aboutsummaryrefslogtreecommitdiff
path: root/flakes/private/opendmarc
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2023-10-04 01:35:06 +0200
committerIsmaël Bouya <ismael.bouya@normalesup.org>2023-10-04 02:11:48 +0200
commit1a64deeb894dc95e2645a75771732c6cc53a79ad (patch)
tree1b9df4838f894577a09b9b260151756272efeb53 /flakes/private/opendmarc
parentfa25ffd4583cc362075cd5e1b4130f33306103f0 (diff)
downloadNix-1a64deeb894dc95e2645a75771732c6cc53a79ad.tar.gz
Nix-1a64deeb894dc95e2645a75771732c6cc53a79ad.tar.zst
Nix-1a64deeb894dc95e2645a75771732c6cc53a79ad.zip
Squash changes containing private information
There were a lot of changes since the previous commit, but a lot of them contained personnal information about users. All thos changes got stashed into a single commit (history is kept in a different place) and private information was moved in a separate private repository
Diffstat (limited to 'flakes/private/opendmarc')
-rw-r--r--flakes/private/opendmarc/flake.lock85
-rw-r--r--flakes/private/opendmarc/flake.nix125
2 files changed, 80 insertions, 130 deletions
diff --git a/flakes/private/opendmarc/flake.lock b/flakes/private/opendmarc/flake.lock
index f40e1a9..fdd4d64 100644
--- a/flakes/private/opendmarc/flake.lock
+++ b/flakes/private/opendmarc/flake.lock
@@ -1,8 +1,21 @@
1{ 1{
2 "nodes": { 2 "nodes": {
3 "environment": {
4 "locked": {
5 "lastModified": 1,
6 "narHash": "sha256-rMKbM7fHqWQbI7y59BsPG8KwoDj2jyrvN2niPWB24uE=",
7 "path": "../environment",
8 "type": "path"
9 },
10 "original": {
11 "path": "../environment",
12 "type": "path"
13 }
14 },
3 "files-watcher": { 15 "files-watcher": {
4 "locked": { 16 "locked": {
5 "narHash": "sha256-6urOJuzXsu4HJHyVmrZHd40SMzzTeHiOiDOM40q53Y0=", 17 "lastModified": 1,
18 "narHash": "sha256-ZsdumUVoSPkV/DB6gO6dNDttjzalye0ToVBF9bl5W0k=",
6 "path": "../../files-watcher", 19 "path": "../../files-watcher",
7 "type": "path" 20 "type": "path"
8 }, 21 },
@@ -26,69 +39,20 @@
26 "type": "github" 39 "type": "github"
27 } 40 }
28 }, 41 },
29 "my-lib": { 42 "myuids": {
30 "inputs": {
31 "nixpkgs": "nixpkgs"
32 },
33 "locked": { 43 "locked": {
34 "narHash": "sha256-HGNP1eH7b42BxViYx/F3ZPO9CM1X+5qfA9JoP2ArN+s=", 44 "lastModified": 1,
35 "path": "../../lib", 45 "narHash": "sha256-HkW9YCLQCNBX3Em7J7MjraVEZO3I3PizkVV2QrUdULQ=",
46 "path": "../myuids",
36 "type": "path" 47 "type": "path"
37 }, 48 },
38 "original": { 49 "original": {
39 "path": "../../lib", 50 "path": "../myuids",
40 "type": "path" 51 "type": "path"
41 } 52 }
42 }, 53 },
43 "myuids": {
44 "locked": {
45 "dir": "flakes/myuids",
46 "lastModified": 1628207001,
47 "narHash": "sha256-7e12OfDv9zMOfqcAlsk1sZj2l3ZB03kcBdWUqhwVaWo=",
48 "ref": "master",
49 "rev": "dfe02d8fd52e33c7d4e1a209cf486696100b88f3",
50 "revCount": 865,
51 "type": "git",
52 "url": "https://git.immae.eu/perso/Immae/Config/Nix.git"
53 },
54 "original": {
55 "dir": "flakes/myuids",
56 "type": "git",
57 "url": "https://git.immae.eu/perso/Immae/Config/Nix.git"
58 }
59 },
60 "nix-lib": {
61 "locked": {
62 "lastModified": 1633008342,
63 "narHash": "sha256-wZV5YidnsqV/iufDIhaZip3LzwUGeIt8wtdiGS5+cXc=",
64 "owner": "NixOS",
65 "repo": "nixpkgs",
