Merge remote-tracking branch 'cd/master'

This commit is contained in:
lassulus 2016-04-27 12:47:13 +02:00
commit 94fa4005d6
9 changed files with 100 additions and 16 deletions

View File

@ -13,6 +13,7 @@ let
./buildbot/slave.nix
./build.nix
./current.nix
./exim.nix
./exim-retiolum.nix
./exim-smarthost.nix
./fetchWallpaper.nix

View File

@ -32,7 +32,7 @@ let
};
imp = {
services.exim = {
krebs.exim = {
enable = true;
config =
# This configuration makes only sense for retiolum-enabled hosts.

View File

@ -105,7 +105,7 @@ let
requires = [ "secret.service" ];
};
};
services.exim = {
krebs.exim = {
enable = true;
config = ''
keep_environment =

80
krebs/3modules/exim.nix Normal file
View File

@ -0,0 +1,80 @@
{ config, lib, pkgs, ... }: with config.krebs.lib; let
cfg = config.krebs.exim;
in {
options.krebs.exim = {
enable = mkEnableOption "krebs.exim";
config = mkOption {
type = types.str;
default = "";
description = ''
Verbatim Exim configuration. This should not contain exim_user,
exim_group, exim_path, or spool_directory.
'';
};
user = mkOption {
type = types.user;
default = {
name = "exim";
home = "/var/spool/exim";
};
description = ''
User to use when no root privileges are required.
In particular, this applies when receiving messages and when doing
remote deliveries. (Local deliveries run as various non-root users,
typically as the owner of a local mailbox.) Specifying this value
as root is not supported.
'';
};
group = mkOption {
type = types.group;
default = {
name = "exim";
};
description = ''
Group to use when no root privileges are required.
'';
};
};
config = lib.mkIf cfg.enable {
environment = {
etc."exim.conf".text = ''
exim_user = ${cfg.user.name}
exim_group = ${cfg.group.name}
exim_path = /var/setuid-wrappers/exim
spool_directory = ${cfg.user.home}
${cfg.config}
'';
systemPackages = [ pkgs.exim ];
};
krebs.setuid = {
exim = {
filename = "${pkgs.exim}/bin/exim";
mode = "4111";
};
sendmail = {
filename = "${pkgs.exim}/bin/exim";
mode = "4111";
};
};
systemd.services.exim = {
restartTriggers = [
config.environment.etc."exim.conf".source
];
serviceConfig = {
ExecStart = "${pkgs.exim}/bin/exim -bdf -q30m";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
};
wantedBy = [ "multi-user.target" ];
};
users = {
groups.${cfg.group.name} = {
inherit (cfg.group) name gid;
};
users.${cfg.user.name} = {
inherit (cfg.user) home name uid;
createHome = true;
group = cfg.group.name;
};
};
};
}

View File

@ -213,6 +213,18 @@ types // rec {
};
};
});
group = submodule ({ config, ... }: {
options = {
name = mkOption {
type = username;
default = config._module.args.name;
};
gid = mkOption {
type = int;
default = genid config.name;
};
};
});
addr = either addr4 addr6;
addr4 = mkOptionType {

View File

@ -19,10 +19,11 @@ in {
username = "lol";
password = "wut";
};
exim-retiolum = {
enable = true;
primary_hostname = "test.r";
};
# XXX exim-retiolum and exim-smarthost are mutually exclusive
#exim-retiolum = {
# enable = true;
# primary_hostname = "test.r";
#};
exim-smarthost = {
enable = true;
primary_hostname = "test.r";

View File

@ -183,7 +183,5 @@ with config.krebs.lib;
KERNEL=="hpet", GROUP="audio"
'';
services.tor.client.enable = true;
services.tor.enable = true;
services.virtualboxHost.enable = true;
}

View File

@ -4,9 +4,5 @@ with config.krebs.lib;
{
krebs.exim-retiolum.enable = true;
krebs.setuid.sendmail = {
filename = "${pkgs.exim}/bin/exim";
mode = "4111";
};
tv.iptables.input-retiolum-accept-new-tcp = singleton "smtp";
}

View File

@ -43,9 +43,5 @@ with config.krebs.lib;
{ from = "mirko"; to = "mv"; }
];
};
krebs.setuid.sendmail = {
filename = "${pkgs.exim}/bin/exim";
mode = "4111";
};
tv.iptables.input-internet-accept-new-tcp = singleton "smtp";
}