From ffa70c499c5a6000ebb63e1b729de82f5253c055 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Benjamin=20B=C3=A4dorf?= Date: Thu, 20 Jul 2023 22:16:25 +0200 Subject: [PATCH] Fix droppie --- flake.nix | 2 +- hosts/droppie/droppie.nix | 3 +- hosts/droppie/hardware-configuration.nix | 5 - hosts/flora-6/caddy.nix | 99 ---- hosts/flora-6/concourse.nix | 105 ---- hosts/flora-6/default.nix | 5 - hosts/flora-6/drone.nix | 110 ---- hosts/flora-6/flora-6.nix | 146 ----- hosts/flora-6/gitea.nix | 72 --- hosts/flora-6/hardware-configuration.nix | 44 -- hosts/flora-6/keycloak.nix | 29 - hosts/flora-6/mailman.nix | 143 ----- hosts/flora-6/postfix/main.cf | 692 ----------------------- hosts/flora-6/triton-vmtools.nix | 9 - 14 files changed, 3 insertions(+), 1461 deletions(-) delete mode 100644 hosts/flora-6/caddy.nix delete mode 100644 hosts/flora-6/concourse.nix delete mode 100644 hosts/flora-6/default.nix delete mode 100644 hosts/flora-6/drone.nix delete mode 100644 hosts/flora-6/flora-6.nix delete mode 100644 hosts/flora-6/gitea.nix delete mode 100644 hosts/flora-6/hardware-configuration.nix delete mode 100644 hosts/flora-6/keycloak.nix delete mode 100644 hosts/flora-6/mailman.nix delete mode 100644 hosts/flora-6/postfix/main.cf delete mode 100644 hosts/flora-6/triton-vmtools.nix diff --git a/flake.nix b/flake.nix index b2290734..fe71b9cb 100644 --- a/flake.nix +++ b/flake.nix @@ -187,7 +187,7 @@ deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations { droppie = { - sshUser = "yule"; + sshUser = "root"; }; nougat-2 = { sshUser = "yule"; diff --git a/hosts/droppie/droppie.nix b/hosts/droppie/droppie.nix index ba54cb1f..2273d6d2 100644 --- a/hosts/droppie/droppie.nix +++ b/hosts/droppie/droppie.nix @@ -39,7 +39,8 @@ in { domains = ["backup.b12f.io"]; server = "ddns.hosting.de"; username = "b12f"; - use = "web, web=http://checkip6.spdyn.de/, web-skip=''"; + protocol = "dyndns2"; + use = "web, web=https://ipcheck-ds.wieistmeineip.de/callback/, web-skip='\\\\(\\\\{\"ip\":\"'"; passwordFile = "/run/agenix/dyndns-droppie.key"; }; diff --git a/hosts/droppie/hardware-configuration.nix b/hosts/droppie/hardware-configuration.nix index 34b2c02b..d51cfed7 100644 --- a/hosts/droppie/hardware-configuration.nix +++ b/hosts/droppie/hardware-configuration.nix @@ -32,11 +32,6 @@ fsType = "ext4"; }; - fileSystems."/home" = { - device = "/dev/disk/by-uuid/2ef980f1-1f27-4d2a-9789-00f45e791fcc"; - fsType = "xfs"; - }; - swapDevices = [{device = "/dev/disk/by-uuid/0203b641-280f-4a3d-971d-fd32a666c852";}]; # Enables DHCP on each ethernet and wireless interface. In case of scripted networking diff --git a/hosts/flora-6/caddy.nix b/hosts/flora-6/caddy.nix deleted file mode 100644 index 648bfe33..00000000 --- a/hosts/flora-6/caddy.nix +++ /dev/null @@ -1,99 +0,0 @@ -{ - config, - lib, - pkgs, - self, - ... -}: { - services.caddy = { - enable = lib.mkForce true; - group = "hakkonaut"; - email = "admins@pub.solar"; - globalConfig = lib.mkForce ""; - virtualHosts = { - "pub.solar" = { - logFormat = lib.mkForce '' - output discard - ''; - extraConfig = '' - # PubSolarOS images - handle /os/download/* { - root * /srv/www - file_server /os/download/* browse - } - # serve base domain pub.solar for mastodon.pub.solar - # https://masto.host/mastodon-usernames-different-from-the-domain-used-for-installation/ - handle /.well-known/host-meta { - redir https://mastodon.pub.solar{uri} - } - # pub.solar website - handle { - root * /srv/www/pub.solar - try_files {path}.html {path} - file_server - } - # minimal error handling, respond with status code and text - handle_errors { - respond "{http.error.status_code} {http.error.status_text}" - } - ''; - }; - "www.pub.solar" = { - logFormat = lib.mkForce '' - output discard - ''; - extraConfig = '' - redir https://pub.solar{uri} - ''; - }; - "auth.pub.solar" = { - logFormat = lib.mkForce '' - output discard - ''; - extraConfig = '' - redir / /realms/pub.solar/account temporary - reverse_proxy :8080 - ''; - }; - "git.pub.solar" = { - logFormat = lib.mkForce '' - output discard - ''; - extraConfig = '' - redir /user/login /user/oauth2/keycloak temporary - reverse_proxy :3000 - ''; - }; - "ci.pub.solar" = { - logFormat = lib.mkForce '' - output discard - ''; - extraConfig = '' - reverse_proxy :4000 - ''; - }; - "list.pub.solar" = { - logFormat = lib.mkForce '' - output discard - ''; - extraConfig = '' - handle_path /static/* { - root * /var/lib/mailman/web - file_server - } - - reverse_proxy :8000 - ''; - }; - "obs-portal.pub.solar" = { - logFormat = lib.mkForce '' - output discard - ''; - extraConfig = '' - reverse_proxy obs-portal.svc.e5756d08-36fd-424b-f8bc-acdb92ca7b82.lev-1.int.greenbaum.zone:3000 - ''; - }; - }; - }; - networking.firewall.allowedTCPPorts = [80 443]; -} diff --git a/hosts/flora-6/concourse.nix b/hosts/flora-6/concourse.nix deleted file mode 100644 index 9bc1fe91..00000000 --- a/hosts/flora-6/concourse.nix +++ /dev/null @@ -1,105 +0,0 @@ -{ - config, - lib, - pkgs, - self, - ... -}: let - pubsolarDomain = import ./pubsolar-domain.nix; - - getSecret = name: - lib.attrsets.setAttrByPath [name] { - file = "${self}/secrets/${name}.age"; - mode = "600"; - owner = "concourse"; - }; - - keys = [ - "concourse-session-signing-key" - "concourse-worker-key" - "concourse-tsa-host-key" - ]; - - secrets = - [ - "concourse-secrets" - "concourse-db-secrets" - ] - ++ keys; -in { - age.secrets = lib.lists.foldl (a: b: a // getSecret b) {} secrets; - - users.users.concourse = { - description = "Concourse Service"; - home = "/var/lib/concourse"; - useDefaultShell = true; - uid = 10001; - group = "concourse"; - isSystemUser = true; - }; - - users.groups.concourse = {}; - - systemd.tmpfiles.rules = [ - "d '/var/lib/concourse' 0750 concourse concourse - -" - ]; - - virtualisation.oci-containers = { - containers."concourse-db" = { - image = "postgres:14"; - autoStart = true; - user = "994"; - volumes = [ - "/data/concourse/db:/var/lib/postgresql/data" - ]; - extraOptions = [ - "--network=concourse-net" - ]; - environmentFiles = [ - config.age.secrets.concourse-db-secrets.path - ]; - }; - - containers."concourse" = { - image = "concourse/concourse:7.9.1"; - autoStart = true; - user = "10001"; - ports = [ - "8080:8080" - ]; - dependsOn = ["concourse-db"]; - extraOptions = [ - "--network=concourse-net" - ]; - volumes = [ - "${config.age.secrets.concourse-session-signing-key.path}:/keys/session_signing_key" - "${config.age.secrets.concourse-worker-key.path}:/keys/worker_key" - "${config.age.secrets.concourse-tsa-host-key.path}:/keys/tsa_host_key" - ]; - - environment = { - CONCOURSE_EXTERNAL_URL = "https://ci.${pubsolarDomain}"; - - CONCOURSE_ADD_LOCAL_USER = "crew:changeme"; - CONCOURSE_MAIN_TEAM_LOCAL_USER = "crew"; - - # instead of relying on the default "detect" - CONCOURSE_WORKER_BAGGAGECLAIM_DRIVER = "overlay"; - CONCOURSE_X_FRAME_OPTIONS = "allow"; - CONCOURSE_CONTENT_SECURITY_POLICY = "*"; - CONCOURSE_CLUSTER_NAME = "pub.solar"; - CONCOURSE_WORKER_CONTAINERD_DNS_SERVER = "8.8.8.8"; - - CONCOURSE_SESSION_SIGNING_KEY = "/keys/session_signing_key"; - CONCOURSE_TSA_HOST_KEY = "/keys/tsa_host_key"; - CONCOURSE_TSA_AUTHORIZED_KEYS = "/keys/worker_key"; - - # For ARM-based machine, change the Concourse runtime to "houdini" - CONCOURSE_WORKER_RUNTIME = "containerd"; - }; - environmentFiles = [ - config.age.secrets.concourse-secrets.path - ]; - }; - }; -} diff --git a/hosts/flora-6/default.nix b/hosts/flora-6/default.nix deleted file mode 100644 index 98269bfe..00000000 --- a/hosts/flora-6/default.nix +++ /dev/null @@ -1,5 +0,0 @@ -{...