tgbot-send

common.nix

@@ -23,7 +23,10 @@
       panicOnChecksumMismatch = true;
     };
   };
-  users.users.root.hashedPasswordFile = "/secrets/root.passwd";
+  users = {
+    groups.secrets.gid = 1578;
+    users.root.hashedPasswordFile = "/secrets/user-root-pw";
+  };
   networking = {
     firewall = {
       allowedTCPPorts = [ 53 80 ];
@@ -48,6 +51,7 @@
     };
   };
   environment.systemPackages = with pkgs; [
+    jq
     sbctl
   ];
   services = {
@@ -65,7 +69,7 @@
       settings = {
         enable-ra = true;
         no-resolv = true;
-        cache-size = 8192;
+        cache-size = 4096;
         bogus-priv = true;
         enable-tftp = true;
         interface = "enp1s0";

marks

@@ -12,6 +12,5 @@ nixos-install --flake "/mnt/etc/nixos#nixos" --no-channel-copy --no-root-passwd
 systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 <LUKS_DEV>
 
 todo:
-- gitea, mediawiki
+- mediawiki, wordpress
 - email tracking
-- redirect randomizer

server/configuration.nix

@@ -3,6 +3,7 @@
   imports = [ ../common.nix ./hardware-configuration.nix ];
   boot.kernelParams = [
     "consoleblank=60"
+    #TPM fix
     "memmap=0x4000%0xbfb76000-4"
     "memmap=0x4000%0xbfb7a000-4"
   ];
@@ -13,6 +14,7 @@
     };
     users = {
       nginx.extraGroups = [ "acme" ];
+      dovecot2.extraGroups = [ "secrets" ];
       root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ];
       php = {
         uid = 1568;
@@ -63,23 +65,41 @@
       "d /var/spool/postfix 0755 postfix postfix -"
       "d /var/spool/postfix/private 0755 postfix postfix -"
     ];
-    timers.network-watchdog = {
+    timers = {
+      tgbot-send = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-01 16:00:00";
+          Persistent = true;
+        };
+      };
+      network-watchdog = {
         wantedBy = [ "timers.target" ];
         timerConfig = {
           OnBootSec = 30;
           AccuracySec = 1;
           OnUnitActiveSec = 10;
-        Unit = "network-watchdog.service";
         };
       };
-    services.network-watchdog = {
-      path = [ pkgs.iputils ];
+    };
+    services = {
+      tgbot-send = {
+        serviceConfig.Type = "oneshot";
+        script = ''
+          . /secrets/tgbot.env
+          ${pkgs.curl}/bin/curl "https://api.telegram.org/$BOT/sendMessage" \
+            -X POST -d "chat_id=$CHAT_ID" -d "text=$TEXT" 2> /dev/null | \
+            ${pkgs.jq}/bin/jq '.result.date |= strftime("%Y-%m-%d %H:%M:%S")'
+        '';
+      };
+      network-watchdog = {
         serviceConfig = {
           Type = "oneshot";
           LogLevelMax = "notice";
         };
         script = ''
-        if [ ! -e /run/network.failures ] || ping -c 1 -W 3 1.1.1.1 &> /dev/null; then
+          if [ ! -e /run/network.failures ] || \
+            ${pkgs.iputils}/bin/ping -c 1 -W 3 1.1.1.1 &> /dev/null; then
             failures=0
           else
             failures=$((1+$(cat /run/network.failures)))
@@ -96,7 +116,9 @@
         '';
       };
     };
+  };
   services = let
+    mailBase = "/var/spool/mail/vmail";
     saslSocket = "/var/spool/postfix/private/auth";
     sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
   in {
@@ -183,7 +205,6 @@
       postfix.enable = true;
       locals = {
         "classifier-bayes.conf".text = "autolearn = true;";
-        "worker-controller.inc".source = "/secrets/rspamd-pw";
         "redis.conf".text = ''
           servers = "${config.services.redis.servers.rspamd.unixSocket}";
         '';
@@ -195,15 +216,15 @@
         ssl = "required";
         mail_gid = "vmail";
         mail_uid = "vmail";
+        mail_path = mailBase;
         protocols.imap = true;
         mail_driver = "maildir";
         auth_mechanisms = [ "plain" ];
+        dovecot_config_version = "2.4.5";
         dovecot_storage_version = "2.4.5";
-        mail_path = "/var/spool/mail/vmail";
         ssl_server_key_file = "${sslCertDir}/key.pem";
         ssl_server_cert_file = "${sslCertDir}/fullchain.pem";
-        dovecot_config_version = config.services.dovecot2.package.version;
-        "passdb passwd-file".passwd_file_path = "/secrets/dovecot-passwd";
+        "passdb passwd-file".passwd_file_path = "/secrets/dovecot-pw";
         "service auth"."unix_listener ${saslSocket}" = {
           mode = "0660";
           user = "postfix";
@@ -225,13 +246,13 @@
         smtpd_sasl_path = saslSocket;
         smtp_sasl_auth_enable = "yes";
         smtpd_sasl_auth_enable = "yes";
+        virtual_mailbox_base = mailBase;
         virtual_uid_maps = "static:1819";
         virtual_gid_maps = "static:1819";
         smtp_tls_security_level = "encrypt";
         smtpd_tls_security_level = "encrypt";
         relayhost = [ "smtp.resend.com:2587" ];
         virtual_mailbox_domains = "bogaledev.ru";
-        virtual_mailbox_base = "/var/spool/mail/vmail";
         smtp_sasl_tls_security_options = "noanonymous";
         virtual_mailbox_maps = "hash:/etc/postfix/mailbox";
         smtp_sasl_password_maps = "hash:/etc/postfix/smtp_passwd";