summaryrefslogtreecommitdiffstats
path: root/krebs/3modules
diff options
context:
space:
mode:
Diffstat (limited to 'krebs/3modules')
-rw-r--r--krebs/3modules/default.nix40
-rw-r--r--krebs/3modules/dns.nix13
-rw-r--r--krebs/3modules/ergo.nix133
-rw-r--r--krebs/3modules/exim-smarthost.nix43
-rw-r--r--krebs/3modules/hosts.nix2
-rw-r--r--krebs/3modules/htgen.nix21
-rw-r--r--krebs/3modules/krebs-pages.nix46
-rw-r--r--krebs/3modules/sitemap.nix8
-rw-r--r--krebs/3modules/ssl.nix21
-rw-r--r--krebs/3modules/users.nix20
10 files changed, 150 insertions, 197 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 70fc05813..bff7e135f 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -7,6 +7,7 @@ let
out = {
imports = [
../../kartei
+ ../../submodules/disko/module.nix
./acl.nix
./airdcpp.nix
./announce-activation.nix
@@ -20,7 +21,6 @@ let
./ci
./current.nix
./dns.nix
- ./ergo.nix
./exim-retiolum.nix
./exim-smarthost.nix
./exim.nix
@@ -35,6 +35,7 @@ let
./iptables.nix
./kapacitor.nix
./konsens.nix
+ ./krebs-pages.nix
./monit.nix
./nixpkgs.nix
./on-failure.nix
@@ -49,6 +50,7 @@ let
./secret.nix
./setuid.nix
./shadow.nix
+ ./sitemap.nix
./ssl.nix
./sync-containers.nix
./systemd.nix
@@ -56,6 +58,7 @@ let
./tinc_graphs.nix
./upstream
./urlwatch.nix
+ ./users.nix
./xresources.nix
./zones.nix
];
@@ -66,15 +69,6 @@ let
api = {
enable = mkEnableOption "krebs";
- users = mkOption {
- type = with types; attrsOf user;
- };
-
- sitemap = mkOption {
- default = {};
- type = types.attrsOf types.sitemap.entry;
- };
-
zone-head-config = mkOption {
type = with types; attrsOf str;
description = ''
@@ -91,10 +85,6 @@ let
@ IN SOA dns19.ovh.net. tech.ovh.net. (2015052000 86400 3600 3600000 86400)
IN NS ns19.ovh.net.
IN NS dns19.ovh.net.
- IN A 185.199.108.153
- IN A 185.199.109.153
- IN A 185.199.110.153
- IN A 185.199.111.153
'';
};
};
@@ -102,28 +92,6 @@ let
imp = lib.mkMerge [
{
- krebs.dns.providers = {
- "krebsco.de" = "zones";
- shack = "hosts";
- i = "hosts";
- r = "hosts";
- w = "hosts";
- };
-
- krebs.dns.search-domain = mkDefault "r";
-
- krebs.users = {
- krebs = {
- home = "/krebs";
- mail = "spam@krebsco.de";
- };
- root = {
- home = "/root";
- pubkey = config.krebs.build.host.ssh.pubkey;
- uid = 0;
- };
- };
-
services.openssh.hostKeys =
let inherit (config.krebs.build.host.ssh) privkey; in
mkIf (privkey != null) [privkey];
diff --git a/krebs/3modules/dns.nix b/krebs/3modules/dns.nix
index 8acc4ccd8..8a74d3067 100644
--- a/krebs/3modules/dns.nix
+++ b/krebs/3modules/dns.nix
@@ -1,12 +1,21 @@
with import <stockholm/lib>;
-{
+{ config, ... }: {
options = {
krebs.dns.providers = mkOption {
type = types.attrsOf types.str;
};
-
krebs.dns.search-domain = mkOption {
type = types.nullOr types.hostname;
};
};
+ config = mkIf config.krebs.enable {
+ krebs.dns.providers = {
+ "krebsco.de" = "zones";
+ shack = "hosts";
+ i = "hosts";
+ r = "hosts";
+ w = "hosts";
+ };
+ krebs.dns.search-domain = mkDefault "r";
+ };
}
diff --git a/krebs/3modules/ergo.nix b/krebs/3modules/ergo.nix
deleted file mode 100644
index d5f167e79..000000000
--- a/krebs/3modules/ergo.nix
+++ /dev/null
@@ -1,133 +0,0 @@
-{ config, lib, options, pkgs, ... }: {
- options = {
- krebs.ergo = {
- enable = lib.mkEnableOption "Ergo IRC daemon";
- openFilesLimit = lib.mkOption {
- type = lib.types.int;
- default = 1024;
- description = ''
- Maximum number of open files. Limits the clients and server connections.
