pxeboot chain

server/configuration.nix

@@ -40,7 +40,7 @@
       configFile = "/secrets/awg/1.conf";
       address = [ "fc00::2/128" "10.0.0.2/32" ];
     };
-    networkmanager.ensureProfiles.profiles.home-wifi = {
+    networkmanager.ensureProfiles.profiles.wifi = {
       wifi.ssid = "bogale_2.4";
       ipv6.addresses = "fc01::2/64";
       ipv4.addresses = "10.1.0.2/16";

server/mods/mail.nix

@@ -33,17 +33,21 @@ in {
         smtpd_sasl_path = "${postfixDir}/auth";
         milter_macro_daemon_name = "ORIGINATING";
         smtpd_client_restrictions = "permit_sasl_authenticated,reject";
-        smtpd_tls_chain_files = "${sslCertDir}/key.pem,${sslCertDir}/fullchain.pem";
       };
       settings.main = {
         smtp_tls_wrappermode = true;
         smtp_sasl_auth_enable = true;
         smtp_tls_security_level = "verify";
+        smtpd_tls_security_level = "encrypt";
         relayhost = [ "smtp.resend.com:2465" ];
         virtual_mailbox_domains = "bogaledev.ru";
         smtp_sasl_tls_security_options = "noanonymous";
         virtual_transport = "lmtp:unix:${postfixDir}/lmtp";
         smtp_sasl_password_maps = "hash:/etc/postfix/smtp_passwd";
+        smtpd_tls_chain_files = [
+          "${sslCertDir}/key.pem"
+          "${sslCertDir}/fullchain.pem"
+        ];
       };
     };
     dovecot2 = {

server/mods/sysd.nix

@@ -71,7 +71,7 @@
             failures=$((1+$(cat /run/network.failures)))
           fi
           if [ $failures -ge $limit ]; then
-            echo "<4>restarting NetworkManager"
+            echo "<4>restarting network"
             systemctl restart NetworkManager.service
             [ $limit -lt 360 ] && limit=$((2*$limit))
             failures=0

server/mods/web.nix

@@ -77,15 +77,17 @@
       '';
       localNetworks = ''
         allow fc00::/64;
-        allow fc01::/120;
+        allow fc01::/96;
+        allow fc02::/64;
         allow 10.0.0.0/16;
         allow 10.1.0.0/24;
+        allow 10.2.0.0/16;
         deny all;
       '';
     in {
       quic = true;
+      addSSL = true;
       default = true;
-      forceSSL = true;
       root = "/srv/http";
       useACMEHost = "bogaledev.ru";
       extraConfig = ''