}: { - imports = [ - ./flora-6.nix - ]; -} diff --git a/hosts/flora-6/drone.nix b/hosts/flora-6/drone.nix deleted file mode 100644 index 8b7dd693..00000000 --- a/hosts/flora-6/drone.nix +++ /dev/null @@ -1,110 +0,0 @@ -{ - config, - lib, - pkgs, - self, - ... -}: { - age.secrets.drone-secrets = { - file = "${self}/secrets/drone-secrets.age"; - mode = "600"; - owner = "drone"; - }; - age.secrets.drone-db-secrets = { - file = "${self}/secrets/drone-db-secrets.age"; - mode = "600"; - owner = "drone"; - }; - - users.users.drone = { - description = "Drone Service"; - home = "/var/lib/drone"; - useDefaultShell = true; - uid = 994; - group = "drone"; - isSystemUser = true; - }; - - users.groups.drone = {}; - - systemd.tmpfiles.rules = [ - "d '/var/lib/drone-db' 0750 drone drone - -" - ]; - - system.activationScripts.mkDroneNet = let - docker = config.virtualisation.oci-containers.backend; - dockerBin = "${pkgs.${docker}}/bin/${docker}"; - in '' - ${dockerBin} network inspect drone-net >/dev/null 2>&1 || ${dockerBin} network create drone-net --subnet 172.20.0.0/24 - ''; - - virtualisation = { - docker = { - enable = true; # sadly podman is not supported rightnow - extraOptions = '' - --data-root /data/docker - ''; - }; - - oci-containers = { - backend = "docker"; - containers."drone-db" = { - image = "postgres:14"; - autoStart = true; - user = "994"; - volumes = [ - "/var/lib/drone-db:/var/lib/postgresql/data" - ]; - extraOptions = [ - "--network=drone-net" - ]; - environmentFiles = [ - config.age.secrets.drone-db-secrets.path - ]; - }; - containers."drone-server" = { - image = "drone/drone:2"; - autoStart = true; - user = "994"; - ports = [ - "4000:80" - ]; - dependsOn = ["drone-db"]; - extraOptions = [ - "--network=drone-net" - ]; - environment = { - DRONE_GITEA_SERVER = "https://git.pub.solar"; - DRONE_SERVER_HOST = "ci.pub.solar"; - DRONE_SERVER_PROTO = "https"; - DRONE_DATABASE_DRIVER = "postgres"; - }; - environmentFiles = [ - config.age.secrets.drone-secrets.path - ]; - }; - containers."drone-docker-runner" = { - image = "drone/drone-runner-docker:1"; - autoStart = true; - # needs to run as root - #user = "994"; - volumes = [ - "/var/run/docker.sock:/var/run/docker.sock" - ]; - dependsOn = ["drone-db"]; - extraOptions = [ - "--network=drone-net" - ]; - environment = { - DRONE_RPC_HOST = "ci.pub.solar"; - DRONE_RPC_PROTO = "https"; - DRONE_RUNNER_CAPACITY = "2"; - DRONE_RUNNER_NAME = "flora-6-docker-runner"; - }; - environmentFiles = [ - config.age.secrets.drone-secrets.path - ]; - }; - }; - }; -} diff --git a/hosts/flora-6/flora-6.nix b/hosts/flora-6/flora-6.nix deleted file mode 100644 index d7c59716..00000000 --- a/hosts/flora-6/flora-6.nix +++ /dev/null @@ -1,146 +0,0 @@ -{ - config, - latestModulesPath, - lib, - inputs, - pkgs, - profiles, - self, - ... -}: let - psCfg = config.pub-solar; -in { - imports = [ - # Include the results of the hardware scan. - ./hardware-configuration.nix - ./triton-vmtools.nix - - ./caddy.nix - ./drone.nix - ./keycloak.nix - ./gitea.nix - ./mailman.nix - - profiles.base-user - profiles.users.root # make sure to configure ssh keys - profiles.users.barkeeper - - "${latestModulesPath}/services/misc/gitea.nix" - ]; - disabledModules = [ - "services/misc/gitea.nix" - ]; - - config = { - # # # - # # # pub.solar options - # # # - pub-solar.core = { - disk-encryption-active = false; - iso-options.enable = true; - lite = true; - }; - - # Allow sudo without a password for the barkeeper user - security.sudo.extraRules = [ - { - users = ["${psCfg.user.name}"]; - commands = [ - { - command = "ALL"; - options = ["NOPASSWD"]; - } - ]; - } - ]; - - # Machine user for CI pipelines - users.users.hakkonaut = { - description = "CI and automation user"; - home = "/var/nix/iso-cache"; - useDefaultShell = true; - uid = 998; - group = "hakkonaut"; - isSystemUser = true; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW hakkonaut@flora-6" - ]; - }; - - users.groups.hakkonaut = {}; - - # # # - # # # Triton host specific options - # # # DO NOT ALTER below this line, changes might render system unbootable - # # # - - # Use the systemd-boot EFI boot loader. - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - - # Force getting the hostname from cloud-init - networking.hostName = lib.mkDefault ""; - - # Set your time zone. - time.timeZone = "Europe/Berlin"; - - # Select internationalisation properties. - console = { - font = "Lat2-Terminus16"; - keyMap = "us"; - }; - - # List packages installed in system profile. To search, run: - # $ nix search wget - environment.systemPackages = with pkgs; [ - git - vim - wget - ]; - - # Some programs need SUID wrappers, can be configured further or are - # started in user sessions. - # programs.mtr.enable = true; - # programs.gnupg.agent = { - # enable = true; - # enableSSHSupport = true; - # }; - - # List services that you want to enable: - services.cloud-init.enable = true; - services.cloud-init.ext4.enable = true; - services.cloud-init.network.enable = true; - # use the default NixOS cloud-init config, but add some SmartOS customization to it - environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = '' - datasource_list: [ SmartOS ] - - # Do not create the centos/ubuntu/debian user - users: [ ] - - # mount second disk with label ephemeral0, gets formated by cloud-init - # this will fail to get added to /etc/fstab as it's read-only, but should - # mount at boot anyway - mounts: - - [ vdb, /data, auto, "defaults,nofail" ] - ''; - - # Enable the OpenSSH daemon. - services.openssh = { - enable = true; - passwordAuthentication = false; - permitRootLogin = "no"; - }; - - # We manage the firewall with nix, too - # altough triton can also manage firewall rules via the triton fwrule subcommand - networking.firewall.enable = true; - - # This value determines the NixOS release from which the default - # settings for stateful data, like file locations and database versions - # on your system were taken. It‘s perfectly fine and recommended to leave - # this value at the release version of the first install of this system. - # Before changing this value read the documentation for this option - # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). - system.stateVersion = "22.05"; # Did you read the comment? - }; -} diff --git a/hosts/flora-6/gitea.nix b/hosts/flora-6/gitea.nix deleted file mode 100644 index 091be889..00000000 --- a/hosts/flora-6/gitea.nix +++ /dev/null @@ -1,72 +0,0 @@ -{ - config, - lib, - pkgs, - self, - ... -}: { - age.secrets.gitea-database-password = { - file = "${self}/secrets/gitea-database-password.age"; - mode = "600"; - owner = "gitea"; - }; - age.secrets.gitea-mailer-password = { - file = "${self}/secrets/gitea-mailer-password.age"; - mode = "600"; - owner = "gitea"; - }; - - # gitea - services.gitea = { - enable = true; - appName = "pub.solar git server"; - database = { - type = "postgres"; - passwordFile = config.age.secrets.gitea-database-password.path; - }; - domain = "git.pub.solar"; - httpAddress = "127.0.0.1"; - httpPort = 3000; - lfs.enable = true; - mailerPasswordFile = config.age.secrets.gitea-mailer-password.path; - rootUrl = "https://git.pub.solar"; - settings = { - mailer = { - ENABLED = true; - MAILER_TYPE = "smtp"; - HOST = "mx2.greenbaum.cloud:465"; - FROM = ''"pub.solar git server" ''; - USER = "admins@pub.solar"; - }; - # currently broken, gpg core dumps - #"repository.signing" = { - # SIGNING_KEY = "default"; - # MERGES = "always"; - #}; - openid = { - ENABLE_OPENID_SIGNIN = true; - ENABLE_OPENID_SIGNUP = true; - }; - # uncomment after initial deployment, first user is admin user - # required to setup SSO (oauth openid-connect, keycloak auth provider) - service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true; - session.COOKIE_SECURE = lib.mkForce true; - }; - }; - - # Required for gitea server side gpg signatures - # configured / setup manually in - # /var/lib/gitea/data/home/.gitconfig and - # /var/lib/gitea/data/home/.gnupg/ - programs.gnupg.agent = { - enable = true; - pinentryFlavor = "curses"; - }; - # Required to make gpg work without a graphical environment? - # otherwise generating a new gpg key fails with this error: - # gpg: agent_genkey failed: No pinentry - # see: https://github.com/NixOS/nixpkgs/issues/97861#issuecomment-827951675 - environment.variables = { - GPG_TTY = "$(tty)"; - }; -} diff --git a/hosts/flora-6/hardware-configuration.nix b/hosts/flora-6/hardware-configuration.nix deleted file mode 100644 index be3cc858..00000000 --- a/hosts/flora-6/hardware-configuration.nix +++ /dev/null @@ -1,44 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ - config, - lib, - pkgs, - modulesPath, - ... -}: { - imports = []; - - boot.initrd.availableKernelModules = ["ahci" "virtio_pci" "xhci_pci" "sr_mod" "virtio_blk"]; - boot.initrd.kernelModules = []; - boot.kernelModules = []; - boot.extraModulePackages = []; - - fileSystems."/" = { - device = "/dev/disk/by-label/nixos"; - autoResize = true; - fsType = "ext4"; - }; - - fileSystems."/boot" = { - device = "/dev/disk/by-label/boot"; - fsType = "vfat"; - }; - - fileSystems."/data" = { - device = "/dev/disk/by-label/ephemeral0"; - fsType = "ext4"; - options = [ - "defaults" - "nofail" - ]; - }; - - swapDevices = []; - - networking.useDHCP = lib.mkDefault false; - networking.networkmanager.enable = lib.mkForce false; - - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} diff --git a/hosts/flora-6/keycloak.nix b/hosts/flora-6/keycloak.nix deleted file mode 100644 index 14f91bfc..00000000 --- a/hosts/flora-6/keycloak.nix +++ /dev/null @@ -1,29 +0,0 @@ -{ - config, - lib, - inputs, - pkgs, - self, - ... -}: { - age.secrets.keycloak-database-password = { - file = "${self}/secrets/keycloak-database-password.age"; - mode = "700"; - #owner = "keycloak"; - }; - - # keycloak - services.keycloak = { - enable = true; - database.passwordFile = config.age.secrets.keycloak-database-password.path; - settings = { - hostname = "auth.pub.solar"; - http-host = "127.0.0.1"; - http-port = 8080; - proxy = "edge"; - }; - themes = { - "pub.solar" = inputs.keycloak-theme-pub-solar.legacyPackages.${pkgs.system}.keycloak-theme-pub-solar; - }; - }; -} diff --git a/hosts/flora-6/mailman.nix b/hosts/flora-6/mailman.nix deleted file mode 100644 index 2bbc0866..00000000 --- a/hosts/flora-6/mailman.nix +++ /dev/null @@ -1,143 +0,0 @@ -{ - config, - lib, - pkgs, - self, - ... -}: let - postfixConfig = pkgs.writeTextFile { - name = "main.cf"; - text = builtins.readFile ./postfix/main.cf; - }; -in { - system.activationScripts.mkMailmanNet = let - docker = config.virtualisation.oci-containers.backend; - dockerBin = "${pkgs.${docker}}/bin/${docker}"; - in '' - ${dockerBin} network inspect mailman-net >/dev/null 2>&1 || ${dockerBin} network create mailman-net --subnet 172.20.1.0/24 - ''; - - users.users.mailman = { - description = "Mailman Service"; - home = "/var/lib/mailman"; - useDefaultShell = true; - uid = 993; - # