nixos/server/configuration.nix

{ config, lib, pkgs, ... }:
{
  imports = [ ../common.nix ./hardware-configuration.nix ];
  boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ];
  users = {
    groups.vmail.gid = 1819;
    users = {
      nginx.extraGroups = [ "acme" ];
      bogale.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+wc+3rahpNa+OMS9gaWgMQIxXIKHy4Beku5LBDt+Ow" ];
      vmail = {
        uid = 1819;
        group = "vmail";
        isSystemUser = true;
      };
    };
  };
  networking = {
    hostName = "nixos-server";
    networkmanager.ensureProfiles.profiles.home-wifi = {
      wifi.ssid = "bogale_2.4";
      wifi-security.psk = "$BOGALE_2_4_PSK";
    };
    firewall = {
      allowedTCPPorts = [ 25 80 443 993 ];
      allowedUDPPorts = [ 443 ];
    };
  };
  security.acme = {
    acceptTerms = true;
    certs."bogaledev.ru" = {
      validMinDays = 3;
      dnsProvider = "cloudflare";
      email = "letsencrypt@bogaledev.ru";
      extraDomainNames = [ "*.bogaledev.ru" ];
      reloadServices = [ "nginx.service" "dovecot.service" "postfix.service" ];
      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/secrets/cf-token"; };
    };
  };
  systemd = {
    services.network-watchdog = {
      path = [ pkgs.iputils ];
      serviceConfig.Type = "oneshot";
      script = ''
        if [ ! -e /run/network.failures ] || ping -c 1 -W 3 1.1.1.1 &> /dev/null; then
          failures=0
        else
          failures=$(($(cat /run/network.failures)+1))
          if [ $failures -ge 3 ]; then
            systemctl restart NetworkManager
            failures=0
          fi
        fi
        echo $failures > /run/network.failures
      '';
    };
    timers.network-watchdog = {
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnBootSec = 5;
        AccuracySec = 1;
        OnUnitActiveSec = 5;
        Unit = "network-watchdog.service";
      };
    };
  };
  services = {
    postgresql.enable = true;
    openssh = {
      enable = true;
      settings = {
        PermitRootLogin = "no";
        PasswordAuthentication = false;
      };
    };
    phpfpm.pools.main = {
      user = "nginx";
      group = "nginx";
      settings = {
        "pm" = "ondemand";
        "pm.max_children" = 8;
        "listen.owner" = "nginx";
        "listen.group" = "nginx";
      };
    };
    dovecot2 = {
      enable = true;
      settings = {
        mail_path = "~";
        ssl = "required";
        mail_gid = "vmail";
        mail_uid = "vmail";
        protocols.imap = true;
        mail_driver = "maildir";
        mail_home = "/var/mail/vmail";
        auth_mechanisms = [ "plain" ];
        dovecot_config_version = "2.4.5";
        dovecot_storage_version = "2.4.5";
        ssl_server_key_file = "/var/lib/acme/bogaledev.ru/key.pem";
        ssl_server_cert_file = "/var/lib/acme/bogaledev.ru/fullchain.pem";
        "passdb passwd-file".passwd_file_path = "/secrets/dovecot-passwd";
      };
    };
    postfix = {
      enable = true;
      #enableSubmission = true;
      virtualMapType = "regexp";
      virtual = ''/.*@bogaledev.ru/ mail@bogaledev.ru'';
      mapFiles.mailbox = pkgs.writeText "mailbox" ''mail@bogaledev.ru /'';
      settings.main = {
        virtual_uid_maps = "static:1819";
        virtual_gid_maps = "static:1819";
        smtp_tls_security_level = "encrypt";
        smtpd_tls_security_level = "encrypt";
        virtual_mailbox_domains = "bogaledev.ru";
        virtual_mailbox_base = "/var/spool/mail/vmail";
        virtual_mailbox_maps = "hash:/etc/postfix/mailbox";
        smtpd_tls_chain_files = [
          "/var/lib/acme/bogaledev.ru/key.pem"
          "/var/lib/acme/bogaledev.ru/fullchain.pem"
        ];
      };
    };
    vaultwarden = {
      enable = true;
      configureNginx = true;
      dbBackend = "postgresql";
      configurePostgres = true;
      domain = "vw.bogaledev.ru";
      package = pkgs.vaultwarden-postgresql;
      environmentFile = "/secrets/vaultwarden.env";
      config = {
        #EMAIL_TOKEN_SIZE = 8;
        #SMTP_SECURITY = "off";
        #SMTP_HOST = "localhost";
        SIGNUPS_ALLOWED = false;
        #REQUIRE_DEVICE_EMAIL = true;
        TRASH_AUTO_DELETE_DAYS = 90;
        PASSWORD_HINTS_ALLOWED = false;
        EMERGENCY_ACCESS_ALLOWED = false;
        #SMTP_FROM = "vaultwarden@bogaledev.ru";
      };
    };
    nginx = {
      enable = true;
      recommendedTlsSettings = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedBrotliSettings = true;
      virtualHosts."bogaledev.ru" = {
        quic = true;
        default = true;
        forceSSL = true;
        root = "/srv/http";
        useACMEHost = "bogaledev.ru";
        extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;'';
        locations = {
          "/".index = "index.php index.html";
          "~ \\.php$".extraConfig = ''
            fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
          '';
        };
      };
      virtualHosts."vw.bogaledev.ru" = {
        quic = true;
        forceSSL = true;
        useACMEHost = "bogaledev.ru";
        serverAliases = [ "vw-wl.bogaledev.ru" ];
        extraConfig = ''
          allow fc00::/64;
          allow 10.0.0.0/24;
          allow 192.168.1.0/24;
          deny all;
          add_header Alt-Svc 'h3=":443"; ma=86400' always;
        '';
      };
    };
  };
}