diff options
Diffstat (limited to '')
| -rw-r--r-- | services/email.nix | 66 | ||||
| -rw-r--r-- | services/freshrss.nix | 1 | ||||
| -rw-r--r-- | services/mysql.nix | 10 | ||||
| -rw-r--r-- | services/uptimekuma.nix | 10 |
4 files changed, 52 insertions, 35 deletions
diff --git a/services/email.nix b/services/email.nix index 5fbd04a..906b44d 100644 --- a/services/email.nix +++ b/services/email.nix @@ -33,7 +33,7 @@ in secrets = [ "user_admin_password" ]; toSops = (sname: "stalwart/${sname}"); toCredfilePath = (name: config.sops.secrets.${toSops name}.path); - toStalwartCred = name: "%{file:/run/credentials/stalwart-mail.service/${name}}%"; + toStalwartCred = name: "%{file:/run/credentials/${config.systemd.services.stalwart.name}/${name}}%"; basicListener = proto: port: tls: { bind = [ "[::]:${toString port}" ]; @@ -63,10 +63,10 @@ in # Need this bc otherwise sops will complain for some reason users = { - groups.stalwart-mail = { }; - users.stalwart-mail = { + groups.stalwart = { }; + users.stalwart = { isSystemUser = true; - group = "stalwart-mail"; + group = "stalwart"; }; }; @@ -93,39 +93,37 @@ in uri: (makeHttpRedirect "${cfg.domain}${uri}") cfg.doACME )); }) - )) - // + )) // + { ${cfg.domain} = { + addSSL = cfg.doACME; + enableACME = cfg.doACME; + serverName = "${cfg.domain}"; + locations."/" = { + proxyPass = "http://localhost:3080"; + recommendedProxySettings = true; + }; + };}; - (lib.genAttrs - (map (x: "${x}${cfg.domain}") [ - "" - "autodiscover." - "autoconfig." - ]) - (domain: { - addSSL = cfg.doACME; - enableACME = cfg.doACME; - serverName = "${domain}"; - locations."/" = { - proxyPass = "http://localhost:3080"; - recommendedProxySettings = true; - }; - }) - ); - - services.stalwart-mail = { + services.stalwart = { enable = true; dataDir = cfg.dataDir; openFirewall = false; - credentials = lib.genAttrs secrets toCredfilePath; + credentials = (lib.genAttrs secrets toCredfilePath) // (let + acme_dir = config.security.acme.certs.${cfg.domain}.directory; + cert_path = file: "${acme_dir}/${file}"; + in (if cfg.doACME then { + "tls_cert.pem" = cert_path "cert.pem"; + "tls_key.pem" = cert_path "key.pem"; + } else {})); + settings = { server.listener = { smtp = basicListener "smtp" 25 false; submission = basicListener "smtp" 465 true; imaptls = basicListener "imap" 993 true; imap = basicListener "imap" 143 true; - webdav = basicListener "http" 3080 false; - jmap = basicListener "http" 3080 false; + # webdav = basicListener "http" 3080 false; + # jmap = basicListener "http" 3080 false; http = basicListener "http" 3080 false; }; @@ -155,8 +153,20 @@ in http = { use-x-forwarded = true; - url = "protocol + \"${cfg.domain}\""; + url = "protocol + \"://${cfg.domain}\""; }; + + session.connect = { + hostname = "config_get('server.hostname')"; + }; + + server.hostname = "${cfg.domain}"; + + certificate."nix_${cfg.domain}" = lib.mkIf cfg.doACME { + cert = toStalwartCred "tls_cert.pem"; + private-key = toStalwartCred "tls_key.pem"; + default = true; + }; }; }; } diff --git a/services/freshrss.nix b/services/freshrss.nix index 2c28baa..26a1853 100644 --- a/services/freshrss.nix +++ b/services/freshrss.nix @@ -59,6 +59,7 @@ in enable = true; users."freshrss" = { sopsPlaceholder = config.sops.placeholder."fresh-rss/db_pass"; + host = "localhost"; }; databases."freshrss" = { enable = true; diff --git a/services/mysql.nix b/services/mysql.nix index 83a5033..06edfcb 100644 --- a/services/mysql.nix +++ b/services/mysql.nix @@ -23,10 +23,10 @@ let ( '' -- Clauses for user ${name} - ALTER USER IF EXISTS '${name}'@'%' IDENTIFIED BY '${ucfg.sopsPlaceholder}'; - CREATE USER IF NOT EXISTS '${name}'@'%' IDENTIFIED BY '${ucfg.sopsPlaceholder}'; + ALTER USER IF EXISTS '${name}'@'${ucfg.host}' IDENTIFIED BY '${ucfg.sopsPlaceholder}'; + CREATE USER IF NOT EXISTS '${name}'@'${ucfg.host}' IDENTIFIED BY '${ucfg.sopsPlaceholder}'; '' - + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'name'@'%'") (create_users_ensure name)) + + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'${name}'@'${ucfg.host}'") (create_users_ensure name)) ) else " -- Ommitted user ${name}"; @@ -84,6 +84,10 @@ in allowedRanges = mkOption { type = types.listOf types.str; }; + host = mkOption { + type = types.str; + default = "%"; + }; }; } ); diff --git a/services/uptimekuma.nix b/services/uptimekuma.nix index d98a0b3..720040d 100644 --- a/services/uptimekuma.nix +++ b/services/uptimekuma.nix @@ -67,10 +67,12 @@ in services.uptime-kuma = { enable = true; settings = { - UPTIME_KUMA_PORT = "3111"; - UPTIME_KUMA_HOST = "127.0.0.1"; - UPTIME_KUMA_DB_TYPE = "sqlite"; - UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock"; + UPTIME_KUMA_PORT = "3111"; + UPTIME_KUMA_HOST = "127.0.0.1"; + UPTIME_KUMA_DB_TYPE = "sqlite"; + #UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock"; + #UPTIME_KUMA_DB_USERNAME = config.systemd.services.uptime-kuma.serviceConfig.User; + #UPTIME_KUMA_DB_NAME = "uptimekuma"; }; }; }); |