Compare commits
12 Commits
6382326316
...
addc202345
Author | SHA1 | Date |
---|---|---|
Egor Savkin | addc202345 | |
Egor Savkin | 6dded5a701 | |
Egor Savkin | 17b21f3801 | |
Egor Savkin | dba87d68d3 | |
Egor Savkin | 4966465b1c | |
Egor Savkin | a230f3fa68 | |
Egor Savkin | c3be96a166 | |
Egor Savkin | 3237cfb50f | |
Egor Savkin | f0d13c40ba | |
Sebastien Bourdeauducq | aaf70f36df | |
Sébastien Bourdeauducq | 4a288abe2b | |
Sébastien Bourdeauducq | 246a375dfb |
|
@ -90,7 +90,7 @@ in
|
|||
hostId = "e423f012";
|
||||
firewall = {
|
||||
allowedTCPPorts = [ 53 80 443 2222 7402 ];
|
||||
allowedUDPPorts = [ 53 67 500 4500 ];
|
||||
allowedUDPPorts = [ 53 67 500 4500 51820 ];
|
||||
trustedInterfaces = [ netifLan ];
|
||||
};
|
||||
useDHCP = false;
|
||||
|
@ -246,6 +246,30 @@ in
|
|||
}
|
||||
];
|
||||
};
|
||||
wireguard.interfaces = {
|
||||
intl0 = {
|
||||
ips = [ "10.42.0.2/30" ];
|
||||
listenPort = 51820;
|
||||
privateKeyFile = "/path/to/private/key"; # just `wg-quick genkey > /path/to/private/key`
|
||||
postUp = ''
|
||||
${pkgs.iproute2}/bin/ip rule add from 10.42.0.0/30 lookup 51820
|
||||
${pkgs.iproute2}/bin/ip route add default via 10.42.0.1 dev intl0 table 51820
|
||||
'';
|
||||
preDown = ''
|
||||
${pkgs.iproute2}/bin/ip rule del from 10.42.0.0/30 lookup 51820
|
||||
${pkgs.iproute2}/bin/ip route del default via 10.42.0.1 dev intl0 table 51820
|
||||
'';
|
||||
peers = [
|
||||
{
|
||||
publicKey = "4RozbGZ9ENCjvJXGMB5aK1oqyZfD4UCarEHjSckwVGI=";
|
||||
allowedIPs = [ "0.0.0.0/0" ];
|
||||
allowedIPsAsRoutes = false;
|
||||
endpoint = "2a01:4ff:1f0:83de::1:51820";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
|
||||
boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
|
||||
|
@ -1150,6 +1174,7 @@ in
|
|||
enable = true;
|
||||
package = pkgs.callPackage ./flarum {};
|
||||
domain = "forum.m-labs.hk";
|
||||
createDatabaseLocally = true;
|
||||
};
|
||||
|
||||
services.rt = {
|
||||
|
@ -1178,6 +1203,18 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
environment.etc."postfix/sender_relay".text = ''
|
||||
m-labs-intl.com smtptun:
|
||||
* :
|
||||
'';
|
||||
systemd.services.postfix-rebuild-sender-relay = {
|
||||
description = "Postfix Rebuild Sender Dependent Relayhost Maps";
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.postfix}/sbin/postmap /etc/postfix/sender_relay";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
mailserver = {
|
||||
enable = true;
|
||||
localDnsResolver = false; # conflicts with dnsmasq
|
||||
|
@ -1186,8 +1223,17 @@ in
|
|||
enablePop3 = true;
|
||||
enablePop3Ssl = true;
|
||||
certificateScheme = "acme-nginx";
|
||||
policydSPFExtraConfig = "skip_addresses = 5.78.86.156,2a01:4ff:1f0:83de::1";
|
||||
} // (import /etc/nixos/secret/email_settings.nix);
|
||||
services.postfix = {
|
||||
config = {
|
||||
sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay";
|
||||
masterConfig.smtptun = {
|
||||
type = "smtp";