- '';
- };
- config = lib.mkOption {
- type = (pkgs.formats.json {}).type;
- description = ''
- Ergo IRC daemon configuration file.
- https://raw.githubusercontent.com/ergochat/ergo/master/default.yaml
- '';
- default = {
- network = {
- name = "krebstest";
- };
- server = {
- name = "${config.networking.hostName}.r";
- listeners = {
- ":6667" = {};
- };
- casemapping = "permissive";
- enforce-utf = true;
- lookup-hostnames = false;
- ip-cloaking = {
- enabled = false;
- };
- forward-confirm-hostnames = false;
- check-ident = false;
- relaymsg = {
- enabled = false;
- };
- max-sendq = "1M";
- ip-limits = {
- count = false;
- throttle = false;
- };
- };
- datastore = {
- autoupgrade = true;
- path = "/var/lib/ergo/ircd.db";
- };
- accounts = {
- authentication-enabled = true;
- registration = {
- enabled = true;
- allow-before-connect = true;
- throttling = {
- enabled = true;
- duration = "10m";
- max-attempts = 30;
- };
- bcrypt-cost = 4;
- email-verification.enabled = false;
- };
- multiclient = {
- enabled = true;
- allowed-by-default = true;
- always-on = "opt-out";
- auto-away = "opt-out";
- };
- };
- channels = {
- default-modes = "+ntC";
- registration = {
- enabled = true;
- };
- };
- limits = {
- nicklen = 32;
- identlen = 20;
- channellen = 64;
- awaylen = 390;
- kicklen = 390;
- topiclen = 390;
- };
- history = {
- enabled = true;
- channel-length = 2048;
- client-length = 256;
- autoresize-window = "3d";
- autoreplay-on-join = 0;
- chathistory-maxmessages = 100;
- znc-maxmessages = 2048;
- restrictions = {
- expire-time = "1w";
- query-cutoff = "none";
- grace-period = "1h";
- };
- retention = {
- allow-individual-delete = false;
- enable-account-indexing = false;
- };
- tagmsg-storage = {
- default = false;
- whitelist = [
- "+draft/react"
- "+react"
- ];
- };
- };
- };
- };
- };
- };
- config = let
- cfg = config.krebs.ergo;
- configFile = pkgs.writeJSON "ergo.conf" cfg.config;
- in lib.mkIf cfg.enable ({
- environment.etc."ergo.yaml".source = configFile;
- krebs.ergo.config =
- lib.mapAttrsRecursive (_: lib.mkDefault) options.krebs.ergo.config.default;
- systemd.services.ergo = {
- description = "Ergo IRC daemon";
- wantedBy = [ "multi-user.target" ];
- # reload currently not working as expected
- # reloadIfChanged = true;
- restartTriggers = [ configFile ];
- serviceConfig = {
- ExecStart = "${pkgs.ergochat}/bin/ergo run --conf /etc/ergo.yaml";
- ExecReload = "${pkgs.util-linux}/bin/kill -HUP $MAINPID";
- DynamicUser = true;
- StateDirectory = "ergo";
- LimitNOFILE = "${toString cfg.openFilesLimit}";
- };
- };
- });
-}
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index fe149448b..7c176d224 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -12,6 +12,8 @@ let
api = {
enable = mkEnableOption "krebs.exim-smarthost";
+ enableSPFVerification = mkEnableOption "SPF verification";
+
authenticators = mkOption {
type = types.attrsOf types.str;
default = {};
