| Commit message (Collapse) | Author | ||
|---|---|---|---|
| 11 days | tests/email-http: Test the http self-service availability | Benedikt Peetz | |
| 11 days | tests/email-dns: Factor out all of the secrets/acme stuff into a common dir | Benedikt Peetz | |
| This makes it easier to re-use this test data for various tests. | |||
| 11 days | modules/stalwart-mail: Don't restart the systemd service | Benedikt Peetz | |
| Restarting might be useful, if stalwart is actually _running_ in prod, but currently the constant restart makes it very difficult to debug (or even stop) the service. | |||
| 11 days | modules/stalwart-mail: Enable the http self-service interface | Benedikt Peetz | |
| 11 days | modules/nginx: Set the "acme" group as group of the "acme" user | Benedikt Peetz | |
| For some reason, this is not done already. Setting this prevents an assertion being thrown, that the "acme" user does not have a group. | |||
| 11 days | modules/stalwart-mail: Allow both nginx and stalwart-mail access to the cert | Benedikt Peetz | |
| This is needed for the http challenge (and for the potential to use nginx as a proxy in the future.) | |||
| 11 days | modules/stalwart-mail: Explicitly list out valid password hashes | Benedikt Peetz | |
| If a password hash does not match stalwart's know ones, it will just treat it as plaintext. This is obviously very bad, and should be avoided. | |||
| 11 days | modules/stalwart-mail: Make `cfg.principals` nullable | Benedikt Peetz | |
| This makes it possible to use the internal storage | |||
| 11 days | modules/stalwart-mail: Use correct group name for `redis-stalwart-mail` | Benedikt Peetz | |
| 12 days | zones/vhack.eu: Add a taskchampion subdomain | Benedikt Peetz | |
| 12 days | modules/system-info: Register taskchampion port | Benedikt Peetz | |
| 12 days | modules/taskchampion-sync: Persist data directory | Benedikt Peetz | |
| 12 days | hosts/server2: Enable taskwarrior-sync | Benedikt Peetz | |
| 12 days | modules/taskchampion-sync: Add {u,g}ids to {group,user} | Benedikt Peetz | |
| 12 days | {modules,test}/taskchampion-sync: Init | Benedikt Peetz | |
| 2025-04-07 | zones/vhack.eu: add nextcloud subdomain | Silas Schöffel | |
| 2025-04-07 | nextcloud: init on server2 | Silas Schöffel | |
| 2025-04-01 | hosts/server2: Format | Benedikt Peetz | |
| 2025-04-01 | tests/email-dns/secrets/dkim/gen_key.sh: Add shellcheck shell | Benedikt Peetz | |
| 2025-04-01 | {hosts/server3,zones/vhack.eu}: Activate stalwart-mail on server3 for soispha | Benedikt Peetz | |
| 2025-04-01 | zones/vhack.eu: Correct specify the SRV targets as fully-qualified | Benedikt Peetz | |
| 2025-04-01 | zones/vhack.eu: Set the SOA name server entry to a real domain | Benedikt Peetz | |
| 2025-04-01 | zones/vhack.eu: Make it obvious, that the serial number must be changed | Benedikt Peetz | |
| The comment alone would probably suffice, but having a convenient function that makes it obvious *what* part of the serial number you are actually supposed to change seems quite useful, when trying to reduce the possibilities of forgetting it. | |||
| 2025-04-01 | tests/dns: Avoid tracing the name-server interfaces | Benedikt Peetz | |
| 2025-03-30 | zones/vhack.eu: Also revert the mail server changes | Benedikt Peetz | |
| 2025-03-30 | {hosts/server2,modules/mail}: Re-active the old mail server | Benedikt Peetz | |
| Running two mail-servers on one system is a total /mess/. Both try to bind to the same ports, the old stack consists of **5** different systemd services whilst stalwart-mail's systemd service simply refuses to stop, etc. I'm confident that it can work, but it would probably be best to deploy the new mail-server on server3. | |||
| 2025-03-30 | modules/mail: Avoid changing the `virtualMail` user uid | Benedikt Peetz | |
| We would need to set the `vmailUID` option to this value and even then some parts of SNM would still hardcode the default of 5000. Considering that we are in the process of phasing out SNM, this does not seem to be a worthwhile endeavour. | |||
