFolder" ];
|
||||
isSystemUser = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Define custom groups
|
||||
users.groups = {
|
||||
nfsShare = {};
|
||||
musicFolder = {};
|
||||
};
|
||||
|
||||
# Installed programs to the system profile.
|
||||
environment.systemPackages = with pkgs; [
|
||||
|
|
@ -110,9 +127,12 @@ in
|
|||
80 443
|
||||
|
||||
# Minecraft
|
||||
25565 19132
|
||||
25565 19132
|
||||
|
||||
# Gitea
|
||||
# Pufferpanel sftp
|
||||
5657
|
||||
|
||||
# Gitea SSH
|
||||
2299
|
||||
|
||||
# Coturn
|
||||
|
|
@ -156,9 +176,9 @@ in
|
|||
''
|
||||
iptables -N RTMPCHAIN
|
||||
iptables -A INPUT -p tcp -m tcp --match multiport --dports 1935,1945 -j RTMPCHAIN
|
||||
iptables -A RTMPCHAIN -s ${pc} -j ACCEPT
|
||||
iptables -A RTMPCHAIN -s 71.87.124.226 -j ACCEPT
|
||||
iptables -A RTMPCHAIN -s 24.66.98.13 -j ACCEPT
|
||||
iptables -A RTMPCHAIN -s ${pc} -m comment --comment "Local PC" -j ACCEPT
|
||||
iptables -A RTMPCHAIN -s 71.87.124.226 -m comment --comment "Luna IP" -j ACCEPT
|
||||
iptables -A RTMPCHAIN -s 24.66.98.13 -m comment --comment "Freecorn IP" -j ACCEPT
|
||||
iptables -A RTMPCHAIN -j DROP
|
||||
'' +
|
||||
|
||||
|
|
@ -225,10 +245,21 @@ in
|
|||
recommendedGzipSettings = true;
|
||||
recommendedProxySettings = true;
|
||||
virtualHosts = {
|
||||
# Homepage redirect
|
||||
"${jimdomain}" = {
|
||||
enableACME = true;
|
||||
addSSL = true;
|
||||
locations."/" = {
|
||||
extraConfig = "
|
||||
return 301 https://social.${bloxeldomain}/@jimbo;
|
||||
";
|
||||
};
|
||||
};
|
||||
|
||||
# Nextcloud Proxy
|
||||
"cloud.${jimdomain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
addSSL = true;
|
||||
locations."/" = {
|
||||
proxyWebsockets = true;
|
||||
extraConfig = "
|
||||
|
|
@ -283,6 +314,16 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
# Gitea Proxy
|
||||
"mc.${jimdomain}" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:5010";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Matrix Proxy
|
||||
"matrix.${bloxeldomain}" = {
|
||||
enableACME = true;
|
||||
|
|
@ -293,8 +334,8 @@ in
|
|||
|
||||
# Element Proxy
|
||||
"chat.${bloxeldomain}" = {
|
||||
addSSL = true;
|
||||
enableACME = true;
|
||||
addSSL = true;
|
||||
root = "${pkgs.element-web}";
|
||||
};
|
||||
|
||||
|
|
@ -347,8 +388,8 @@ in
|
|||
|
||||
# Staging Bloxel Proxy
|
||||
"staging.${bloxeldomain}" = {
|
||||
addSSL = true;
|
||||
enableACME = true;
|
||||
addSSL = true;
|
||||
root = "/var/www/bloxelcomweb/landing-page/";
|
||||
locations."/BloxelcomCable/hls" = {
|
||||
extraConfig = ''
|
||||
|
|
@ -396,6 +437,11 @@ in
|
|||
hls_fragment 3;
|
||||
hls_playlist_length 40;
|
||||
}
|
||||
application forward {
|
||||
record off;
|
||||
live on;
|
||||
allow play all;
|
||||
}
|
||||
}
|
||||
}
|
||||
'';
|
||||
|
|
@ -416,6 +462,16 @@ in
|
|||
trusted_proxies = [ "127.0.0.1" ];
|
||||
trusted_domains = [ "cloud.${jimdomain}" ];
|
||||
overwriteprotocol = "https";
