diff --git a/homeModules/programs/ssh/default.nix b/homeModules/programs/ssh/default.nix index ad0b97bc..7ae58acb 100644 --- a/homeModules/programs/ssh/default.nix +++ b/homeModules/programs/ssh/default.nix @@ -30,7 +30,7 @@ in "PreferredAuthentications" = "publickey"; }; }; - "prefect" = { + "prefect-old" = { hostname = "100.93.63.54"; user = "thehedgehog"; port = 22; @@ -39,13 +39,14 @@ in "PreferredAuthentications" = "publickey"; }; }; - "botw" = { - hostname = "bandit.labs.overthewire.org"; - port = 2220; - sendEnv = [ - "WECHALLUSER" - "WECHALLTOKEN" - ]; + "prefect" = { + hostname = "100.107.252.71"; + user = "thehedgehog"; + port = 22; + extraOptions = { + "IdentitiesOnly" = "no"; + "PreferredAuthentications" = "publickey"; + }; }; }; extraOptionOverrides = { diff --git a/hosts/marvin/services/git.nix b/hosts/marvin/services/git.nix index e5a7f504..5ac130f7 100644 --- a/hosts/marvin/services/git.nix +++ b/hosts/marvin/services/git.nix @@ -54,7 +54,7 @@ in ENABLED = true; FROM = "dishNet Git "; PROTOCOL = "smtps"; - SMTP_ADDR = "mail.pyrox.dev"; + SMTP_ADDR = "smtp.purelymail.com"; SMTP_PORT = 465; USER = "git@pyrox.dev"; }; diff --git a/hosts/marvin/services/grafana.nix b/hosts/marvin/services/grafana.nix index e32cec0c..fb5a1603 100644 --- a/hosts/marvin/services/grafana.nix +++ b/hosts/marvin/services/grafana.nix @@ -58,7 +58,7 @@ in enabled = true; user = "grafana@pyrox.dev"; from_address = "grafana@pyrox.dev"; - host = "mail.pyrox.dev:465"; + host = "smtp.purelymail.com:465"; password = "$__file{${config.age.secrets.grafana-smtp-password.path}}"; }; }; diff --git a/hosts/marvin/services/immich-config.json b/hosts/marvin/services/immich-config.json index 3b53fcd4..4523164e 100644 --- a/hosts/marvin/services/immich-config.json +++ b/hosts/marvin/services/immich-config.json @@ -172,9 +172,9 @@ "from": "dishNet Photos ", "replyTo": "", "transport": { - "host": "mail.pyrox.dev", + "host": "smtp.purelymail.com", "ignoreCert": false, - "port": 25, + "port": 465, "secure": true, "username": "immich@pyrox.dev" } diff --git a/hosts/marvin/services/paperless.nix b/hosts/marvin/services/paperless.nix index bb426424..8e50e659 100644 --- a/hosts/marvin/services/paperless.nix +++ b/hosts/marvin/services/paperless.nix @@ -19,7 +19,7 @@ in settings = { PAPERLESS_EMAIL_TASK_CRON = "0 */4 * * *"; PAPERLESS_TIME_ZONE = "America/New_York"; - PAPERLESS_EMAIL_HOST = "mail.pyrox.dev"; + PAPERLESS_EMAIL_HOST = "smtp.purelymail.com"; PAPERLESS_EMAIL_PORT = 465; PAPERLESS_EMAIL_HOST_USER = "paperless@pyrox.dev"; PAPERLESS_EMAIL_FROM = "dish Docs"; diff --git a/hosts/marvin/services/pocket-id.nix b/hosts/marvin/services/pocket-id.nix index fbe28783..bad8f0ca 100644 --- a/hosts/marvin/services/pocket-id.nix +++ b/hosts/marvin/services/pocket-id.nix @@ -23,7 +23,7 @@ in EMAILS_VERIFIED = true; ALLOW_OWN_ACCOUNT_EDIT = true; DISABLE_ANIMATIONS = true; - SMTP_HOST = "mail.pyrox.dev"; + SMTP_HOST = "smtp.purelymail.com"; SMTP_PORT = 465; SMTP_FROM = "auth@pyrox.dev"; SMTP_USER = "auth@pyrox.dev"; diff --git a/hosts/marvin/services/vaultwarden.nix