| 2025-03-30 | modules/mail: Actually set the uid/gid of the virtualMail user | Benedikt Peetz | |
| 2025-03-30 | zones/vhack.eu: Use correct `eu` tld instead of `org` | Benedikt Peetz | |
| 2025-03-29 | modules/stalwart-mail: Assign uids and gids to the stalwart users | Benedikt Peetz | |
| 2025-03-29 | modules/constants: Enforce the 0 to 400 limit | Benedikt Peetz | |
| 2025-03-29 | modules/constants: Correctly assign each uid so that none is greater 400 | Benedikt Peetz | |
| The uid ranges from 400 upwards are reserved for things that allocate them dynamic during runtime (like systemd). Our users would than get clobbered, thus we avoid that range. BREAKING CHANGE: Well, we'll need to change all uid of the files owned by the respective users. | |||
| 2025-03-29 | modules/constants: Dry gid definitions by inheriting the uids | Benedikt Peetz | |
| 2025-03-29 | hosts/server2: Use the correct path to the DKIM keys | Benedikt Peetz | |
| 2025-03-29 | hosts/server2: Setup stalwalt-mail on mail.vhack.eu for soispha@vhack.eu | Benedikt Peetz | |
| We need to actually test stalwart out in the real world, because the test can never actually capture all the weird things people do with their mail setup. Refs: #6ea08aa | |||
| 2025-03-27 | tests/email-dns/secrets: Re-key secrets, so that soispha and sils can read them | Benedikt Peetz | |
| Doing a full `ragenix --rekey --idenitity <soispha.age.key>` run will fail, if there are secrets that she cannot decrypt. Thus encrypt the test secrets with all keys. | |||
| 2025-03-27 | flake.lock: Update | Benedikt Peetz | |
| 2025-03-21 | zones/vhack.eu: Fix cyclic CNAME entry for `source.vhack.eu` | Benedikt Peetz | |
| 2025-03-21 | zones/vhack.eu: Add the `source.vhack.eu` dns entry for the redirect | Benedikt Peetz | |
| 2025-03-21 | zones/vhack.eu: Update to actually be a drop-in replacement for netcup's servers | Benedikt Peetz | |
| Currently, our NS record was missing, and we had an MX record that pointed to `mail.foss-syndicate.org.vhack.eu`. | |||
| 2025-03-11 | zones: Provide a single entry point for all zones | Benedikt Peetz | |
| 2025-03-10 | zones/vhack.eu: Set correct CNAME records | Benedikt Peetz | |
| 2025-03-10 | modules/system-info: Include port 53 (dns) in port -> name mappings | Benedikt Peetz | |
| 2025-03-10 | {hosts,zones}: Init dns zone for vhack.eu | Benedikt Peetz | |
| 2025-03-09 | {modules/system-info,scripts/system_info}: Init | Benedikt Peetz | |
| This collects relevant information for each host in an informative markdown file. An example (generated via `./scripts/system_info.sh`): # server2 ## Virtual Hosts etebase.vhack.eu: dav.vhack.eu gallery.s-schoeffel.de git.foss-syndicate.org invidious-router.vhack.eu: video.fosswelt.org invidious-router.sils.li issues.foss-syndicate.org libreddit.vhack.eu redlib.vhack.eu source.foss-syndicate.org source.vhack.eu ## Open ports TCP 22: ssh TCP 25: mail-smtp TCP 80: http TCP 443: https TCP 465: mail-smtp-tls TCP 993: mail-imap-tls TCP 995: mail-pop3-tls # server3 ## Virtual Hosts b-peetz.de mastodon.vhack.eu matrix.vhack.eu miniflux.foss-syndicate.org: rss.foss-syndicate.org rss.vhack.eu miniflux.vhack.eu openpgpkey.b-peetz.de openpgpkey.s-schoeffel.de openpgpkey.sils.li openpgpkey.vhack.eu peertube.vhack.eu trinitrix.vhack.eu vhack.eu ## Open ports TCP 22: ssh TCP 80: http TCP 443: https TCP 64738: ??? UDP 64738: ??? | |||
| 2025-03-09 | hosts/server2: Use new back config | Benedikt Peetz | |
| 2025-03-09 | pkgs/back/package.nix: Include the html templates in the build source | Benedikt Peetz | |
| 2025-03-09 | pkgs/back/config: Also try to open a repo if a directory with `.git` exists | Benedikt Peetz | |
| 2025-03-09 | pkgs/back: Do not store repositories in config | Benedikt Peetz | |
| Otherwise, back will need to be restarted every time a new repository is added or removed. | |||
| 2025-03-09 | {modules,tests}/back: Update to deal with newest back | Benedikt Peetz | |
 |
index : nixos-server | |
| nixos-config for vhack.eu servers https://vhack.eu | vhack.eu |
| about summary refs log tree commit diff stats |