|
||||
|
||||
# Mailserver settings
|
||||
mail_smtphost = "mx.${bloxeldomain}";
|
||||
mail_domain = "${bloxeldomain}";
|
||||
mail_from_address = "noreply";
|
||||
mail_smtpauth = "true";
|
||||
mail_smtpname = "noreply@${bloxeldomain}";
|
||||
mail_smtppassword = secrets.noreplyPassword;
|
||||
mail_smtpmode = "smtp";
|
||||
mail_smtpport = 587;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -428,6 +484,16 @@ in
|
|||
ROCKET_ADDRESS = "127.0.0.1";
|
||||
ROCKET_PORT = 8222;
|
||||
ROCKET_LOG = "critical";
|
||||
|
||||
# Smtp email
|
||||
SMTP_HOST = "mx.${bloxeldomain}";
|
||||
SMTP_FROM = "noreply@${bloxeldomain}";
|
||||
SMTP_FROM_NAME = "Vaultwarden";
|
||||
SMTP_USERNAME = "noreply@${bloxeldomain}";
|
||||
SMTP_PASSWORD = secrets.noreplyPassword;
|
||||
SMTP_SECURITY = "starttls";
|
||||
SMTP_PORT = 587;
|
||||
SMTP_TIMEOUT = 15;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -448,10 +514,75 @@ in
|
|||
SSH_PORT = 2299;
|
||||
START_SSH_SERVER = true;
|
||||
};
|
||||
mailer = {
|
||||
ENABLED = true;
|
||||
SMTP_ADDR = "mx.${bloxeldomain}";
|
||||
FROM = "noreply@${bloxeldomain}";
|
||||
PASSWD = secrets.noreplyPassword;
|
||||
PROTOCOL = "smtp+starttls";
|
||||
SMTP_PORT = 587;
|
||||
};
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Pufferpannel for Minecraft
|
||||
pufferpanel = {
|
||||
enable = true;
|
||||
environment = {
|
||||
PUFFER_WEB_HOST = ":5010";
|
||||
PUFFER_PANEL_REGISTRATIONENABLED = "false";
|
||||
PUFFER_PANEL_EMAIL_PROVIDER = "smtp";
|
||||
PUFFER_PANEL_EMAIL_HOST = "mx.${bloxeldomain}:587";
|
||||
PUFFER_PANEL_EMAIL_FROM = "noreply@${bloxeldomain}";
|
||||
PUFFER_PANEL_EMAIL_USERNAME = "noreply@${bloxeldomain}";
|
||||
PUFFER_PANEL_EMAIL_PASSWORD = secrets.noreplyPassword;
|
||||
};
|
||||
extraPackages = with pkgs; [ bash curl gawk gnutar gzip ];
|
||||
package = pkgs.buildFHSEnv {
|
||||
name = "pufferpanel-fhs";
|
||||
meta.mainProgram = "pufferpanel-fhs";
|
||||
runScript = lib.getExe pkgs.pufferpanel;
|
||||
targetPkgs = pkgs': with pkgs'; [ icu openssl zlib ];
|
||||
};
|
||||
};
|
||||
|
||||
# MariaDB
|
||||
mysql = {
|
||||
enable = true;
|
||||
package = pkgs.mariadb;
|
||||
dataDir = "/var/lib/mysql";
|
||||
initialDatabases = [
|
||||
{ name = "nextcloud"; }
|
||||
{ name = "matrix"; }
|
||||
{ name = "git"; }
|
||||
{ name = "minecraft"; }
|
||||
];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "nextcloud";
|
||||
ensurePermissions = {
|
||||
"nextcloud.*" = "ALL PRIVILEGES";
|
||||
};
|
||||
}{
|
||||
name = "matrix-synapse";
|
||||
ensurePermissions = {
|
||||
"matrix.*" = "ALL PRIVILEGES";
|
||||
};
|
||||
}{
|
||||
name = "gitea";
|
||||
ensurePermissions = {
|
||||
"git.*" = "ALL PRIVILEGES";
|
||||
};
|
||||
}{
|
||||
name = "minecraft";
|
||||
ensurePermissions = {
|
||||
"minecraft.*" = "ALL PRIVILEGES";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
# Owncast
|
||||
owncast = {
|
||||
enable = true;
|
||||
|
|
@ -477,7 +608,6 @@ in
|
|||
# Synapse for Matrix clients
|
||||
matrix-synapse = with config.services.coturn; {
|
||||
enable = true;
|
||||
extraConfigFiles = [ "/etc/matrix-synapse/conf.d/email-conf.yaml" ];
|
||||
settings = {
|
||||
server_name = "${bloxeldomain}";
|
||||
public_baseurl = "https://matrix.${bloxeldomain}";
|
||||
|
|
@ -494,6 +624,26 @@ in
|
|||
x_forwarded = true;
|
||||
}];
|
||||
|
||||
# Enable smtp for password resets
|
||||
email = {
|
||||
notif_from = "Bloxelcom's Matrix Homeserver <noreply@bloxelcom.net>";
|
||||
smtp_host = "mx.${bloxeldomain}";
|
||||
smtp_user = "noreply@${bloxeldomain}";
|
||||
smtp_pass = secrets.noreplyPassword;
|
||||
enable_tls = true;
|
||||
smtp_port = 587;
|
||||
require_transport_security = true;
|
||||
};
|
||||
|
||||
# Disable registration without email
|
||||
registrations_require_3pid = [ "email" ];
|
||||
|
||||
# Allow only this range of emails
|
||||
allowed_local_3pids = [{
|
||||
medium = "email";
|
||||
pattern = "^[^@]+@bloxelcom\\.net$";
|
||||
}];
|
||||
|
||||
# Set the type of database
|
||||
database.name = "sqlite3";
|
||||
|
||||
|
|
@ -522,17 +672,17 @@ in
|
|||
streamingProcesses = 4;
|
||||
configureNginx = true;
|
||||
smtp = {
|
||||
createLocally = false;
|
||||
host = "mx.${bloxeldomain}";
|
||||
port = 587;
|
||||
authenticate = true;
|
||||
user = "noreply@${bloxeldomain}";
|
||||
passwordFile = "/var/lib/mastodon/secrets/smtp-password";
|
||||
fromAddress = "noreply@${bloxeldomain}";
|
||||
createLocally = false;
|
||||
user = "noreply@${bloxeldomain}";
|
||||
passwordFile = pkgs.writeText "smtp_pass.txt" secrets.noreplyPassword;
|
||||
};
|
||||
};
|
||||
|
||||
# Try Lemmy
|
||||
# Lemmy forums
|
||||
lemmy = {
|
||||
enable = true;
|
||||
nginx.enable = true;
|
||||
|
|
@ -543,19 +693,13 @@ in
|
|||
smtp_server = "mx.${bloxeldomain}:587";
|
||||
smtp_login = "noreply@${bloxeldomain}";
|
||||
smtp_from_address = "noreply@${bloxeldomain}";
|
||||
smtp_password = secrets.noreplyPassword;
|
||||
tls_type = "starttls";
|
||||
};
|
||||
};
|
||||
smtpPasswordFile = "/var/lib/mastodon/secrets/smtp-password";
|
||||
};
|
||||
|
||||
# Snowflake proxy for Tor
|
||||
snowflake-proxy.enable = true;
|
||||
|
||||
# Fix a nonbuilding issue
|
||||
logrotate.checkConfig = false;
|
||||
|
||||
# Try roundcube
|
||||
# Roundcube mail server
|
||||
roundcube = {
|
||||
enable = true;
|
||||
hostName = "mail.${bloxeldomain}";
|
||||
|
|
@ -565,6 +709,12 @@ in
|
|||
$config['smtp_pass'] = "%p";
|
||||
'';
|
||||
};
|
||||
|
||||
# Snowflake proxy for Tor
|
||||
snowflake-proxy.enable = true;
|
||||
|
||||
# Fix a nonbuilding issue
|
||||
logrotate.checkConfig = false;
|
||||
};
|
||||
|
||||
# Make Nginx not shit itself
|
||||
|
|
@ -626,21 +776,25 @@ in
|
|||
# Generate passwords with nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt'
|
||||
loginAccounts = {
|
||||