@@ -123,10 +125,12 @@ let
# XXX We abuse local_domains to mean "domains, we're the gateway for".
domainlist local_domains = ${concatStringsSep ":" cfg.local_domains}
domainlist relay_to_domains = ${concatStringsSep ":" cfg.relay_to_domains}
+ domainlist sender_domains = ${concatStringsSep ":" cfg.sender_domains}
hostlist relay_from_hosts = <;${concatStringsSep ";" cfg.relay_from_hosts}
- acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data
+ acl_smtp_mail = acl_check_mail
+ acl_smtp_rcpt = acl_check_rcpt
never_users = root
@@ -173,11 +177,46 @@ let
acl_check_data:
warn
- sender_domains = ${concatStringsSep ":" cfg.sender_domains}
+ sender_domains = +sender_domains
set acl_m_special_dom = $sender_address_domain
accept
+ acl_check_mail:
+ ${if cfg.enableSPFVerification then indent /* exim */ ''
+ accept
+ authenticated = *
+ accept
+ hosts = +relay_from_hosts
+ deny
+ spf = fail : softfail
+ log_message = spf=$spf_result
+ message = SPF validation failed: \
+ $sender_host_address is not allowed to send mail from \
+ ''${if def:sender_address_domain\
+ {$sender_address_domain}\
+ {$sender_helo_name}}
+ deny
+ spf = permerror
+ log_message = spf=$spf_result
+ message = SPF validation failed: \
+ syntax error in SPF record(s) for \
+ ''${if def:sender_address_domain\
+ {$sender_address_domain}\
+ {$sender_helo_name}}
+ defer
+ spf = temperror
+ log_message = spf=$spf_result; deferred
+ message = temporary error during SPF validation; \
+ please try again later
+ warn
+ spf = none : neutral
+ log_message = spf=$spf_result
+ accept
+ add_header = $spf_received
+ '' else indent /* exim */ ''
+ accept
+ ''}
begin routers
diff --git a/krebs/3modules/hosts.nix b/krebs/3modules/hosts.nix
index ae0136303..bd1bb1652 100644
--- a/krebs/3modules/hosts.nix
+++ b/krebs/3modules/hosts.nix
@@ -11,7 +11,7 @@ in {
};
};
- config = {
+ config = mkIf config.krebs.enable {
networking.hosts =
filterAttrs
(_name: value: value != [])
diff --git a/krebs/3modules/htgen.nix b/krebs/3modules/htgen.nix
index 375e26974..b760ea671 100644
--- a/krebs/3modules/htgen.nix
+++ b/krebs/3modules/htgen.nix
@@ -2,6 +2,12 @@
with import <stockholm/lib>;
let
+ optionalAttr = name: value:
+ if name != null then
+ { ${name} = value; }
+ else
+ {};
+
cfg = config.krebs.htgen;
out = {
@@ -30,8 +36,15 @@ let
};
script = mkOption {
- type = types.str;
+ type = types.nullOr types.str;
+ default = null;
+ };
+
+ scriptFile = mkOption {
+ type = types.nullOr (types.either types.package types.pathname);
+ default = null;
};
+
user = mkOption {
type = types.user;
default = {
@@ -54,8 +67,10 @@ let
after = [ "network.target" ];
environment = {
HTGEN_PORT = toString htgen.port;
- HTGEN_SCRIPT = htgen.script;
- };
+ }
+ // optionalAttr "HTGEN_SCRIPT" htgen.script
+ // optionalAttr "HTGEN_SCRIPT_FILE" htgen.scriptFile
+ ;
serviceConfig = {
SyslogIdentifier = "htgen";
User = htgen.user.name;
diff --git a/krebs/3modules/krebs-pages.nix b/krebs/3modules/krebs-pages.nix
new file mode 100644
index 000000000..6dd046a8b
--- /dev/null
+++ b/krebs/3modules/krebs-pages.nix
@@ -0,0 +1,46 @@
+{ config, modulesPath, pkgs, ... }: let
+ cfg = config.krebs.pages;
+ lib = import ../../lib;
+ extraTypes.nginx-vhost = lib.types.submodule (
+ lib.recursiveUpdate
+ (import (modulesPath + "/services/web-servers/nginx/vhost-options.nix")
+ { inherit config lib; })
+ {}
+ );
+in {
+ options.krebs.pages = {
+ enable = lib.mkEnableOption "krebs-pages";
+ domain = lib.mkOption {
+ type = lib.types.hostname;
+ default = "krebsco.de";
+ };
+ nginx = lib.mkOption {
+ type = extraTypes.nginx-vhost;
+ default = {};
+ example = lib.literalExpression /* nix */ ''
+ {
+ # To enable encryption and let let's encrypt take care of certificate
+ enableACME = true;
+ forceSSL = true;
+ }
+ '';
+ description = lib.mkDoc ''
+ With this option, you can customize the nginx virtualHost settings.
