From 02abf4ed0131237c25e0a10db50fa4c41a902a50 Mon Sep 17 00:00:00 2001 From: Alejandro Soto Date: Sun, 14 Jul 2024 17:53:13 -0600 Subject: sys: final merge of dmz, hv into sys --- env/users/default.nix | 143 ------------------------------ env/users/mailbox.nix | 241 -------------------------------------------------- env/users/users.nix | 1 - env/users/virtual.nix | 1 - 4 files changed, 386 deletions(-) delete mode 100644 env/users/default.nix delete mode 100644 env/users/mailbox.nix delete mode 100644 env/users/users.nix delete mode 100644 env/users/virtual.nix (limited to 'env/users') diff --git a/env/users/default.nix b/env/users/default.nix deleted file mode 100644 index 0e77e0d..0000000 --- a/env/users/default.nix +++ /dev/null @@ -1,143 +0,0 @@ -{ config, lib, ... }: -with lib; let - cfg = config.local; - inherit (config.networking) domain; -in -{ - imports = [ - ./mailbox.nix - ]; - - options.local = with types; let - mailOption = mkOption { - default = { }; - - type = submodule { - options.certs = mkOption { - type = listOf str; - default = [ ]; - }; - }; - }; - in - { - sysadmin = mkOption { - type = str; - }; - - users = mkOption { - default = { }; - - type = attrsOf (submodule ({ config, ... }: { - options = { - uid = mkOption { - type = int; - }; - - gid = mkOption { - type = int; - }; - - gecos = mkOption { - type = str; - default = ""; - }; - - sysadmin = mkOption { - type = bool; - default = false; - }; - - groups = mkOption { - type = listOf str; - default = [ ]; - }; - - allowLogin = mkOption { - type = bool; - default = true; - }; - - hardAliases = mkOption { - type = listOf str; - default = [ ]; - }; - - mail = mailOption; - }; - - config.groups = mkBefore (optional config.sysadmin "wheel"); - })); - }; - - virtual = mkOption { - default = { }; - - type = attrsOf (submodule ({ name, ... }: { - options = { - aliases = mkOption { - type = attrsOf (listOf str); - default = { }; - }; - - rules = mkOption { - default = [ ]; - - type = listOf (submodule { - options = { - pattern = mkOption { - type = str; - }; - - targets = mkOption { - type = listOf str; - }; - }; - }); - }; - - users = mkOption { - default = { }; - - type = attrsOf (submodule { - options.mail = mailOption; - }); - }; - }; - - config.aliases = - let - sysadmin = mkDefault [ "sysadmin@${name}" ]; - in - { - abuse = sysadmin; - security = sysadmin; - webmaster = sysadmin; - hostmaster = sysadmin; - postmaster = sysadmin; - - sysadmin = mkDefault [ "sysadmin@${domain}" ]; - }; - })); - }; - }; - - config.local = mkMerge [ - { - users = import ./users.nix; - virtual = import ./virtual.nix; - - sysadmin = - (findSingle - (user: user.value.sysadmin) - (throw "no user is declared as sysadmin") - (throw "more than one user is declared as sysadmin") - (mapAttrsToList nameValuePair cfg.users) - ).name; - } - - { - virtual.${domain}.aliases.sysadmin = [ cfg.sysadmin ]; - } - ]; -} diff --git a/env/users/mailbox.nix b/env/users/mailbox.nix deleted file mode 100644 index eaec5fc..0000000 --- a/env/users/mailbox.nix +++ /dev/null @@ -1,241 +0,0 @@ -{ config, lib, pkgs, ... }: -with lib; let - cfg = config.local; -in -{ - options.local.mailHost = with types; { - enable = mkEnableOption "mailbox host service"; - - security.acme.defaults.dnsProvider = "gandiv5"; - - mdaListen = mkOption { - type = str; - }; - - saslPort = mkOption { - type = port; - }; - - lmtpPort = mkOption { - type = port; - }; - }; - - config = - let - imapHostname = cfg.domains.imap.main; - in - mkIf cfg.mailHost.enable { - services.dovecot2 = - let - cert = config.security.acme.certs.${imapHostname}.directory; - in - { - enable = true; - enablePAM = false; - enableLmtp = true; - - sslServerKey = "${cert}/key.pem"; - sslServerCert = "${cert}/fullchain.pem"; - - modules = [ pkgs.dovecot_pigeonhole ]; - - mailUser = "vmail"; - mailGroup = "vmail"; - mailLocation = "maildir:~/mail"; - mailPlugins.perProtocol.lmtp.enable = [ "sieve" ]; - - extraConfig = - let - inherit (config.networking) domain; - - # https://dovecot.org/list/dovecot/2019-March/115250.html - # Otra solución posible (https://serverfault.com/a/1062274/980378): - # auth_username_format = %{if;%d;eq;${domain};%Ln;%Lu} - localEntry = canonical: username: '' - ${username}:::::::user=${canonical} nopassword userdb_user=${canonical} - ''; - - localMailboxes = - pkgs.writeText "local-mailboxes" - (concatStrings - (flatten (mapAttrsToList - (canonical: user: - map (localEntry canonical) ([ canonical ] ++ user.hardAliases)) - cfg.users))); - - localCerts = - flatten (mapAttrsToList - (canonical: user: - let - certNames = { - inherit canonical; - logins = [ canonical ] ++ user.hardAliases; - }; - in - map (flip nameValuePair certNames) user.mail.certs) - cfg.users); - - vmailCerts = - flatten (flatten (mapAttrsToList - (domain: virtual: mapAttrsToList - (username: user: - let - address = "${username}@${domain}"; - - certNames = { - canonical = address; - logins = [ address ]; - }; - in - map (flip nameValuePair certNames) user.mail.certs) - virtual.users) - cfg.virtual)); - - certLogins = - pkgs.writeText "cert-logins" - (concatStrings (flatten (mapAttrsToList - (uuid: names: map - (addr: '' - ${uuid}.mail-client@nodomain,${addr}:::::::user=${names.canonical} - '') - names.logins) - (listToAttrs (localCerts ++ vmailCerts))))); - - vmailPath = "/var/lib/vmail/%{if;%d;ne;;%Ld;${domain}}"; - in - '' - auth_mechanisms = plain login external - - #TODO: automatizar implantación de archivo de CA - - # Orden de concatenación de mail-fullchain-crl.crt: - # - Issuing CA cert - # - Issuing CA CRL - # - Intermediate CA cert - # - Intermediate CA CRL - # - Root CA cert - # - Root CA CRL - ssl_ca =