M-Labs/it-infra
M-Labs
/
it-infra
8
0
Fork 6
Code Issues 11 Pull Requests Releases Wiki Activity

Optimize new fw rules and tweak postfix 

Signed-off-by: Egor Savkin <es@m-labs.hk>
This commit is contained in:
Egor Savkin 2024-10-15 17:41:28 +08:00
parent 60903e955f
commit 2ee23bc03a
1 changed files with 5 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
nixbld-etc-nixos/configuration.nix
View File

@ -97,8 +97,6 @@ in
extraCommands = '' extraCommands = ''
iptables -A INPUT -s 5.78.86.156 -p gre -j ACCEPT iptables -A INPUT -s 5.78.86.156 -p gre -j ACCEPT
iptables -A INPUT -s 5.78.86.156 -p ah -j ACCEPT iptables -A INPUT -s 5.78.86.156 -p ah -j ACCEPT
iptables -A OUTPUT -d 5.78.86.156 -p gre -j ACCEPT
iptables -A OUTPUT -d 5.78.86.156 -p ah -j ACCEPT
''; '';
}; };
useDHCP = false; useDHCP = false;
@ -1255,18 +1253,6 @@ in
}; };
}; };
services.postfix.mapFiles.sender_transport = pkgs.writeText "sender_transport" ''
@m-labs-intl.com intltunnel:
* :
'';
systemd.services.postfix-rebuild-sender-relay = {
description = "Postfix Rebuild Sender Dependent Transport Maps";
serviceConfig = {
ExecStart = "${pkgs.postfix}/sbin/postmap /var/lib/postfix/conf/sender_transport";
};
wantedBy = [ "multi-user.target" ];
};
mailserver = { mailserver = {
enable = true; enable = true;
localDnsResolver = false; # conflicts with dnsmasq localDnsResolver = false; # conflicts with dnsmasq
@ -1277,6 +1263,10 @@ in
certificateScheme = "acme-nginx"; certificateScheme = "acme-nginx";
} // (import /etc/nixos/secret/email_settings.nix); } // (import /etc/nixos/secret/email_settings.nix);
services.postfix = { services.postfix = {
mapFiles.sender_transport = pkgs.writeText "sender_transport" ''
@m-labs-intl.com intltunnel:
* :
'';
config = { config = {
sender_dependent_default_transport_maps = "hash:/var/lib/postfix/conf/sender_transport"; sender_dependent_default_transport_maps = "hash:/var/lib/postfix/conf/sender_transport";
}; };
@ -1284,8 +1274,8 @@ in
type = "unix"; type = "unix";
command = "smtp"; command = "smtp";
args = [ args = [
"-o" "smtp_bind_address=10.47.3.1"
"-o" "inet_interfaces=10.47.3.1" "-o" "inet_interfaces=10.47.3.1"
"-o" "smtp_helo_name=mail.m-labs-intl.com"
"-o" "inet_protocols=ipv4" "-o" "inet_protocols=ipv4"
]; ];
}; };