66 "rev": "6eae8a116011f4db0aa5146f364820024411d6bb",
67 "type": "github"
68 },
69 "original": {
70 "owner": "NixOS",
71 "repo": "nixpkgs",
72 "type": "github"
73 }
74 },
75 "nixpkgs": { 54 "nixpkgs": {
76 "locked": { 55 "locked": {
77 "lastModified": 1631570365,
78 "narHash": "sha256-vc6bfo0hijpicdUDiui2DvZXmpIP2iqOFZRcpMOuYPo=",
79 "owner": "NixOS",
80 "repo": "nixpkgs",
81 "rev": "df7113c0727881519248d4c7d080324e0ee3327b",
82 "type": "github"
83 },
84 "original": {
85 "owner": "NixOS",
86 "repo": "nixpkgs",
87 "type": "github"
88 }
89 },
90 "nixpkgs_2": {
91 "locked": {
92 "lastModified": 1597943282, 56 "lastModified": 1597943282,
93 "narHash": "sha256-G/VQBlqO7YeFOSvn29RqdvABZxmQBtiRYVA6kjqWZ6o=", 57 "narHash": "sha256-G/VQBlqO7YeFOSvn29RqdvABZxmQBtiRYVA6kjqWZ6o=",
94 "owner": "NixOS", 58 "owner": "NixOS",
@@ -106,10 +70,11 @@
106 "inputs": { 70 "inputs": {
107 "flake-utils": "flake-utils", 71 "flake-utils": "flake-utils",
108 "myuids": "myuids", 72 "myuids": "myuids",
109 "nixpkgs": "nixpkgs_2" 73 "nixpkgs": "nixpkgs"
110 }, 74 },
111 "locked": { 75 "locked": {
112 "narHash": "sha256-7jup/d3+WXXWsNMB7Sp5Py4rJQV30Z5+PJITBISbQ9o=", 76 "lastModified": 1,
77 "narHash": "sha256-dDS9a1XujZU6KVCgz2RKbx2T3yT1k7z0EknUh1OyMdQ=",
113 "path": "../../opendmarc", 78 "path": "../../opendmarc",
114 "type": "path" 79 "type": "path"
115 }, 80 },
@@ -120,16 +85,16 @@
120 }, 85 },
121 "root": { 86 "root": {
122 "inputs": { 87 "inputs": {
88 "environment": "environment",
123 "files-watcher": "files-watcher", 89 "files-watcher": "files-watcher",
124 "my-lib": "my-lib",
125 "nix-lib": "nix-lib",
126 "opendmarc": "opendmarc", 90 "opendmarc": "opendmarc",
127 "secrets": "secrets" 91 "secrets": "secrets"
128 } 92 }
129 }, 93 },
130 "secrets": { 94 "secrets": {
131 "locked": { 95 "locked": {
132 "narHash": "sha256-w3u1bMEJHCg9SqErJ5Qi0sTX2xx7mk+HrHZXzpjQd1w=", 96 "lastModified": 1,
97 "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
133 "path": "../../secrets", 98 "path": "../../secrets",
134 "type": "path" 99 "type": "path"
135 }, 100 },
diff --git a/flakes/private/opendmarc/flake.nix b/flakes/private/opendmarc/flake.nix
index e2575e7..7e9e8eb 100644
--- a/flakes/private/opendmarc/flake.nix
+++ b/flakes/private/opendmarc/flake.nix
@@ -1,77 +1,62 @@
1{ 1{
2 inputs.opendmarc = { 2 inputs.opendmarc.url = "path:../../opendmarc";
3 path = "../../opendmarc"; 3 inputs.environment.url = "path:../environment";
4 type = "path"; 4 inputs.secrets.url = "path:../../secrets";
5 }; 5 inputs.files-watcher.url = "path:../../files-watcher";
6 inputs.secrets = {
7 path = "../../secrets";
8 type = "path";
9 };
10 inputs.files-watcher = {
11 path = "../../files-watcher";
12 type = "path";
13 };
14 inputs.my-lib = {
15 path = "../../lib";
16 type = "path";
17 };
18 inputs.nix-lib.url = "github:NixOS/nixpkgs";
19 6
20 description = "Private configuration for opendmarc"; 7 description = "Private configuration for opendmarc";
21 outputs = { self, nix-lib, opendmarc, my-lib, files-watcher, secrets }: 8 outputs = { self, environment, opendmarc, files-watcher, secrets }: {
22 let 9 nixosModule = self.nixosModules.opendmarc;
