diff --git a/hosts/phantom/default.nix b/hosts/phantom/default.nix index 7bb0fb0..a0e99b7 100644 --- a/hosts/phantom/default.nix +++ b/hosts/phantom/default.nix @@ -10,12 +10,11 @@ ./syncthing.nix ./users.nix ./writefreely.nix - ./renawiki.nix ./email.nix ./forgejo.nix ]; - services.nginx.virtualHosts."lelgenio.xyz" = { + services.nginx.virtualHosts."lelgenio.com" = { enableACME = true; forceSSL = true; root = pkgs.runCommand "www-dir" { } '' @@ -51,7 +50,7 @@ dates = "04:40"; operation = "switch"; flags = [ "--update-input" "nixpkgs" "--no-write-lock-file" "-L" ]; - flake = "git+https://git.lelgenio.xyz/lelgenio/nixos-config#phantom"; + flake = "git+https://git.lelgenio.com/lelgenio/nixos-config#phantom"; }; system.stateVersion = "23.05"; # Never change this diff --git a/hosts/phantom/email.nix b/hosts/phantom/email.nix index d56a946..e0a135e 100644 --- a/hosts/phantom/email.nix +++ b/hosts/phantom/email.nix @@ -1,4 +1,4 @@ -{ pkgs, inputs, ... }: { +{ pkgs, inputs, config, ... }: { # It's important to let Digital Ocean set the hostname so we get rDNS to work networking.hostName = ""; @@ -8,32 +8,47 @@ mailserver = { enable = true; - fqdn = "lelgenio.xyz"; + fqdn = "lelgenio.com"; domains = [ "lelgenio.xyz" "git.lelgenio.xyz" + "lelgenio.com" + "git.lelgenio.com" + "social.lelgenio.com" ]; certificateScheme = "acme-nginx"; # Create passwords with # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt' loginAccounts = { + "lelgenio@lelgenio.com" = { + hashedPassword = "$2y$05$z5s7QCXcs5uTFsfyYpwNJeWzb3RmzgWxNgcPCr0zjSytkLFF/qZmS"; + aliases = [ "postmaster@lelgenio.com" ]; + }; "lelgenio@lelgenio.xyz" = { hashedPassword = "$2y$05$z5s7QCXcs5uTFsfyYpwNJeWzb3RmzgWxNgcPCr0zjSytkLFF/qZmS"; aliases = [ "postmaster@lelgenio.xyz" ]; }; - "noreply@git.lelgenio.xyz" = { + "noreply@git.lelgenio.com" = { hashedPassword = "$2b$05$TmR1R7ZwXfec7yrOfeBL7u3ZtyXf0up5dEO6uMWSvb/O7LPEm.j0."; }; + "noreply@social.lelgenio.com" = { + hashedPassword = "$2b$05$DcA9xMdvHqqQMZw2.zybI.vfKsQAJtaQ/JB.t9AHu6psstWq97m2C"; + }; }; }; + # Prefer ipv4 and use main ipv6 to avoid reverse DNS issues + services.postfix.extraConfig = '' + smtp_address_preference = ipv4 + ''; + # Webmail - services.roundcube = rec { + services.roundcube = { enable = true; package = pkgs.roundcube.withPlugins (p: [ p.carddav ]); - hostName = "mail.lelgenio.xyz"; + hostName = "mail.lelgenio.com"; extraConfig = '' - $config['smtp_host'] = "tls://${hostName}:587"; + $config['smtp_host'] = "tls://${config.mailserver.fqdn}:587"; $config['smtp_user'] = "%u"; $config['smtp_pass'] = "%p"; $config['plugins'] = [ "carddav", "archive" ]; diff --git a/hosts/phantom/forgejo.nix b/hosts/phantom/forgejo.nix index 4e6327b..61f0a51 100644 --- a/hosts/phantom/forgejo.nix +++ b/hosts/phantom/forgejo.nix @@ -26,15 +26,15 @@ in DEFAULT_ACTIONS_URL = "github"; }; server = { - DOMAIN = "git.lelgenio.xyz"; + DOMAIN = "git.lelgenio.com"; HTTP_PORT = 3000; ROOT_URL = "https://${srv.DOMAIN}/"; }; mailer = { ENABLED = true; - SMTP_ADDR = "mail.lelgenio.xyz"; - FROM = "noreply@git.lelgenio.xyz"; - USER = "noreply@git.lelgenio.xyz"; + SMTP_ADDR = "mail.lelgenio.com"; + FROM = "noreply@git.lelgenio.com"; + USER = "noreply@git.lelgenio.com"; }; }; mailerPasswordFile = config.age.secrets.phantom-forgejo-mailer-password.path; diff --git a/hosts/phantom/mastodon.nix b/hosts/phantom/mastodon.nix index adfaf0d..9d15d6b 100644 --- a/hosts/phantom/mastodon.nix +++ b/hosts/phantom/mastodon.nix @@ -2,10 +2,22 @@ services.mastodon = { enable = true; configureNginx = true; - localDomain = "social.lelgenio.xyz"; - smtp.fromAddress = "lelgenio@disroot.org"; + localDomain = "social.lelgenio.com"; + smtp = { + authenticate = true; + host = "lelgenio.com"; + fromAddress = "noreply@social.lelgenio.com"; + user = "noreply@social.lelgenio.com"; + passwordFile = config.age.secrets.phantom-mastodon-mailer-password.path; + }; streamingProcesses = 2; extraConfig.SINGLE_USER_MODE = "true"; mediaAutoRemove.olderThanDays = 10; }; + + age.secrets.phantom-mastodon-mailer-password = { + file = ../../secrets/phantom-mastodon-mailer-password.age; + mode = "400"; + owner = "mastodon"; + }; } diff --git a/hosts/phantom/nextcloud.nix b/hosts/phantom/nextcloud.nix index 5bddece..20c7173 100644 --- a/hosts/phantom/nextcloud.nix +++ b/hosts/phantom/nextcloud.nix @@ -2,7 +2,7 @@ services.nextcloud = { enable = true; package = pkgs.nextcloud27; - hostName = "cloud.lelgenio.xyz"; + hostName = "cloud.lelgenio.com"; https = true; config = { adminpassFile = config.age.secrets.phantom-nextcloud.path; diff --git a/hosts/phantom/nginx.nix b/hosts/phantom/nginx.nix index 08ece70..8692134 100644 --- a/hosts/phantom/nginx.nix +++ b/hosts/phantom/nginx.nix @@ -1,10 +1,23 @@ -{ config, pkgs, inputs, ... }: { +{ config, pkgs, lib, ... }: { services.nginx = { enable = true; recommendedProxySettings = true; recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; }; + # Redirect *lelgenio.xyz -> *lelgenio.com + services.nginx.virtualHosts = lib.mapAttrs' + (key: value: lib.nameValuePair "${key}lelgenio.xyz" value) + ( + lib.genAttrs [ "" "social." "blog." "cloud." "mail." "git." "syncthing." ] (name: { + enableACME = true; + forceSSL = true; + locations."/".return = "301 $scheme://${name}lelgenio.com$request_uri"; + }) + ); + security.acme = { acceptTerms = true; defaults.email = "lelgenio@disroot.org"; diff --git a/hosts/phantom/renawiki.nix b/hosts/phantom/renawiki.nix deleted file mode 100644 index 5b21907..0000000 --- a/hosts/phantom/renawiki.nix +++ /dev/null @@ -1,23 +0,0 @@ -{ config, pkgs, inputs, ... }: { - services.mediawiki = { - enable = true; - name = "Rena Wiki"; - - webserver = "nginx"; - nginx.hostName = "renawiki.lelgenio.xyz"; - passwordFile = config.age.secrets.phantom-renawiki.path; - - extensions.VisualEditor = null; - }; - services.nginx.virtualHosts."renawiki.lelgenio.xyz" = { - enableACME = true; - forceSSL = true; - }; - - age.secrets.phantom-renawiki = { - file = ../../secrets/phantom-renawiki.age; - mode = "400"; - owner = "mediawiki"; - }; -} - diff --git a/hosts/phantom/syncthing.nix b/hosts/phantom/syncthing.nix index a971b86..55e4cbc 100644 --- a/hosts/phantom/syncthing.nix +++ b/hosts/phantom/syncthing.nix @@ -7,7 +7,7 @@ openDefaultPorts = true; }; - services.nginx.virtualHosts."syncthing.lelgenio.xyz" = { + services.nginx.virtualHosts."syncthing.lelgenio.com" = { enableACME = true; forceSSL = true; locations."/" = { diff --git a/hosts/phantom/writefreely.nix b/hosts/phantom/writefreely.nix index 6a2652e..3530e06 100644 --- a/hosts/phantom/writefreely.nix +++ b/hosts/phantom/writefreely.nix @@ -4,7 +4,7 @@ acme.enable = true; nginx.enable = true; nginx.forceSSL = true; - host = "blog.lelgenio.xyz"; + host = "blog.lelgenio.com"; admin.name = "lelgenio"; admin.initialPasswordFile = config.age.secrets.phantom-writefreely.path; settings.app = { diff --git a/secrets/phantom-mastodon-mailer-password.age b/secrets/phantom-mastodon-mailer-password.age new file mode 100644 index 0000000..37232fb --- /dev/null +++ b/secrets/phantom-mastodon-mailer-password.age @@ -0,0 +1,13 @@ +age-encryption.org/v1 +-> ssh-rsa BwwxHg +Mnc+/tJ0QqxHkg2nl9gEkz5Oj1RgxtOZnD5gRv66ISUOqZhNm1+F+xVEdKn843/q +/WzH0f1cTF9NXP8vIaEo//bMmp50obJAd+JNovJxV+0gb9L55Nu7ayvK+eyk6j5n +eb8TxUnwh5BPkEyc6akDh/O49GXzLlVoFD6Ik/0f3YCqUDNAYOl2bsssXtevCeK/ +WEPoCFGhZfNUrOo/0eAhiujZZ5zVb0CWNqXi8VTe2eWOE20VJULcN13TEyO3ZePx +bAPBmDfS5GgGlV4INWxVLaIMDrzlm0tYozbBNNUbdLFFOhIOrgvay9RWxdk0u2hJ +MPKoKsJ96EFxrbZJdS0W7a+aZk/Q3A3Civ2rtPx+5UANhmlY8e1lUHa26e1vA4K7 +ApoMtDyCbuZ9FbLurwl9zO64wWP68aKzuyKOIw+wpy41NQ/PcViSY8KNG9Pt7A2N +CcOkByx+rwz+JdNHbOF8O4FFG4fNSWn7SvVtu5ymGgVi1bOd8PdJpjDR+6Is0SX7 + +--- DHNyITb7ZseEV58MOD/zHeH5vff0hhlbKg27rlYECGk +ÆJ…¨Úãè· /dev/null 2>&1 < /dev/null & }} +} > /dev/null 2>&1 < /dev/null & }} -group sync-clipboard # Trim trailing whitespace hook global BufWritePre .* %{ try %{