M-Labs/it-infra
M-Labs
/
it-infra
8
0
Fork 6
Code Issues 11 Pull Requests 1 Releases Wiki Activity

Optimize new fw rules and tweak postfix 

Signed-off-by: Egor Savkin <es@m-labs.hk>
This commit is contained in:
Egor Savkin 2024-10-15 17:41:28 +08:00
parent 7131a54bb6
commit 785777eb0e
1 changed files with 5 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
nixbld-etc-nixos/configuration.nix
View File

@ -92,7 +92,7 @@ in
firewall = { firewall = {
allowedTCPPorts = [ 53 80 443 2222 7402 ]; allowedTCPPorts = [ 53 80 443 2222 7402 ];
allowedUDPPorts = [ 53 67 500 4500 ]; allowedUDPPorts = [ 53 67 500 4500 ];
trustedInterfaces = [ netifLan netifUSA ]; trustedInterfaces = [ netifLan ];
logRefusedConnections = false; logRefusedConnections = false;
extraCommands = '' extraCommands = ''
iptables -A INPUT -s 5.78.86.156 -p gre -j ACCEPT iptables -A INPUT -s 5.78.86.156 -p gre -j ACCEPT
@ -1252,18 +1252,6 @@ in
}; };
}; };
services.postfix.mapFiles.sender_transport = pkgs.writeText "sender_transport" ''
@m-labs-intl.com intltunnel:
* :
'';
systemd.services.postfix-rebuild-sender-relay = {
description = "Postfix Rebuild Sender Dependent Transport Maps";
serviceConfig = {
ExecStart = "${pkgs.postfix}/sbin/postmap /var/lib/postfix/conf/sender_transport";
};
wantedBy = [ "multi-user.target" ];
};
mailserver = { mailserver = {
enable = true; enable = true;
localDnsResolver = false; # conflicts with dnsmasq localDnsResolver = false; # conflicts with dnsmasq
@ -1274,6 +1262,9 @@ in
certificateScheme = "acme-nginx"; certificateScheme = "acme-nginx";
} // (import /etc/nixos/secret/email_settings.nix); } // (import /etc/nixos/secret/email_settings.nix);
services.postfix = { services.postfix = {
mapFiles.sender_transport = pkgs.writeText "sender_transport" ''
@m-labs-intl.com intltunnel:
'';
config = { config = {
sender_dependent_default_transport_maps = "hash:/var/lib/postfix/conf/sender_transport"; sender_dependent_default_transport_maps = "hash:/var/lib/postfix/conf/sender_transport";
}; };
@ -1281,8 +1272,8 @@ in
type = "unix"; type = "unix";
command = "smtp"; command = "smtp";
args = [ args = [
"-o" "smtp_bind_address=10.47.3.1"
"-o" "inet_interfaces=10.47.3.1" "-o" "inet_interfaces=10.47.3.1"
"-o" "smtp_helo_name=mail.m-labs-intl.com"
"-o" "inet_protocols=ipv4" "-o" "inet_protocols=ipv4"
]; ];
}; };