b/hosts/marvin/services/vaultwarden.nix index 898702ae..263ebb5f 100644 --- a/hosts/marvin/services/vaultwarden.nix +++ b/hosts/marvin/services/vaultwarden.nix @@ -66,7 +66,7 @@ in smtpUsername = "vault@pyrox.dev"; smtpSecurity = "force_tls"; smtpPort = 465; - smtpHost = "mail.pyrox.dev"; + smtpHost = "smtp.purelymail.com"; smtpAuthMechanism = "Login"; smtpTimeout = 20; smtpEmbedImages = true; diff --git a/hosts/prefect/default.nix b/hosts/prefect/default.nix index ad9d2b6c..a0a1fbe8 100644 --- a/hosts/prefect/default.nix +++ b/hosts/prefect/default.nix @@ -18,7 +18,6 @@ ./services/acme.nix ./services/caddy.nix ./services/fail2ban.nix - ./services/mailserver ./services/prometheus.nix ./services/secrets.nix ./services/tailscale.nix diff --git a/hosts/prefect/services/acme.nix b/hosts/prefect/services/acme.nix index 5d005cbf..4b26895d 100644 --- a/hosts/prefect/services/acme.nix +++ b/hosts/prefect/services/acme.nix @@ -2,16 +2,6 @@ { security.acme = { acceptTerms = true; - certs."pyroxdev-mail" = { - domain = "mail.pyrox.dev"; - extraDomainNames = [ - "dav.pyrox.dev" - "mta-sts.pyrox.dev" - "autoconfig.pyrox.dev" - "autodiscover.pyrox.dev" - ]; - reloadServices = [ "stalwart" ]; - }; defaults = { # LE Production Server server = "https://acme-v02.api.letsencrypt.org/directory"; diff --git a/hosts/prefect/services/caddy.nix b/hosts/prefect/services/caddy.nix index ec573106..160e67a2 100644 --- a/hosts/prefect/services/caddy.nix +++ b/hosts/prefect/services/caddy.nix @@ -21,7 +21,6 @@ in }; email = "pyrox@pyrox.dev"; virtualHosts = { - "mail2.pyrox.dev" = { }; # Redirect old domains -> pyrox.dev "blog.pyrox.dev" = { serverAliases = [ @@ -248,24 +247,6 @@ in reverse_proxy ${marvin}:${toString pns.pinchflat.port} ''; }; - - "http://mail.pyrox.dev" = { - serverAliases = [ - "http://mail2.pyrox.dev" - "http://mta-sts.pyrox.dev" - "http://autodiscover.pyrox.dev" - "http://autoconfig.pyrox.dev" - "http://dav.pyrox.dev" - ]; - extraConfig = '' - reverse_proxy 127.0.0.1:${toString mail.intHTTP} { - transport http { - proxy_protocol v2 - } - } - - ''; - }; }; # Mail Config globalConfig = '' @@ -273,39 +254,6 @@ in ref refs/heads/pages refresh_period 10m } - servers :80 { - listener_wrappers { - layer4 { - @maildomains http host mail.pyrox.dev mail2.pyrox.dev mta-sts.pyrox.dev autoconfig.pyrox.dev autodiscover.pyrox.dev dav.pyrox.dev - route @maildomains { - subroute { - @a http - route @a { - proxy { - proxy_protocol v2 - upstream 127.0.0.1:${toString mail.intHTTP} - } - } - } - } - } - http_redirect - } - } - servers :443 { - listener_wrappers { - layer4 { - @maildomains tls sni mail.pyrox.dev mail2.pyrox.dev mta-sts.pyrox.dev autoconfig.pyrox.dev autodiscover.pyrox.dev dav.pyrox.dev - route @maildomains { - proxy { - proxy_protocol v2 - upstream 127.0.0.1:${toString mail.intHTTPS} - } - } - } - tls - } - } layer4 { :22 { @a ssh @@ -315,54 +263,6 @@ in } } } - :25 { - route { - proxy { - proxy_protocol v2 - upstream 127.0.0.1:40025 - } - } - } - :143 { - route { - proxy { - proxy_protocol v2 - upstream 127.0.0.1:${toString