|
||||
command = "smtp";
|
||||
args = "-o smtp_bind_address=10.42.0.2";
|
||||
};
|
||||
};
|
||||
};
|
||||
services.roundcube = {
|
||||
enable = true;
|
||||
hostName = "mail.m-labs.hk";
|
||||
|
|
|
@ -23,7 +23,6 @@ ns A 94.190.212.123
|
|||
ns AAAA 2001:470:18:390::2
|
||||
|
||||
mail A 5.78.86.156
|
||||
mail AAAA 2a01:4ff:1f0:83de::1
|
||||
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB"
|
||||
_dmarc TXT "v=DMARC1; p=none"
|
||||
|
||||
|
|
|
@ -111,27 +111,6 @@
|
|||
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBK1tUg7TtceARRnGI80Ai5kNFolFfZ++LH9v1UoRCiJdxeQWPdNYO0Gj7+ejJvgZXwvN4yHGgcZHraEml4Mj/dKrEMFygfuYLDRmXtPFwX6TNMrWlxMhPzuNY+yCaxlqYg=="
|
||||
];
|
||||
};
|
||||
architeuthis = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["plugdev" "dialout"];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBMhLPEGWDUauFHjiVduBMJrIMKT8SvtTDHXDVudUZrhewQy08h4NEEyWmczP4WMeyugI/L/a+J+Vc8mImgqSoHw52823LVcnR9EKnJoqnwAHU/J+41vIWAN2LAryd4p9yg=="
|
||||
];
|
||||
};
|
||||
abdul = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["plugdev" "dialout"];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBONzKWn65erPM2xBCe9Dcw8dHRQCJmvzwhX72iHE1xVlAr7UcB1PMOjEB25MFfV/kCIFS5UB5wuoPvq+/oZ3EXiFjmQtsb669KN6MkZNyDqP5Y2W8gR1wVa/ZLfH4HynHg=="
|
||||
];
|
||||
};
|
||||
lyken = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["plugdev" "dialout"];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBJ88QJlh/+F/xwXQlPEmQVmtycb8FfabxCdeiP3gTHUCV8y4PLh3ubY+EsY+Xhy/GlOAPdX7KSpiII3dndYfwZWzorXVoPBhhPKEIumFBOinWfp5kRVzWOD61gCwsYoVBg=="
|
||||
];
|
||||
};
|
||||
|
||||
dpn = {
|
||||
isNormalUser = true;
|
||||
|
|
|
@ -0,0 +1,49 @@
|
|||
connections {
|
||||
bypass-ipsec {
|
||||
remote_addrs = 127.0.0.1
|
||||
children {
|
||||
bypass-isakmp-v4 {
|
||||
local_ts = 0.0.0.0/0[udp/isakmp]
|
||||
remote_ts = 0.0.0.0/0[udp/isakmp]
|
||||
mode = pass
|
||||
start_action = trap
|
||||
}
|
||||
bypass-isakmp-v6 {
|
||||
local_ts = ::/0[udp/isakmp]
|
||||
remote_ts = ::/0[udp/isakmp]
|
||||
mode = pass
|
||||
start_action = trap
|
||||
}
|
||||
}
|
||||
}
|
||||
m_labs {
|
||||
version = 2
|
||||
encap = no
|
||||
mobike = no
|
||||
send_certreq = no
|
||||
proposals = aes128gcm128-sha256-prfsha256-curve25519,aes128gcm128-sha256-prfsha256-ecp256
|
||||
local_addrs = 103.206.98.1
|
||||
remote_addrs = 94.190.212.123
|
||||
local {
|
||||
auth = pubkey
|
||||
id = fqdn:igw0.hkg.as150788.net
|
||||
pubkeys = igw0.hkg.as150788.net
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = fqdn:m-labs.hk
|
||||
pubkeys = m-labs.hk
|
||||
}
|
||||
children {
|
||||
con1 {
|
||||
mode = transport
|
||||
ah_proposals = sha256-curve25519,sha256-ecp256
|
||||
esp_proposals =
|
||||
local_ts = 103.206.98.1[gre]
|
||||
remote_ts = 94.190.212.123[gre]
|
||||
start_action = none
|
||||
close_action = none
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
Loading…
Reference in New Issue