diff --git a/flake.nix b/flake.nix index f19e96b..102efeb 100644 --- a/flake.nix +++ b/flake.nix @@ -83,6 +83,7 @@ helios = mkNixosSystem { system = "x86_64-linux"; name = "helios"; }; hypnos = mkNixosSystem { system = "x86_64-linux"; name = "hypnos"; }; library = mkNixosSystem { system = "x86_64-linux"; name = "library"; }; + mail = mkNixosSystem { system = "x86_64-linux"; name = "mail"; }; odyssey = mkNixosSystem { system = "x86_64-linux"; name = "odyssey"; }; pi = mkNixosSystem { system = "aarch64-linux"; name = "pi"; extraModules = [ nixos-hardware.nixosModules.raspberry-pi-4 ]; }; vps1 = mkNixosSystem { system = "x86_64-linux"; name = "vps1"; }; @@ -99,6 +100,14 @@ autoRollback = true; sshUser = "root"; nodes = { + mail = { + hostname = "mail.mesh.vimium.net"; + + profiles.system = { + user = "root"; + path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.mail; + }; + }; vps1 = { hostname = "vps1.mesh.vimium.net"; diff --git a/hosts/mail/README.md b/hosts/mail/README.md new file mode 100644 index 0000000..08ba3e0 --- /dev/null +++ b/hosts/mail/README.md @@ -0,0 +1,18 @@ +# Mail server + +## Overview +Mail server hosted in OVH. + +## Specs +* CPU - ?? +* Memory - ?? + +### Disks +Device | Partitions _(filesystem, usage)_ +--- | --- +NVMe | `/dev/sda1` (ext4, NixOS Root) + +### Networks +- DHCP on `10.0.1.0/24` subnet. +- Tailscale on `100.64.0.0/10` subnet. FQDN: `mail.mesh.vimium.net`. + diff --git a/hosts/mail/default.nix b/hosts/mail/default.nix new file mode 100644 index 0000000..f9babd9 --- /dev/null +++ b/hosts/mail/default.nix @@ -0,0 +1,53 @@ +{ config, lib, pkgs, inputs, ... }: + +{ + imports = [ + ./hardware-configuration.nix + ./disko-config.nix + ../server.nix + ]; + + networking = { + hostId = "08ac2f14"; + domain = "mesh.vimium.net"; + firewall = { + enable = true; + allowedTCPPorts = [ + 22 # SSH + ]; + }; + }; + + users = { + users = { + root = { + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVHTjsyMIV4THNw6yz0OxAxGnC+41gX72UrPqTzR+OS jordan@vimium.com" + ]; + }; + }; + }; + + services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password"; + + security.acme.defaults = { + email = "hostmaster@vimium.com"; + group = "nginx"; + webroot = "/var/lib/acme/acme-challenge"; + }; + + modules = { + services = { + borgmatic = { + enable = true; + directories = [ + "/var/lib" + ]; + repoPath = "ssh://kg2mpt28@kg2mpt28.repo.borgbase.com/./repo"; + }; + mail.enable = true; + }; + }; + + system.stateVersion = "22.11"; +} diff --git a/hosts/mail/disko-config.nix b/hosts/mail/disko-config.nix new file mode 100644 index 0000000..f5c34d8 --- /dev/null +++ b/hosts/mail/disko-config.nix @@ -0,0 +1,55 @@ +{ lib, ... }: +{ + disko.devices = { + disk.disk1 = { + device = lib.mkDefault "/dev/sda"; + type = "disk"; + content = { + type = "gpt"; + partitions = { + boot = { + name = "boot"; + size = "2M"; + type = "EF02"; + }; + esp = { + name = "ESP"; + size = "300M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + root = { + name = "root"; + size = "100%"; + content = { + type = "lvm_pv"; + vg = "pool"; + }; + }; + }; + }; + }; + lvm_vg = { + pool = { + type = "lvm_vg"; + lvs = { + root = { + size = "100%FREE"; + content = { + type = "filesystem"; + format = "ext4"; + mountpoint = "/"; + mountOptions = [ + "defaults" + ]; + }; + }; + }; + }; + }; + }; +} diff --git a/hosts/mail/hardware-configuration.nix b/hosts/mail/hardware-configuration.nix new file mode 100644 index 0000000..7ee550c --- /dev/null +++ b/hosts/mail/hardware-configuration.nix @@ -0,0 +1,22 @@ +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot = { + initrd = { + availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ]; + kernelModules = [ "nvme" ]; + }; + loader.grub = { + efiSupport = true; + efiInstallAsRemovable = true; + }; + tmp.cleanOnBoot = true; + }; + + zramSwap.enable = true; +} + diff --git a/modules/default.nix b/modules/default.nix index b4f7283..096b6de 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -34,6 +34,7 @@ ./services/coturn ./services/gitea ./services/headscale + ./services/mail ./services/matrix-synapse ./services/nginx ./services/photoprism diff --git a/modules/services/mail/default.nix b/modules/services/mail/default.nix index 8765339..fcac553 100644 --- a/modules/services/mail/default.nix +++ b/modules/services/mail/default.nix @@ -18,7 +18,7 @@ in { certificateDomains = [ "imap.vimium.com" - "pop3.vimium.com" + "smtp.vimium.com" ]; certificateScheme = "acme-nginx";