"noreply@${bloxeldomain}" = {
|
||||
hashedPasswordFile = "${pkgs.writeText "noreply" "$2b$05$7VibcFKXy5Ff9sUMh3KWBeSXkInXNeaADa71Md/swt5RCk5s7UnM2"}";
|
||||
hashedPasswordFile = pkgs.writeText "noreply" secrets.noreplySmtpHash;
|
||||
sendOnly = true;
|
||||
};
|
||||
"jimbo@${bloxeldomain}" = {
|
||||
hashedPasswordFile = "${pkgs.writeText "jimbo" "$2b$05$Chm7AjSicifTVpUWjOx1q.9YGaokIjxijAfqKTmI6o3OR2QU0B4U."}";
|
||||
hashedPasswordFile = pkgs.writeText "jimbo" secrets.jimboSmtpHash;
|
||||
aliases = [ "canada@${bloxeldomain}" "contact@${bloxeldomain}" ];
|
||||
};
|
||||
"lunamoonlight@${bloxeldomain}" = {
|
||||
hashedPasswordFile = "${pkgs.writeText "luna" "$2a$12$ytZ1k4S.XvQAvzc3pHNDV.m7A/bo8PKznA2qH27g5QHMYDloFHdnK"}";
|
||||
hashedPasswordFile = pkgs.writeText "luna" secrets.lunaSmtpHash;
|
||||
aliases = [ "us@${bloxeldomain}" "contact@${bloxeldomain}" ];
|
||||
};
|
||||
"freecorn1854@${bloxeldomain}" = {
|
||||
hashedPasswordFile = "${pkgs.writeText "freecorn1854" "$2b$05$7EF0TV39XzTYPIdWOoMnlegX8qLkcHxUytkvAt5sRDQE1oquAFTqm"}";
|
||||
hashedPasswordFile = pkgs.writeText "freecorn" secrets.freecornSmtpHash;
|
||||
aliases = [ "canada@${bloxeldomain}" "contact@${bloxeldomain}" ];
|
||||
};
|
||||
"tinyattack09@${bloxeldomain}" = {
|
||||
hashedPasswordFile = pkgs.writeText "tiny" secrets.tinySmtpHash;
|
||||
aliases = [ "smallthing@${bloxeldomain}" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -19,7 +19,6 @@
|
|||
"/home/jimbo/JimboNFS" = {
|
||||
device = "/dev/disk/by-uuid/713fcd92-534c-4153-8e04-e0c6fe5f6a51";
|
||||
fsType = "ext4";
|
||||
neededForBoot = true;
|
||||
};
|
||||
"/export/JimboNFS" = {
|
||||
device = "/home/jimbo/JimboNFS";
|
||||
|
|
@ -27,41 +26,53 @@
|
|||
options = [ "bind" ];
|
||||
};
|
||||
"/mnt/nextcloud/data/JimboNFS" = {
|
||||
device = "/home/jimbo/JimboNFS";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
"/var/lib/docker/volumes/azuracast_station_data/_data/bloxradio/media/Music" = {
|
||||
device = "/home/jimbo/JimboNFS/Music";
|
||||
device = "/export/JimboNFS";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
|
||||
# Atrocity
|
||||
# Atrocity of var bindmounts
|
||||
"/var/lib/bitwarden_rs" = {
|
||||
device = "/home/jimbo/JimboNFS/System/var/lib/bitwarden_rs";
|
||||
device = "/export/JimboNFS/System/var/lib/bitwarden_rs";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
depends = [ "/export/JimboNFS" ];
|
||||
};
|
||||
"/var/lib/gitea" = {
|
||||
device = "/home/jimbo/JimboNFS/System/var/lib/gitea";
|
||||
device = "/export/JimboNFS/System/var/lib/gitea";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
depends = [ "/export/JimboNFS" ];
|
||||
};
|
||||
"/var/lib/matrix-synapse" = {
|
||||
device = "/home/jimbo/JimboNFS/System/var/lib/matrix-synapse";
|
||||
device = "/export/JimboNFS/System/var/lib/matrix-synapse";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
depends = [ "/export/JimboNFS" ];
|