+ '';
+ };
+ package = lib.mkOption {
+ type = lib.types.package;
+ default = pkgs.krebs-pages;
+ };
+ };
+ config = lib.mkIf cfg.enable {
+ services.nginx = {
+ enable = lib.mkDefault true;
+ virtualHosts.${cfg.domain} = lib.mkMerge [ cfg.nginx {
+ root = lib.mkForce cfg.package;
+ locations."= /ip".return = "200 $remote_addr";
+ locations."= /redirect".return = "301 /redirect";
+ }];
+ };
+ };
+}
diff --git a/krebs/3modules/sitemap.nix b/krebs/3modules/sitemap.nix
new file mode 100644
index 000000000..ec2179db1
--- /dev/null
+++ b/krebs/3modules/sitemap.nix
@@ -0,0 +1,8 @@
+let
+ lib = import ../../lib;
+in {
+ options.krebs.sitemap = lib.mkOption {
+ type = with lib.types; attrsOf sitemap.entry;
+ default = {};
+ };
+}
diff --git a/krebs/3modules/ssl.nix b/krebs/3modules/ssl.nix
index 3a9b5d329..8cbd8dcce 100644
--- a/krebs/3modules/ssl.nix
+++ b/krebs/3modules/ssl.nix
@@ -5,26 +5,7 @@ in {
rootCA = lib.mkOption {
type = lib.types.str;
readOnly = true;
- default = ''
- -----BEGIN CERTIFICATE-----
- MIIC0jCCAjugAwIBAgIJAKeARo6lDD0YMA0GCSqGSIb3DQEBBQUAMIGBMQswCQYD
- VQQGEwJaWjESMBAGA1UECAwJc3RhdGVsZXNzMRAwDgYDVQQKDAdLcmVic2NvMQsw
- CQYDVQQLDAJLTTEWMBQGA1UEAwwNS3JlYnMgUm9vdCBDQTEnMCUGCSqGSIb3DQEJ
- ARYYcm9vdC1jYUBzeW50YXgtZmVobGVyLmRlMB4XDTE0MDYxMTA4NTMwNloXDTM5
- MDIwMTA4NTMwNlowgYExCzAJBgNVBAYTAlpaMRIwEAYDVQQIDAlzdGF0ZWxlc3Mx
- EDAOBgNVBAoMB0tyZWJzY28xCzAJBgNVBAsMAktNMRYwFAYDVQQDDA1LcmVicyBS
- b290IENBMScwJQYJKoZIhvcNAQkBFhhyb290LWNhQHN5bnRheC1mZWhsZXIuZGUw
- gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMs/WNyeQziccllLqom7bfCjlh6/
- /qx9p6UOqpw96YOOT3sh/mNSBLyNxIUJbWsU7dN5hT7HkR7GwzpfKDtudd9qiZeU
- QNYQ+OL0HdOnApjdPqdspZfKxKTXyC1T1vJlaODsM1RBrjLK9RUcQZeNhgg3iM9B
- HptOCrMI2fjCdZuVAgMBAAGjUDBOMB0GA1UdDgQWBBSKeq01+rAwp7yAXwzlwZBo
- 3EGVLzAfBgNVHSMEGDAWgBSKeq01+rAwp7yAXwzlwZBo3EGVLzAMBgNVHRMEBTAD
- AQH/MA0GCSqGSIb3DQEBBQUAA4GBAIWIffZuQ43ddY2/ZnjAxPCRpM3AjoKIwEj9
- GZuLJJ1sB9+/PAPmRrpmUniRkPLD4gtmolDVuoLDNAT9os7/v90yg5dOuga33Ese
- 725musUbhEoQE1A1oVHrexBs2sQOplxHKsVXoYJp2/trQdqvaNaEKc3EeVnzFC63
- 80WiO952
- -----END CERTIFICATE-----
- '';
+ default = builtins.readFile ../6assets/krebsRootCA.crt;
};
intermediateCA = lib.mkOption {
type = lib.types.str;
diff --git a/krebs/3modules/users.nix b/krebs/3modules/users.nix
new file mode 100644
index 000000000..c1ad4b44b
--- /dev/null
+++ b/krebs/3modules/users.nix
@@ -0,0 +1,20 @@
+{ config, ... }: let
+ lib = import ../../lib;
+in {
+ options.krebs.users = lib.mkOption {
+ type = with lib.types; attrsOf user;
+ };
+ config = lib.mkIf config.krebs.enable {
+ krebs.users = {
+ krebs = {
+ home = "/krebs";
+ mail = "spam@krebsco.de";
+ };
+ root = {
+ home = "/root";
+ pubkey = config.krebs.build.host.ssh.pubkey;
+ uid = 0;
+ };
+ };
+ };
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-08 17:35:17 +0000