Remilia: add SNM and vault-agent

This commit is contained in:
2021-06-07 10:23:28 +05:30
parent 7602cbf16a
commit 2ffcab212c
5 changed files with 69 additions and 13 deletions

View File

@@ -73,7 +73,7 @@
modules = [ modules = [
./modules/vault-agent.nix ./modules/vault-agent.nix
./hosts/servers/marisa.nix ./hosts/servers/marisa.nix
inputs.mailserver.nixosModules.mailserver #inputs.mailserver.nixosModules.mailserver
{ {
nixpkgs.pkgs = self.packages.aarch64-linux; nixpkgs.pkgs = self.packages.aarch64-linux;
} }
@@ -93,7 +93,9 @@
Remilia = nixpkgs.lib.nixosSystem { Remilia = nixpkgs.lib.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
modules = [ modules = [
./modules/vault-agent.nix
./hosts/servers/remilia.nix ./hosts/servers/remilia.nix
inputs.mailserver.nixosModules.mailserver
{ {
nixpkgs.pkgs = self.packages.x86_64-linux; nixpkgs.pkgs = self.packages.x86_64-linux;
} }

View File

@@ -9,6 +9,7 @@
./remilia/boot.nix ./remilia/boot.nix
./remilia/services.nix ./remilia/services.nix
./remilia/builder.nix ./remilia/builder.nix
./remilia/mailserver.nix
../../configs/nvim.nix ../../configs/nvim.nix
]; ];
# programs.gnupg.agent.enable = lib.mkForce false; # programs.gnupg.agent.enable = lib.mkForce false;

View File

@@ -0,0 +1,16 @@
{ config, pkgs, ... }:
{
mailserver = {
enable = true;
fqdn = "mail.weirdnatto.in";
domains = [ "weirdnatto.in" ];
loginAccounts = {
"natto@weirdnatto.in" = {
hashedPasswordFile = "/var/secrets/natto@weirdnatto.in.key";
aliases = ["@weirdnatto.in"];
};
};
enablePop3 = false;
enablePop3Ssl = false;
};
}

View File

@@ -6,7 +6,12 @@
firewall = { firewall = {
interfaces = { interfaces = {
ens3 = { ens3 = {
allowedTCPPorts = [ 22 80 443 ]; allowedTCPPorts = [
22
80 81
443 444
993 465 143 25
];
allowedUDPPorts = [ 17840 ]; allowedUDPPorts = [ 17840 ];
}; };
}; };
@@ -33,7 +38,7 @@
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.55.0.0/24 -o ${config.networking.nat.externalInterface} -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.55.0.0/24 -o ${config.networking.nat.externalInterface} -j MASQUERADE
''; '';
privateKeyFile = "/var/secrets/wg"; privateKeyFile = "/var/secrets/wg.key";
peers = [ peers = [
{ {
publicKey = "m9SSpkj+r2QY4YEUMEoTkbOI/L7C39Kh6m45QZ5mkw4="; publicKey = "m9SSpkj+r2QY4YEUMEoTkbOI/L7C39Kh6m45QZ5mkw4=";

View File

@@ -1,18 +1,20 @@
{config, pkgs, ...}: {config, pkgs, ...}:
{ {
services = { services = {
openssh = { openssh = { enable = true;
enable = true;
permitRootLogin = "yes"; permitRootLogin = "yes";
}; };
nginx = { nginx = {
enable = true; enable = true;
package = pkgs.nginx; package = (pkgs.nginx.overrideAttrs(oa: {
configureFlags = oa.configureFlags ++ [ "--with-mail" "--with-mail_ssl_module" ];
}));
virtualHosts = { virtualHosts = {
"weirdnatto.in" = { "weirdnatto.in" = {
addSSL = true; addSSL = true;
enableACME = true; enableACME = true;
locations."/".proxyPass = "http://10.55.0.2:80"; locations."/".proxyPass = "http://10.55.0.2:80";
serverAliases = [ "www.weirdnatto.in" ];
}; };
"git.weirdnatto.in" = { "git.weirdnatto.in" = {
addSSL = true; addSSL = true;
@@ -24,24 +26,54 @@
''; '';
}; };
}; };
"mail.weirdnatto.in" = {
addSSL = true;
enableACME = true;
locations."/" = {};
}; };
}; };
vault-agent = {
enable = true;
settings = {
vault = {
address = "https://10.55.0.2:8800";
client_cert = "/var/vault/cert.pem";
client_key = "/var/vault/key.pem";
}; };
auto_auth = {
method = [
{
"cert" = {
name = "Remilia";
};
}
];
};
template = [
{
source = pkgs.writeText "wg.tpl" ''
{{ with secret "kv/systems/Remilia/wg" }}{{ .Data.data.private }}{{ end }}
'';
destination = "/var/secrets/wg.key";
}
{
source = pkgs.writeText "natto@weirdnatto.in.tpl" ''
{{ with secret "kv/systems/Remilia" }}{{ .Data.data.nattomail }}{{ end }}
'';
destination = "/var/secrets/natto@weirdnatto.in.key";
}
];
};
};
}; };
users.users.root.openssh.authorizedKeys.keys = [ users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHingN2Aho+KGgEvBMjtoez+W1svl9uVoa4vG0d646j" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHingN2Aho+KGgEvBMjtoez+W1svl9uVoa4vG0d646j"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILCH975XCps+VCzo8Fpp5BkbtiFmj9y3//FBVYlQ7/yo"
]; ];
security.acme = { security.acme = {
acceptTerms = true; acceptTerms = true;
certs = { certs = {
"weirdnatto.in".email = "natto+acme@weirdnatto.in"; "weirdnatto.in".email = "natto+acme@weirdnatto.in";
"git.weirdnatto.in".email = "git+acme@weirdnatto.in"; "git.weirdnatto.in".email = "git+acme@weirdnatto.in";
"mail.weirdnatto.in".email = "mail+acme@weirdnatto.in";
}; };
}; };
security.pki.certificateFiles = [ ../../../cert.pem ];
} }