||||
};
|
||||
"/var/lib/nextcloud" = {
|
||||
device = "/home/jimbo/JimboNFS/System/var/lib/nextcloud";
|
||||
device = "/export/JimboNFS/System/var/lib/nextcloud";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
depends = [ "/export/JimboNFS" ];
|
||||
};
|
||||
"/var/lib/owncast" = {
|
||||
device = "/home/jimbo/JimboNFS/System/var/lib/owncast";
|
||||
device = "/export/JimboNFS/System/var/lib/owncast";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
depends = [ "/export/JimboNFS" ];
|
||||
};
|
||||
"/var/lib/docker/volumes/azuracast_station_data/_data/bloxradio/media/Music" = {
|
||||
device = "/export/JimboNFS/Music";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
depends = [ "/export/JimboNFS" ];
|
||||
};
|
||||
"/var/lib/pufferpanel/servers" = {
|
||||
device = "/export/JimboNFS/MineServers";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
depends = [ "/export/JimboNFS" ];
|
||||
};
|
||||
};
|
||||
swapDevices = [
|
||||
|
|
|
|||
|
|
@ -355,11 +355,11 @@ let
|
|||
a:/home/jimbo/JimboNFS
|
||||
K:/home/jimbo/JimboNFS/Downloads
|
||||
p:/home/jimbo/JimboNFS/Photos
|
||||
P:/home/jimbo/JimboNFS/Projects
|
||||
V:/home/jimbo/JimboNFS/Videos/Random
|
||||
m:/home/jimbo/JimboNFS/Music
|
||||
L:/home/jimbo/JimboNFS/MineServers
|
||||
s:/home/jimbo/JimboNFS/School
|
||||
N:/home/jimbo/JimboNFS/JimboOS/NixOS
|
||||
'';
|
||||
in
|
||||
|
||||
|
|
@ -514,6 +514,8 @@ in
|
|||
syntaxHighlighting.enable = true;
|
||||
initExtra = ''
|
||||
${pkgs.any-nix-shell}/bin/any-nix-shell zsh --info-right | source /dev/stdin; pfetch
|
||||
setopt HIST_IGNORE_SPACE
|
||||
setopt RM_STAR_WAIT
|
||||
'';
|
||||
oh-my-zsh = {
|
||||
enable = true;
|
||||
|
|
@ -524,7 +526,7 @@ in
|
|||
mineServers = ''/home/jimbo/JimboNFS/MineServers'';
|
||||
in {
|
||||
# NixOS aliases
|
||||
nixcfg = "nvim /etc/nixos/{configuration,jimbo,hardware-configuration}.nix";
|
||||
nixcfg = "nvim /etc/nixos/{configuration,jimbo,secrets,hardware-configuration}.nix";
|
||||
nixswitch = "${auth} nixos-rebuild switch";
|
||||
nixdate = "${auth} nixos-rebuild switch --upgrade-all";
|
||||
nixclean = "${auth} nix-store --gc; nix-collect-garbage -d";
|
||||
|
|
@ -540,15 +542,6 @@ in
|
|||
|
||||
# Start basic programs
|
||||
controlpanel = "tmux new-session -d -s control; tmux attach -t control";
|
||||
|
||||
# Minecraft stuff
|
||||
mcstart21 = "${pkgs.temurin-jre-bin-21}/bin/java -Xmx4G -jar";
|
||||
mcstart8 = "${pkgs.temurin-jre-bin-8}/bin/java -Xmx4G -jar";
|
||||
velocitystart = "cd ${mineServers}/Velocity && mcstart21 velocity*";
|
||||
johnstart = "cd ${mineServers}/Johnside-SMP && mcstart21 paper* --nogui";
|
||||
bloxelstart = "cd ${mineServers}/Bloxelcom && mcstart21 paper* --nogui";
|
||||
dewstart = "cd ${mineServers}/DewDestroyer && mcstart21 paper* --nogui";
|
||||
betastart = "cd ${mineServers}/BetaServer && mcstart8 Posiden*";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue