Compare commits
5 Commits
6a46388d68
...
568d6ccfb1
Author | SHA1 | Date |
---|---|---|
Egor Savkin | 568d6ccfb1 | |
Egor Savkin | a2d7b847a9 | |
Egor Savkin | 68d8deed73 | |
Egor Savkin | c70da9cac6 | |
Egor Savkin | 56577193f0 |
|
@ -216,6 +216,29 @@ in
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
greTunnels.intl0 = {
|
||||||
|
dev = netifWan;
|
||||||
|
remote = "5.78.86.156";
|
||||||
|
local = "94.190.212.123";
|
||||||
|
ttl = 255;
|
||||||
|
type = "tun";
|
||||||
|
};
|
||||||
|
interfaces.intl0 = {
|
||||||
|
ipv4.addresses = [
|
||||||
|
{
|
||||||
|
address = "5.78.86.156";
|
||||||
|
prefixLength = 32;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
ipv4.routes = [
|
||||||
|
{
|
||||||
|
address = "0.0.0.0";
|
||||||
|
prefixLength = 0;
|
||||||
|
via = "5.78.86.156";
|
||||||
|
options.table = "3";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
vlans = {
|
vlans = {
|
||||||
vlan0 = {
|
vlan0 = {
|
||||||
id = 2;
|
id = 2;
|
||||||
|
@ -263,6 +286,27 @@ in
|
||||||
start_action = "start";
|
start_action = "start";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
services.strongswan-swanctl.swanctl.connections.intl = {
|
||||||
|
local_addrs = [ "94.190.212.123" ];
|
||||||
|
remote_addrs = [ "5.78.86.156" ];
|
||||||
|
local.main = {
|
||||||
|
auth = "pubkey";
|
||||||
|
id = "fqdn:m-labs.hk";
|
||||||
|
pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
|
||||||
|
};
|
||||||
|
remote.main = {
|
||||||
|
auth = "pubkey";
|
||||||
|
id = "fqdn:m-labs-intl.com";
|
||||||
|
pubkeys = [ "/etc/swanctl/pubkey/m-labs-intl.com" ];
|
||||||
|
};
|
||||||
|
children.intl0 = {
|
||||||
|
mode = "transport";
|
||||||
|
ah_proposals = [ "sha256-curve25519" ];
|
||||||
|
remote_ts = [ "5.78.86.156[gre]" ];
|
||||||
|
local_ts = [ "94.190.212.123[gre]" ];
|
||||||
|
start_action = "start";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
systemd.services.network-custom-route-backup = {
|
systemd.services.network-custom-route-backup = {
|
||||||
wantedBy = [ "network.target" ];
|
wantedBy = [ "network.target" ];
|
||||||
|
@ -282,6 +326,15 @@ in
|
||||||
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
|
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
systemd.services.network-custom-route-intl = {
|
||||||
|
wantedBy = [ "network.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
ExecStart = "${pkgs.iproute2}/bin/ip rule add from 5.78.86.156/32 table 3";
|
||||||
|
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 3";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
# https://kb.isc.org/docs/dnssec-key-and-signing-policy
|
# https://kb.isc.org/docs/dnssec-key-and-signing-policy
|
||||||
# chown named.named /etc/nixos/named
|
# chown named.named /etc/nixos/named
|
||||||
|
@ -1177,6 +1230,18 @@ in
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
environment.etc."postfix/sender_relay".text = ''
|
||||||
|
m-labs-intl.com smtptun:
|
||||||
|
* :
|
||||||
|
'';
|
||||||
|
systemd.services.postfix-rebuild-sender-relay = {
|
||||||
|
description = "Postfix Rebuild Sender Dependent Relayhost Maps";
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = "${pkgs.postfix}/sbin/postmap /etc/postfix/sender_relay";
|
||||||
|
};
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
};
|
||||||
|
|
||||||
mailserver = {
|
mailserver = {
|
||||||
enable = true;
|
enable = true;
|
||||||
localDnsResolver = false; # conflicts with dnsmasq
|
localDnsResolver = false; # conflicts with dnsmasq
|
||||||
|
@ -1185,8 +1250,17 @@ in
|
||||||
enablePop3 = true;
|
enablePop3 = true;
|
||||||
enablePop3Ssl = true;
|
enablePop3Ssl = true;
|
||||||
certificateScheme = "acme-nginx";
|
certificateScheme = "acme-nginx";
|
||||||
policydSPFExtraConfig = "skip_addresses = 5.78.86.156,2a01:4ff:1f0:83de::1";
|
|
||||||
} // (import /etc/nixos/secret/email_settings.nix);
|
} // (import /etc/nixos/secret/email_settings.nix);
|
||||||
|
services.postfix = {
|
||||||
|
config = {
|
||||||
|
sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay";
|
||||||
|
masterConfig.smtptun = {
|
||||||
|
type = "smtp";
|
||||||
|
command = "smtp";
|
||||||
|
args = "-o smtp_bind_address=5.78.86.156";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
services.roundcube = {
|
services.roundcube = {
|
||||||
enable = true;
|
enable = true;
|
||||||
hostName = "mail.m-labs.hk";
|
hostName = "mail.m-labs.hk";
|
||||||
|
|
Loading…
Reference in New Issue