about summary refs log tree commit diff stats
path: root/hosts/by-name/server3/configuration.nix
blob: 7706c480d95e734a3c8b325ffdaba5fec0b847db (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
{lib, ...}: {
  imports = [
    ./networking.nix # network configuration that just works
    ./hardware.nix
  ];

  vhack = {
    backup = {
      enable = true;
      privateSshKey = ./secrets/backup/backupssh.age;
      privatePassword = ./secrets/backup/backuppass.age;
      user = "u384702-sub4";
    };
    dns = {
      enable = true;
      openFirewall = true;
      interfaces = [
        "92.60.38.179"
        "2a03:4000:33:25b::4f4e"
      ];
      zones = import ../../../zones {inherit lib;};
    };
    fail2ban.enable = true;
    nix-sync = {
      enable = true;
      domains = import ./websites.nix {};
    };
    mastodon = {
      enable = true;
      domain = "mastodon.vhack.eu";
      enableTLD = false;
      tld = "vhack.eu";
      mailPwFile = ./secrets/mastodon/mail.age;
    };
    matrix = {
      enable = true;
      fqdn = "matrix.vhack.eu";
      url = "vhack.eu";
      sharedSecretFile = ./secrets/matrix/passwd.age;
    };
    miniflux = {
      enable = true;
      domain = "miniflux.foss-syndicate.org";
      extraDomains = [
        "rss.foss-syndicate.org"
        "rss.vhack.eu"
        "miniflux.vhack.eu"
      ];
      adminCredentialsFile = ./secrets/miniflux/admin.age;
    };
    murmur = {
      enable = true;
      host = "mumble.vhack.eu";
      name = "vhack";
      url = "vhack.eu";
    };
    nixconfig.enable = true;
    openssh.enable = true;
    peertube = {
      enable = true;
      peertubeGeneral = ./secrets/peertube/general.age;
      smtpPasswordFile = ./secrets/peertube/smtp.age;
    };
    persist = {
      enable = true;
      directories = [
        "/var/log"
      ];
    };
    stalwart-mail = {
      enable = true;
      fqdn = "mail.vhack.eu";
      admin = "admin@vhack.eu";
      security = {
        dkimKeys = let
          loadKey = name: {
            dkimPublicKey = builtins.readFile (./secrets/dkim + "/${name}-public");
            dkimPrivateKeyPath = ./secrets/dkim + "/${name}-private.age";
            keyAlgorithm = "ed25519-sha256";
          };
        in {
          "mail.vhack.eu" = loadKey "mail.vhack.eu";
        };
        verificationMode = "strict";
      };
      openFirewall = true;
      principals = [
        {
          class = "individual";
          name = "soispha";
          secret = "$y$j9T$.4zf8oHeE7AlE4njAUIRi1$AzkeL3xTXMkGuKqeF7XvIZ519xPrYJLRNxmuFY1sfb/";
          email = [
            "soispha@vhack.eu"
            "abuse@vhack.eu"
            "postmaster@vhack.eu"
            "admin@vhack.eu"
          ];
        }
      ];
    };
    postgresql.enable = true;
    rust-motd.enable = true;
    users.enable = true;
  };

  boot.tmp.cleanOnBoot = true;
  zramSwap.enable = true;
  networking.hostName = "server3";
  networking.domain = "vhack.eu";

  system.stateVersion = "24.11";
}