From 5996d5f84899fb919c6701f8acd599c5c23988e0 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Mon, 28 Sep 2026 08:54:09 +0200 Subject: ... --- accounts/gkleen@skadhi/default.nix | 6 +- accounts/gkleen@skadhi/email/default.nix | 111 ++++++++++++++++++++++++++++++ accounts/gkleen@skadhi/email/relay.crt | 11 +++ accounts/gkleen@skadhi/email/relay.key | 19 +++++ accounts/gkleen@skadhi/email/secrets.yaml | 25 +++++++ accounts/gkleen@skadhi/rzm/default.nix | 52 ++++++++++++-- 6 files changed, 219 insertions(+), 5 deletions(-) create mode 100644 accounts/gkleen@skadhi/email/default.nix create mode 100644 accounts/gkleen@skadhi/email/relay.crt create mode 100644 accounts/gkleen@skadhi/email/relay.key create mode 100644 accounts/gkleen@skadhi/email/secrets.yaml (limited to 'accounts') diff --git a/accounts/gkleen@skadhi/default.nix b/accounts/gkleen@skadhi/default.nix index 99a592c5..e4b35a78 100644 --- a/accounts/gkleen@skadhi/default.nix +++ b/accounts/gkleen@skadhi/default.nix @@ -3,7 +3,7 @@ let user = config.users.users.${userName}; in { imports = [ - ./greetd.nix ./rzm + ./greetd.nix ./rzm ./email ] ++ (with flake.nixosModules.userProfiles.${userName}; [ zsh mpv yt-dlp ]) ++ (with flake.nixosModules.systemProfiles; [ @@ -72,6 +72,8 @@ in { "Downloads" "documents" "screenshots" "media" "projects" ".local/share/direnv" ".config/Element" ".thunderbird" + ".config/chromium" + ".config/sops" ]; }; @@ -284,6 +286,8 @@ in { enable = true; serverUrl = "https://etesync.yggdrasil.li"; }; + + programs.chromium.enable = true; }; }; } diff --git a/accounts/gkleen@skadhi/email/default.nix b/accounts/gkleen@skadhi/email/default.nix new file mode 100644 index 00000000..aaf15901 --- /dev/null +++ b/accounts/gkleen@skadhi/email/default.nix @@ -0,0 +1,111 @@ +{ config, lib, pkgs, ... }: +{ + services.postfix = { + enable = true; + enableSmtp = false; + enableSubmission = false; + setSendmail = true; + # networksStyle = "host"; + settings.main = { + recpipient_delimiter = "+"; + mydestination = []; + myhostname = "skadhi.midgard.yggdrasil"; + + mydomain = "yggdrasil.li"; + + local_transport = "error:5.1.1 No local delivery"; + alias_database = []; + alias_maps = []; + local_recipient_maps = []; + + inet_interfaces = "loopback-only"; + + message_size_limit = 0; + + authorized_submit_users = "inline:{ gkleen= }"; + authorized_flush_users = "inline:{ gkleen= }"; + authorized_mailq_users = "inline:{ gkleen= }"; + + smtp_generic_maps = "inline:{ root=root+skadhi }"; + + mynetworks = ["127.0.0.0/8" "[::1]/128"]; + smtpd_client_restrictions = ["permit_mynetworks" "reject"]; + smtpd_relay_restrictions = ["permit_mynetworks" "reject"]; + + sender_dependent_default_transport_maps = ''regexp:${pkgs.writeText "sender_relay" '' + /@(cip|stud)\.ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtp.ifi.lmu.de + /@ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtpin1.ifi.lmu.de:587 + /@math(ematik)?\.(lmu|uni-muenchen)\.de$/ smtps:smtp.math.lmu.de:465 + /@(campus\.)?lmu\.de$/ smtp:postout.lrz.de + ''}''; + sender_bcc_maps = ''regexp:${pkgs.writeText "sender_bcc" '' + /^uni2work(-[^@]*)?@ifi\.lmu\.de$/ uni2work@ifi.lmu.de + /@ifi\.lmu\.de$/ gregor.kleen@ifi.lmu.de + ''}''; + relayhost = ["[surtr.yggdrasil.li]:465"]; + default_transport = "relay"; + + smtp_sasl_auth_enable = true; + smtp_sender_dependent_authentication = true; + smtp_sasl_tls_security_options = "noanonymous"; + smtp_sasl_mechanism_filter = ["plain"]; + smtp_sasl_password_maps = "regexp:/run/credentials/postfix.service/sasl_passwd"; + smtp_cname_overrides_servername = false; + smtp_always_send_ehlo = true; + smtp_tls_security_level = "dane"; + + smtp_tls_loglevel = "1"; + smtp_dns_support_level = "dnssec"; + }; + settings.master = { + submission = { + type = "inet"; + private = false; + command = "smtpd"; + args = [ + "-o" "syslog_name=postfix/$service_name" + ]; + }; + smtp = { }; + smtps = { + type = "unix"; + private = true; + privileged = true; + chroot = false; + command = "smtp"; + args = [ + "-o" "smtp_tls_wrappermode=yes" + "-o" "smtp_tls_security_level=encrypt" + ]; + }; + relay = { + command = "smtp"; + args = [ + "-o" "smtp_fallback_relay=" + "-o" "smtp_tls_security_level=verify" + "-o" "smtp_tls_wrappermode=yes" + "-o" "smtp_tls_cert_file=${./relay.crt}" + "-o" "smtp_tls_key_file=/run/credentials/postfix.service/relay.key" + ]; + }; + }; + }; + + systemd.services.postfix = { + serviceConfig.LoadCredential = [ + "sasl_passwd:${config.sops.secrets."postfix-sasl-passwd".path}" + "relay.key:${config.sops.secrets."relay-key".path}" + ]; + }; + + sops.secrets = { + postfix-sasl-passwd = { + key = "sasl-passwd"; + sopsFile = ./secrets.yaml; + }; + relay-key = { + format = "binary"; + sopsFile = ./relay.key; + }; + }; +} diff --git a/accounts/gkleen@skadhi/email/relay.crt b/accounts/gkleen@skadhi/email/relay.crt new file mode 100644 index 00000000..ac13e7cb --- /dev/null +++ b/accounts/gkleen@skadhi/email/relay.crt @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBjDCCAQygAwIBAgIPQAAAAGgLfNoL/PSMAsutMAUGAytlcTAXMRUwEwYDVQQD +DAx5Z2dkcmFzaWwubGkwHhcNMjUwNDI1MTIwOTQ1WhcNMzUwNDI2MTIxNDQ1WjAR +MQ8wDQYDVQQDDAZna2xlZW4wKjAFBgMrZXADIQB3outi3/3F4YO7Q97WAAaMHW0a +m+Blldrgee+EZnWnD6N1MHMwHwYDVR0jBBgwFoAUTtn+VjMw6Ge1f68KD8dT1CWn +l3YwHQYDVR0OBBYEFFOa4rYZYMbXUVdKv98NB504GUhjMA4GA1UdDwEB/wQEAwID +6DAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAUGAytlcQNzABC0 +0UgIt7gLZrU1TmzGoqPBris8R1DbKOJacicF5CU0MIIjHcX7mPFW8KtB4qm6KcPq +kF6IaEPmgKpX3Nubk8HJik9vhIy9ysfINcVTvzXx8pO1bxbvREJRyA/apj10nzav +yauId0cXHvN6g5RLAMsMAA== +-----END CERTIFICATE----- diff --git a/accounts/gkleen@skadhi/email/relay.key b/accounts/gkleen@skadhi/email/relay.key new file mode 100644 index 00000000..109241d9 --- /dev/null +++ b/accounts/gkleen@skadhi/email/relay.key @@ -0,0 +1,19 @@ +{ + "data": "ENC[AES256_GCM,data:lBlTuzOS75pvRmcTKT4KhHMH44RlE2SvCFAUP+GfsXws1Uai7DZ1MmbhvxxCa+pcLW19+sQYxrXLRNZWby1yOeKBJ2UQeYV5LOk9LSL/WIE3FZkCo5Dv0O0gSFKjjb61WN22a4JnHbLWADf/mLT3GZv91XfvFDo=,iv:ho8wQH3UNzX9JPW5gVcUGtxZzdVwsMFus0Z4KYe5t48=,tag:dAgZyHOva2xVVhE1nTl+lg==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzZ2gxbU5YYVkvdkF0eTB2\nU25RL254NHp1UFlwTWtPSEpnSmp0cng1dkVjCnZuSU96V2R5OVMxcU9XSDhmT3Az\nWExhelo4Wi9nU2ZycCtyM2F0VWpVVjQKLS0tIFpHZmRNSU9aSk0yeUFkSytVaC9B\nTHBpU2RudDFHY2czYjdMZ2p5T0VPUWcKQzVYd29LnP7v5+tOatkjugEP8LGLr8Dj\nTNC8ZxVRqQwyiTM29elmzJMD1xY1unZi/jLGiDrZi7Arsc10npt2Sw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpVkltdnVzWUhDYjFPVm1w\nTmlDMGdHTlZkUVpuNEM0OGtHTkZ1ZE1jclJvCjZBUHo0NjF3S3UyWFRpV0lCREJO\nYlJpVXJ4TTMwMjBKVVF6a3RwSnZ5VWMKLS0tIGx6WkZZY0N1cGFwb0hsR3ZzOFdC\nRWxqcW5MR0JHVlBwcm43bFJKTTdaZWcKFETZni5oEHnj197CiHk56EtJO3labtFo\npe8jvh81iZIiLdZxhazhh25d3+GGT1NXtQwKcRIsGPBG5PJdul8aNg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1u6xegt79rarmyz8qy4pl7jh9lh90vx8fg0frmh4u2mzam7zydq4s4agz4e" + } + ], + "lastmodified": "2025-04-25T12:14:44Z", + "mac": "ENC[AES256_GCM,data:pObl2bJA93az9E3Ya+hA3ekI8TKKZ9NNTi0KzmWZBOiQwi9FuQYtpnmmT80L1KXWyOKJV6wGdAri3mNe/ue2S0TziSbQ/4+Dj4ubFKgkH7thb5q2dFyxw5FzhYzRQiXFqD/pxcNN9uL0lQI2Al0Eci0zX8Kcd1rAQ6RzLEoSmco=,iv:zo/3QFKTUEDxLy1k5yyU7Z1JMZ7cKdYUc6GHjaTTZKQ=,tag:f63Eja3lBfwJCYAOyEt56g==,type:str]", + "unencrypted_suffix": "_unencrypted", + "version": "3.10.2" + } +} diff --git a/accounts/gkleen@skadhi/email/secrets.yaml b/accounts/gkleen@skadhi/email/secrets.yaml new file mode 100644 index 00000000..fa634212 --- /dev/null +++ b/accounts/gkleen@skadhi/email/secrets.yaml @@ -0,0 +1,25 @@ +sasl-passwd: ENC[AES256_GCM,data:L5QOQTEOplm9rQ+PuyDUl492ZTgIgZdRXNCNRaPQ4FLU+ha0GO7rjYWAOtvW7/oVdALrkQveSpBolnLG0nayvkjLpPuA6o9brR6bky52QmhOd8cYN9LMOhJcLJTwpUuvDesXkJD1mWA+ifuPnK6elVEfPuOndzMyw8MEvbPl53yCKQ7HOJc2nGvneD5QFkiHB9W9MmrR1gjGqaCSjZ0ahCnxe/Z2SwqccmBR9l60vt683RXMYbKNLDuSgE7HcXbzF9NstfnoSq7b332y/NgYsXvY0w+f6yPhsDuPhUXU+7gIcPb4+1TFOtdZP8uIPm1aLqG2nNKNhMGt23X8dD5Myy0FF6XmbTj43mDzKJahNel7pT91d+Vac5s08UeyUpQSjtrVMYneVTYbHEwiFPAD7S57LF0kZuE1aXIRF35g6XV3GB4rQDsrBsrZzn9vsGS12L2pdtYFVCvt/dLFlmd/GjPpm4JWyNSg,iv:fUEBrr1iby7+hK8ZesW+77HLMW93c6LpCcoJy8pgXUE=,tag:cW8vKVAebnJqo1gNNwDohQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpQVM4V3RZNTUyZzN4bERP + SnRhM2hOK2FzNDRzRTR0bG4yYk1YS0tMclZrCkIrQWdBcnBkeU1wbWVZOEN4T0lY + c0lnaWtidTJLQjV0c3Rzd3o3alNIekkKLS0tIG5lZjQ5MWZoVGNIaTROOXJpdDhC + R3hyNlcxN2RQRS9aOGI4RzVPbUtBY3MKBKWGmZjjqZ7CBwVniEF9VjhyWH0kZv56 + 7eWx3lOhb849izKM8EEjr50t1DqrvBLL4KStLq8fbNV5uPotGuKOwA== + -----END AGE ENCRYPTED FILE----- + recipient: age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbStwZ0w5STFxcHNKNDhO + SnhZVHprVUlkUStvVXNpTW5RZ0dTSVpLWEZjCjdDa1ZtOU5KUjJxSHRlNy9WamJq + a0VEdUtiODdCL3RTeDlTc2NqY0Q1dDgKLS0tIGcwNkQxemVuSGw4V2RQNWp1cjhM + cHQ4WXBPNGJGRXZTL1kxSDhRb1c0ZVUKIhyhHihWR79vQBBNuaVLzIAFggmfdkM8 + 40/m+3OllYsTCvm55LdNVNjxQC8QnfsalgtIh+ZzUzhrjCksumqypw== + -----END AGE ENCRYPTED FILE----- + recipient: age1u6xegt79rarmyz8qy4pl7jh9lh90vx8fg0frmh4u2mzam7zydq4s4agz4e + lastmodified: "2022-02-02T14:45:23Z" + mac: ENC[AES256_GCM,data:UdM/VmdfqhYm1aFCHaO0mbJA/oyV/J2oKVVmGDa0Co3MWq9aWMqP726O+rLk36W0HOG4fmue//R1Q524au2hMW9bZUFzrubfQt2V78tZRZeHCJSRmOmi1D1EDdfPz9J3oWDvIEgIIsAk5H5EuuH0j6FILye6tzcomNGDAKZbwuc=,iv:a7dJAqkcroLp01gkGKV5gm6gTIIMa/9P8qJn44ISrw0=,tag:R9/6X6mgfVSLK7bmoWRnfQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.7.1 diff --git a/accounts/gkleen@skadhi/rzm/default.nix b/accounts/gkleen@skadhi/rzm/default.nix index efe5468e..11d8af8b 100644 --- a/accounts/gkleen@skadhi/rzm/default.nix +++ b/accounts/gkleen@skadhi/rzm/default.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ config, pkgs, lib, ... }: let mwnSubnetsPublic = [ "129.187.0.0/16" "141.40.0.0/16" "141.84.0.0/16" @@ -98,9 +98,15 @@ in { }; home-manager.users.gkleen = { sysConfig, config, ... }: { - home.persistence."/persistent".files = [ - "rz.kdbx" ".config/Element-lmu" - ]; + home.persistence."/persistent" = { + files = [ + "rz.kdbx" + ]; + directories = [ + ".config/Element-lmu" ".config/worktime" + ".config/chromium-kimai" ".config/chromium-rainbow" + ]; + }; xdg.desktopEntries = { element-lmu = { @@ -124,6 +130,44 @@ in { StartupNotify = "true"; }; }; + rainbow = { + name = "Rainbow"; + exec = toString (pkgs.writeShellScript "rainbow" '' + exec -- \ + ${lib.getExe' sysConfig.systemd.package "systemd-run"} --wait --user --slice-inherit \ + --property 'CPUAccounting=yes' --property 'CPUQuotaPeriodSec=50ms' \ + -E DSCP=46 -E NIXOS_OZONE_WL \ + -- ${lib.getExe pkgs.dscp} ${lib.getExe config.programs.chromium.package} \ + --class=Rainbow \ + --app="https://web.openrainbow.com" \ + --user-data-dir=''${HOME}/.config/chromium-rainbow + ''); + icon = pkgs.fetchurl { + url = "https://web.openrainbow.com/rb/2.174.21/assets/skins/rainbow/images/homepage/logo__rainbow.svg"; + hash = "sha256-5fmo8rDqVDpzkGaPjk4Y+SsSZpAsY7VUQSFW6WdHwuU="; + }; + settings = { + StartupWMClass = "Rainbow"; + }; + }; + kimai = { + name = "Kimai"; + exec = toString (pkgs.writeShellScript "kimai" '' + exec -- \ + ${lib.getExe config.programs.chromium.package} \ + --class=Kimai \ + --app="https://kimai.yggdrasil.li" \ + --user-data-dir=''${HOME}/.config/chromium-kimai + ''); + icon = pkgs.fetchurl { + url = "https://www.kimai.org/images/kimai_logo.png"; + hash = "sha256-lnlOttzR2SwXA70R+egJUkeKr4U5V0avqTk8uX4bqfs="; + }; + settings = { + StartupWMClass = "Kimai"; + StartupNotify = "true"; + }; + }; }; programs.zsh.dirHashes = { -- cgit v1.2.3