bogale/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ssh-agent, rspamd

Browse source
This commit is contained in:
bogale 2026-09-22 15:24:18 +09:00
commit 0eccc75207
14 changed files with 80 additions and 85 deletions
Download patch file Download diff file Expand all files Collapse all files

85
server/configuration.nix
View file

@ -6,7 +6,7 @@
groups.vmail.gid = 1819;
users = {
nginx.extraGroups = [ "acme" ];
bogale.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ];
root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ];
vmail = {
uid = 1819;
group = "vmail";
@ -17,7 +17,7 @@
networking = {
hostName = "nixos-server";
firewall = {
allowedTCPPorts = [ 25 80 443 587 993 ];
allowedTCPPorts = [ 25 443 587 993 ];
allowedUDPPorts = [ 443 ];
};
networkmanager.ensureProfiles.profiles.home-wifi = {
@ -37,10 +37,10 @@
};
security.acme = {
acceptTerms = true;
defaults.email = "letsencrypt@bogaledev.ru";
certs."bogaledev.ru" = {
validMinDays = 3;
dnsProvider = "cloudflare";
email = "letsencrypt@bogaledev.ru";
extraDomainNames = [ "*.bogaledev.ru" ];
credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
@ -53,8 +53,6 @@
];
timers.network-watchdog = {
wantedBy = [ "timers.target" ];
after = [ "NetworkManager.service" ];
wants = [ "NetworkManager.service" ];
timerConfig = {
OnBootSec = 5;
AccuracySec = 1;
@ -64,7 +62,10 @@
};
services.network-watchdog = {
path = [ pkgs.iputils ];
serviceConfig.Type = "oneshot";
serviceConfig = {
Type = "oneshot";
LogLevelMax = "notice";
};
script = ''
if [ ! -e /run/network.failures ] || ping -c 1 -W 3 1.1.1.1 &> /dev/null; then
failures=0
@ -76,6 +77,9 @@
fi
fi
echo $failures > /run/network.failures
if [ $failures -ge 0 ]; then
echo "<5>failures = $failures"
fi
'';
};
};
@ -83,14 +87,11 @@
saslSocket = "/var/spool/postfix/private/auth";
sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
in {
postgresql.enable = true;
openssh = {
enable = true;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
};
settings.PasswordAuthentication = false;
};
postgresql.enable = true;
phpfpm.pools.main = {
user = "nginx";
group = "nginx";
@ -115,6 +116,35 @@
DOMAIN = "https://bogaledev.ru/vw";
};
};
nginx.virtualHosts."bogaledev.ru" = {
quic = true;
default = true;
forceSSL = true;
root = "/srv/http";
useACMEHost = "bogaledev.ru";
extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;'';
locations = {
"/".index = "index.php index.html";
"~ \\.php$".extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
'';
"/vw" = {
proxyPass = "http://127.0.0.1:8000";
proxyWebsockets = true;
extraConfig = ''
allow fc00::/64;
allow fc01::/64;
allow 10.0.0.0/24;
allow 10.1.0.0/24;
deny all;
'';
};
};
};
rspamd = {
enable = true;
postfix.enable = true;
};
dovecot2 = {
enable = true;
settings = {
@ -167,38 +197,5 @@
];
};
};
nginx = {
enable = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedBrotliSettings = true;
virtualHosts."bogaledev.ru" = {
quic = true;
default = true;
forceSSL = true;
root = "/srv/http";
useACMEHost = "bogaledev.ru";
extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;'';
locations = {
"/".index = "index.php index.html";
"~ \\.php$".extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
'';
"/vw" = {
proxyPass = "http://127.0.0.1:8000";
proxyWebsockets = true;
extraConfig = ''
allow fc00::/64;
allow fc01::/64;
allow 10.0.0.0/24;
allow 10.1.0.0/24;
deny all;
'';
};
};
};
};
};
}