mail.intIMAP} - } - } - } - :465 { - route { - proxy { - proxy_protocol v2 - upstream 127.0.0.1:${toString mail.intSMTPS} - } - } - } - :587 { - route { - proxy { - proxy_protocol v2 - upstream 127.0.0.1:${toString mail.intSMTP} - } - } - } - :993 { - route { - proxy { - proxy_protocol v2 - upstream 127.0.0.1:${toString mail.intIMAPS} - } - } - } - :4190 { - route { - proxy { - proxy_protocol v2 - upstream 127.0.0.1:${toString mail.intManageSieve} - } - } - } } ''; }; diff --git a/hosts/prefect/services/mailserver/acme.nix b/hosts/prefect/services/mailserver/acme.nix deleted file mode 100644 index 60b9ab79..00000000 --- a/hosts/prefect/services/mailserver/acme.nix +++ /dev/null @@ -1,22 +0,0 @@ -# ACME for certs, using TLS-ALPN-01 Challenges(one fewer ports open) -# https://stalw.art/docs/server/tls/acme/configuration -{ cfg, sec }: -{ - letsencrypt = { - directory = "https://acme-staging-v02.api.letsencrypt.org/directory"; - challenge = "dns-01"; - contact = [ "pyrox@pyrox.dev" ]; - domains = [ - "mail.pyrox.dev" - "mail2.pyrox.dev" - "mta-sts.pyrox.dev" - "autoconfig.pyrox.dev" - "autodiscover.pyrox.dev" - ]; - cache = "${cfg.dataDir}/acme/certs"; - renew-before = "30d"; - default = true; - provider = "desec"; - secret = "%{file:${sec.stalwart-desec-token.path}}%"; - }; -} diff --git a/hosts/prefect/services/mailserver/auth.nix b/hosts/prefect/services/mailserver/auth.nix deleted file mode 100644 index b3edaca6..00000000 --- a/hosts/prefect/services/mailserver/auth.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ ifThen, otherwise }: -let - relVer = [ - (ifThen "protocol = 'smtp'" "relaxed") - (otherwise "disable") - ]; -in -{ - dkim = { - sign = [ - (ifThen "sender_domain = 'pyrox.dev'" "['rsa', 'ed25519']") - (otherwise false) - ]; - }; - spf.verify.ehlo = relVer; - spf.verify.mail-from = relVer; - dmarc.verify = relVer; - iprev.verify = relVer; - arc.seal = "'ed25519'"; - arc.verify = "relaxed"; -} diff --git a/hosts/prefect/services/mailserver/auto-ban.nix b/hosts/prefect/services/mailserver/auto-ban.nix deleted file mode 100644 index e9d13c26..00000000 --- a/hosts/prefect/services/mailserver/auto-ban.nix +++ /dev/null @@ -1,25 +0,0 @@ -# Strict Auto-ban -# https://stalw.art/docs/server/auto-ban -{ - auth.rate = "15/1d"; - abuse.rate = "15/1d"; - loiter.rate = "15/1d"; - scan = { - rate = "20/1d"; - paths = [ - "*.php*" - "*.cgi*" - "*.asp*" - "*/wp-*" - "*/php*" - "*/cgi-bin*" - "*xmlrpc*" - "*../*" - "*/..*" - "*joomla*" - "*wordpress*" - "*drupal*" - "/.git*" - ]; - }; -} diff --git a/hosts/prefect/services/mailserver/calendar.nix b/hosts/prefect/services/mailserver/calendar.nix deleted file mode 100644 index 43244bef..00000000 --- a/hosts/prefect/services/mailserver/calendar.nix +++ /dev/null @@ -1,25 +0,0 @@ -# Calendar settings -# https://stalw.art/docs/collaboration/calendar -{ - max-recurrence-expansions = 2048; - # 512 KiB - max-size = 524288; - max-attendees-per-instance = 20; - default.href-name = "default"; - default.display-name = "Personal"; - # Scheduling - # https://stalw.art/docs/collaboration/scheduling - scheduling.enable = true; - # 1 MiB - scheduling.inbound.max-size = 1048576; - scheduling.outbound.max-recipients = 100; - scheduling.inbox.auto-expunge = "30d"; - scheduling.http-rsvp.enable = true; - scheduling.http-rsvp.expiration = "7d"; - # Notifications - # https://stalw.art/docs/collaboration/notifications - alarms.enable = true; - alarms.minimum-interval = "1h"; - alarms.from.name = "PyroNet Calendars"; - alarms.from.email = "calendar-notifs@pyrox.dev"; -} diff --git a/hosts/prefect/services/mailserver/default.nix b/hosts/prefect/services/mailserver/default.nix deleted file mode 100644 index b94aef55..00000000 --- a/hosts/prefect/services/mailserver/default.nix +++ /dev/null @@ -1,218 +0,0 @@ -{ - config, - lib, - self, - ... -}: -let - d = self.lib.data.mail; - cfg = config.services.stalwart; - sec = config.age.secrets; - credsDir = "/run/credentials/stalwart.service"; - certDir = config.security.acme.certs."pyroxdev-mail".directory; - isAuthenticated = d: { - "if" = "!is_empty(authenticated_as)"; - "then" = d; - }; - otherwise = d: { - "else" = d; - }; - ifThen = f: d: { - "if" = f; - "then" = d; - }; - smSecret = { - owner = cfg.user; - inherit (cfg) group; - }; -in -{ - services.stalwart = { - credentials = { - cert = "${certDir}/cert.pem"; - key = "${certDir}/key.pem"; - }; - enable = true; - dataDir = "/var/lib/stalwart"; - settings = { - tracer.stdout.level = "info"; - authentication.fallback-admin = { - user = "fallback"; - secret = "%{file:${sec.stalwart-fallback-admin-pw.path}}%"; - }; - config = { - local-keys = [ - "asn.*" - "auth.*" - "authentication.*" - "auto-ban.*" - "calendar.*" - "certificate.*" - "changes.*" - "cluster.*" - "config.*" - "contacts.*" - "directory.*" - "http.*" - "imap.*" - "jmap.*" - "queue.*" - "report.*" - "resolver.*" - "server.*" - "session.*" - "signature.*" - "storage.*" - "store.*" - "tracer.*" - "webadmin.*" - "form.*" - "email.*" - "spam-filter.*" - ]; - }; - certificate = { - default = { - default = true; - cert = "%{file:${credsDir}/cert}%"; - private-key = "%{file:${credsDir}/key}%"; - subjects = [ - "dav.pyrox.dev" - "mail.pyrox.dev" - "mail2.pyrox.dev" - "mta-sts.pyrox.dev" - "autoconfig.pyrox.dev" - "autodiscover.pyrox.dev" - ]; - }; - }; - server = import ./server.nix { inherit d; }; - # Use NixOS-generated certs now, since stalwart can't do it on its own - # (DeSec API Errors abound) - # acme = import ./acme.nix { inherit cfg sec; }; - # HTTP Configuration - # https://stalw.art/docs/http/overview - http = { - url = "'https://${d.extUrl}'"; - hsts = true; - rate-limit = { - account = "10000/1m"; - }; - }; - # Disable HTTP Forms submission - # https://stalw.art/docs/http/form-submission - form.enable = false; - # DKIM Signatures - signature = import ./signature.nix { inherit sec; }; - # Storage Settings - # https://stalw.art/docs/storage/overview - store = { - data = { - type = "rocksdb"; - path = "${cfg.dataDir}/db"; - purge.frequency = "0 3 *"; - }; - blob = { - type = "fs"; - path = "${cfg.dataDir}/blobs"; - depth = 2; - compression = "lz4"; - purge.frequency = "0 4 *"; - }; - db.path = "${cfg.dataDir}/db2"; - }; - storage = { - data = "data"; - blob = "blob"; - fts = "data"; - lookup = "data"; - directory = "default"; - }; - directory = { - default = { - type = "internal"; - store = "data"; - }; - }; - # ASN/GeoIP Lookups - # https://stalw.art/docs/server/asn - asn = { - type = "dns"; - separator = "|"; - zone.ipv4 = "origin.asn.cymru.com"; - zone.ipv6 = "origin6.asn.cymru.com"; - index.asn = 0; - index.asn-name = 1; - index.country = 2; - }; - auto-ban = import ./auto-ban.nix; - # JMAP Settings - # https://stalw.art/docs/email/jmap - jmap = { - mailbox.max-depth = 10; - mailbox.max-name-length = 255; - # 50 MB - email.max-attachment-size = 50 * 1000 * 1000; - # 75 MB - email.max-size = 75 * 1000 * 1000; - email.parse.max-items = 10; - }; - imap = import ./imap.nix; - # Maintainance - # https://stalw.art/docs/email/maintenance - email.auto-expunge = "180d"; - changes.max-history = 10000; - session = import ./session.nix { inherit isAuthenticated otherwise ifThen; }; - queue = import ./queue.nix { inherit d ifThen otherwise; }; - # DNS Settings - # https://stalw.art/docs/mta/outbound/dns - resolver = { - custom = [ - "tls://dns11.quad9.net" - "tcp://1.1.1.1" - ]; - concurrency = 2; - preserve-intermediates = true; - timeout = "5s"; - attempts = 3; - edns = true; - }; - report = import ./report.nix { inherit d; }; - calendar = import ./calendar.nix; - # Authentication - auth = import ./auth.nix { inherit ifThen otherwise; }; - # Contacts - # https://stalw.art/docs/collaboration/contact - contacts = { - # 512 KiB - max-size = 524288; - default.href-name = "default"; - default.display-name = "Contacts"; - }; - # Spam Filtering - # https://stalw.art/docs/spamfilter/overview - spam-filter = { - card-is-ham = true; - }; - }; - }; - systemd.services.stalwart.serviceConfig = { - Restart = lib.mkForce "always"; - RestartSec = lib.mkForce 1; - ReadWritePaths = lib.mkForce [ ]; - }; - age.secrets = { - stalwart-secret-rsa = smSecret // { - file = ../../secrets/stalwart-secret-rsa.age; - }; - stalwart-secret-ed25519 = smSecret // { - file = ../../secrets/stalwart-secret-ed25519.age; - }; - stalwart-desec-token = smSecret // { - file = ../../secrets/stalwart-desec-token.age; - }; - stalwart-fallback-admin-pw = smSecret // { - file = ../../secrets/stalwart-fallback-admin-pw.age; - }; - }; -} diff --git a/hosts/prefect/services/mailserver/imap.nix b/hosts/prefect/services/mailserver/imap.nix deleted file mode 100644 index 9741a0b8..00000000 --- a/hosts/prefect/services/mailserver/imap.nix +++ /dev/null @@ -1,42 +0,0 @@ -# https://stalw.art/docs/email/imap -{ - # 50 MiB - request.max-size = 52428800; - auth.max-failures = 3; - auth.allow-plain-text = false; - folders = - let - folder = { - create = true; - subscribe = true; - }; - in - { - inbox = folder // { - name = "Inbox"; - }; - drafts = folder // { - name = "Drafts"; - }; - sent = folder // { - name = "Sent"; - }; - trash = folder // { - name = "Trash"; - }; - archive = folder // { - name = "Archive"; - }; - junk = folder // { - name = "Junk"; - }; - shared = { - name = "Shared Folders"; - create = true; - subscribe = false; - }; - }; - timeout.authenticated = "30m"; - timeout.anonymous = "1m"; - timeout.idle = "30m"; -} diff --git a/hosts/prefect/services/mailserver/queue.nix b/hosts/prefect/services/mailserver/queue.nix deleted file mode 100644 index 80bb1b6e..00000000 --- a/hosts/prefect/services/mailserver/queue.nix +++ /dev/null @@ -1,97 +0,0 @@ -{ - d, - ifThen, - otherwise, -}: -# Queue Management -# https://stalw.art/docs/mta/outbound/overview -{ - # Virtual Queues - # https://stalw.art/docs/mta/outbound/queue - virtual.default.threads-per-node = 100; - virtual.admin.threads-per-node = 10; - virtual.local.threads-per-node = 100; - # Schedules - # https://stalw.art/docs/mta/outbound/schedule - schedule = - let - queue = { - retry = [ - "1m" - "2m" - "5m" - "10m" - "15m" - "30m" - "1h" - "2h" - ]; - notify = [ - "1d" - "3d" - ]; - max-attempts = 15; - }; - in - { - default = queue // { - queue-name = "default"; - }; - admin = queue // { - queue-name = "admin"; - }; - local = queue // { - queue-name = "local"; - }; - }; - # Routes - # https://stalw.art/docs/mta/outbound/routing - route = { - local.type = "local"; - remote = { - type = "mx"; - ip-lookup = "ipv6_then_ipv4"; - tls.implicit = false; - tls.allow-invalid-certs = false; - }; - }; - # Strategies - # https://stalw.art/docs/mta/outbound/strategy - strategy = { - schedule = [ - (ifThen "is_local_domain('', rcpt_domain)" "'local'") - (ifThen "source = 'dsn'" "'admin'") - (ifThen "source = 'report'" "'admin'") - (ifThen "source = 'autogenerated'" "'admin'") - (otherwise "'default'") - ]; - route = [ - (ifThen "is_local_domain('', rcpt_domain)" "'local'") - (otherwise "'remote'") - ]; - connection = "'default'"; - tls = "'default'"; - }; - # Remote Connection - # https://stalw.art/docs/mta/outbound/connection - connection.default = { - ehlo-hostname = d.extUrl; - source-ips = d.extIPs; - timeout = { - connect = "3m"; - greeting = "3m"; - ehlo = "3m"; - mail-from = "3m"; - rcpt-to = "3m"; - data = "10m"; - }; - }; - tls.default = { - dane = "optional"; - mta-sts = "optional"; - starttls = "optional"; - allow-invalid-certs = false; - timeout.tls = "3m"; - timeout.mta-sts = "3m"; - }; -} diff --git a/hosts/prefect/services/mailserver/report.nix b/hosts/prefect/services/mailserver/report.nix deleted file mode 100644 index 0e527f01..00000000 --- a/hosts/prefect/services/mailserver/report.nix +++ /dev/null @@ -1,64 +0,0 @@ -{ d }: -# Reports -# https://stalw.art/docs/mta/reports/overview -{ - domain = "pyrox.dev"; - submitter = "'${d.extUrl}'"; - analysis = { - addresses = [ - "dmarc@" - "reports@" - "spf@" - "dkim@" - "abuse@" - ]; - forward = true; - store = "30d"; - }; - dsn = { - from-name = "'PyroNet Mail'"; - from-address = "'mail@pyrox.dev'"; - sign = "['rsa', 'ed25519']"; - }; - dkim = { - from-name = "'PyroNet Mail Reports'"; - from-address = "'noreply-dkim@pyrox.dev'"; - subject = "'DKIM Authentication Failure Report'"; - sign = "['rsa', 'ed25519']"; - send = "1/1d"; - }; - spf = { - from-name = "'PyroNet Mail Reports'"; - from-address = "'noreply-spf@pyrox.dev'"; - subject = "'SPF Authentication Failure Report'"; - sign = "['rsa', 'ed25519']"; - send = "1/1d"; - }; - dmarc = { - from-name = "'PyroNet Mail Reports'"; - from-address = "'noreply-dmarc@pyrox.dev'"; - subject = "'DMARC Authentication Failure Report'"; - sign = "['rsa', 'ed25519']"; - send = "1/1d"; - aggregate = { - from-name = "'DMARC Report'"; - from-address = "'noreply-dmarc@pyrox.dev'"; - org-name = "'PyroNet Mail'"; - contact-info = "'pyrox@pyrox.dev'"; - send = "daily"; - # 25 MiB - max-size = 26214400; - sign = "['rsa', 'ed25519']"; - }; - }; - tls.aggregate = { - from-name = "'PyroNet Mail Reports'"; - from-address = "'noreply-tls@pyrox.dev'"; - org-name = "'PyroNet Mail'"; - contact-info = "'pyrox@pyrox.dev'"; - send = "daily"; - # 25 MiB - max-size = 26214400; - sign = "['rsa', 'ed25519']"; - }; -} diff --git a/hosts/prefect/services/mailserver/server.nix b/hosts/prefect/services/mailserver/server.nix deleted file mode 100644 index 7daa4d1e..00000000 --- a/hosts/prefect/services/mailserver/server.nix +++ /dev/null @@ -1,69 +0,0 @@ -{ d }: -{ - hostname = d.extUrl; - # TLS - # https://stalw.art/docs/server/tls/overview - tls = { - enable = true; - implicit = false; - ignore-client-order = true; - }; - # Listeners - # https://stalw.art/docs/server/listener - listener = { - smtp = { - bind = [ - "[::]:${toString d.intSMTP}" - "[::]:40025" - ]; - protocol = "smtp"; - # Explicit TLS - tls.implicit = false; - }; - smtps = { - bind = "[::]:${toString d.intSMTPS}"; - protocol = "smtp"; - # Implicit TLS - tls.implicit = true; - }; - imap = { - bind = "[::]:${toString d.intIMAP}"; - protocol = "imap"; - # Explicit TLS - tls.implicit = false; - }; - imaps = { - bind = "[::]:${toString d.intIMAPS}"; - protocol = "imap"; - # Implicit TLS - tls.implicit = true; - }; - managesieve = { - bind = "[::]:${toString d.intManageSieve}"; - protocol = "managesieve"; - # Explicit TLS - tls.implicit = false; - }; - https = { - bind = "[::]:${toString d.intHTTPS}"; - protocol = "http"; - # Implicit TLS - tls.implicit = true; - }; - http = { - bind = "[::]:${toString d.intHTTP}"; - protocol = "http"; - # Implicit TLS - tls.implicit = false; - }; - }; - # Proxy Protocol from Caddy - # Only accepts proxy protocol from Tailscale IP Ranges - # https://tailscale.com/kb/1015/100.x-addresses - # https://tailscale.com/kb/1033/ip-and-dns-addresses - proxy.trusted-networks = [ - "fd7a:115c:a1e0::/48" - "100.64.0.0/10" - "127.0.0.1/8" - ]; -} diff --git a/hosts/prefect/services/mailserver/session.nix b/hosts/prefect/services/mailserver/session.nix deleted file mode 100644 index cdcc7abe..00000000 --- a/hosts/prefect/services/mailserver/session.nix +++ /dev/null @@ -1,63 +0,0 @@ -{ - isAuthenticated, - otherwise, - ifThen, -}: -# MTA Settings -# https://stalw.art/docs/mta/overview -{ - # Inbound - # https://stalw.art/docs/mta/inbound/overview - # # EHLO Stage - # # https://stalw.art/docs/mta/inbound/ehlo - ehlo = { - require = true; - reject-non-fqdn = [ - (ifThen "protocol = 'smtp'" true) - (otherwise false) - ]; - }; - # # RCPT Stage - # # https://stalw.art/docs/mta/inbound/rcpt - rcpt = { - relay = [ - (isAuthenticated true) - (otherwise false) - ]; - subaddressing = true; - }; - auth = { - mechanisms = [ - (ifThen "local_port != 40025 && is_tls" "[plain, login, oauthbearer, xoauth2]") - (ifThen "local_port != 40025" "[oauthbearer, xoauth2]") - (otherwise false) - ]; - directory = "'default'"; - require = [ - (ifThen "local_port != 40025" true) - (otherwise false) - ]; - must-match-sender = true; - }; - extensions = - let - ifAuthed = [ - (isAuthenticated true) - (otherwise false) - ]; - in - { - pipelining = true; - chunking = true; - requiretls = true; - no-soliciting = ""; - dsn = ifAuthed; - deliver-by = [ - (isAuthenticated "15d") - (otherwise false) - ]; - mt-priority = false; - vrfy = ifAuthed; - expn = ifAuthed; - }; -} diff --git a/hosts/prefect/services/mailserver/signature.nix b/hosts/prefect/services/mailserver/signature.nix deleted file mode 100644 index 6899257d..00000000 --- a/hosts/prefect/services/mailserver/signature.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ sec }: -let - headers = [ - "From" - "To" - "Cc" - "Date" - "Subject" - "Message-ID" - "Organization" - "MIME-Version" - "Content-Type" - "In-Reply-To" - "References" - "List-Id" - "User-Agent" - "Thread-Topic" - "Thread-Index" - ]; -in -{ - rsa = { - inherit headers; - private-key = "%{file:${sec.stalwart-secret-rsa.path}}%"; - domain = "pyrox.dev"; - selector = "rsa-default"; - algorithm = "rsa-sha256"; - canonicalization = "relaxed/relaxed"; - expire = "10d"; - report = true; - }; - ed25519 = { - inherit headers; - private-key = "%{file:${sec.stalwart-secret-ed25519.path}}%"; - domain = "pyrox.dev"; - selector = "default"; - algorithm = "ed25519-sha256"; - canonicalization = "relaxed/relaxed"; - expire = "10d"; - report = true; - }; -} diff --git a/lib/data/hosts.toml b/lib/data/hosts.toml index d8acbb72..543bfee4 100644 --- a/lib/data/hosts.toml +++ b/lib/data/hosts.toml @@ -5,24 +5,35 @@ # ts.ip6: The node's tailscale IPv6 address [marvin] role = "server" + [marvin.ts] ip4 = "100.123.15.72" ip6 = "fd7a:115c:a1e0:ab12:4843:cd96:627b:f48" -[prefect] +[prefect_old] role = "server" -[prefect.ts] + +[prefect_old.ts] ip4 = "100.93.63.54" ip6 = "fd7a:115c:a1e0:ab12:4843:cd96:625d:3f36" +[prefect] +role = "server" + +[prefect.ts] +ip4 = "100.107.252.71" +ip6 = "fd7a:115c:a1e0::f938:fc47" + [zaphod] role = "desktop" + [zaphod.ts] ip4 = "100.125.9.36" ip6 = "fd7a:115c:a1e0:ab12:4843:cd96:627d:924" [thought] role = "server" + [thought.ts] ip4 = "" ip6 = "" diff --git a/lib/data/mail.toml b/lib/data/mail.toml deleted file mode 100644 index 93c7932c..00000000 --- a/lib/data/mail.toml +++ /dev/null @@ -1,10 +0,0 @@ -extUrl = "mail.pyrox.dev" -extIPs = ["5.161.140.5", "2a01:4ff:f0:98bf:0:0:0:1"] -# internal port is 40k+real mail port -intSMTP = 40587 -intSMTPS = 40465 -intIMAP = 40143 -intIMAPS = 40993 -intManageSieve = 44190 -intHTTPS = 40443 -intHTTP = 40080