23 cfg = name': { config, lib, pkgs, name, ... }: { 10 nixosModules.opendmarc = { config, lib, pkgs, ... }: {
24 imports = [ 11 imports = [
25 (my-lib.lib.withNarKey files-watcher "nixosModule") 12 environment.nixosModule
26 (my-lib.lib.withNarKey opendmarc "nixosModule") 13 files-watcher.nixosModule
27 (my-lib.lib.withNarKey secrets "nixosModule") 14 opendmarc.nixosModule
28 ]; 15 secrets.nixosModule
29 config = lib.mkIf (name == name') { 16 ];
30 users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ]; 17 config = {
31 systemd.services.opendmarc.serviceConfig.Slice = "mail.slice"; 18 users.users."${config.services.opendmarc.user}".extraGroups = [ "keys" ];
32 services.opendmarc = { 19 systemd.services.opendmarc.serviceConfig.Slice = "mail.slice";
33 enable = true; 20 services.opendmarc = {
34 socket = "/run/opendmarc/opendmarc.sock"; 21 enable = true;
35 configFile = pkgs.writeText "opendmarc.conf" '' 22 socket = "/run/opendmarc/opendmarc.sock";
36 AuthservID HOSTNAME 23 configFile = pkgs.writeText "opendmarc.conf" ''
37 FailureReports false 24 AuthservID HOSTNAME
38 FailureReportsBcc postmaster@immae.eu 25 FailureReports false
39 FailureReportsOnNone true 26 FailureReportsBcc postmaster@immae.eu
40 FailureReportsSentBy postmaster@immae.eu 27 FailureReportsOnNone true
41 IgnoreAuthenticatedClients true 28 FailureReportsSentBy postmaster@immae.eu
42 IgnoreHosts ${config.secrets.fullPaths."opendmarc/ignore.hosts"} 29 IgnoreAuthenticatedClients true
43 SoftwareHeader true 30 IgnoreHosts ${config.secrets.fullPaths."opendmarc/ignore.hosts"}
44 SPFIgnoreResults true 31 SoftwareHeader true
45 SPFSelfValidate true 32 SPFIgnoreResults true
46 UMask 002 33 SPFSelfValidate true
47 ''; 34 UMask 002
48 group = config.services.postfix.group; 35 '';
49 }; 36 group = config.services.postfix.group;
50 services.filesWatcher.opendmarc = { 37 };
51 restart = true; 38 services.filesWatcher.opendmarc = {
52 paths = [ 39 restart = true;
53 config.secrets.fullPaths."opendmarc/ignore.hosts" 40 paths = [
54 ]; 41 config.secrets.fullPaths."opendmarc/ignore.hosts"
55 }; 42 ];
56 secrets.keys = { 43 };
57 "opendmarc/ignore.hosts" = { 44 secrets.keys = {
58 user = config.services.opendmarc.user; 45 "opendmarc/ignore.hosts" = {
59 group = config.services.opendmarc.group; 46 user = config.services.opendmarc.user;
60 permissions = "0400"; 47 group = config.services.opendmarc.group;
61 text = let 48 permissions = "0400";
62 mxes = lib.attrsets.filterAttrs 49 text = let
63 (n: v: v.mx.enable) 50 mxes = lib.attrsets.filterAttrs
64 config.myEnv.servers; 51 (n: v: v.mx.enable)
65 in 52 config.myEnv.servers;
66 builtins.concatStringsSep "\n" ([ 53 in
67 config.myEnv.mail.dmarc.ignore_hosts 54 builtins.concatStringsSep "\n" ([
68 ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes); 55 config.myEnv.mail.dmarc.ignore_hosts
69 }; 56 ] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
70 }; 57 };
71 }; 58 };
72 }; 59 };
73 in 60 };
74 opendmarc.outputs // 61 };
75 { nixosModules = opendmarc.nixosModules or {} // nix-lib.lib.genAttrs ["eldiron" "backup-2"] cfg; };
76} 62}
77
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 10:29:53 +0000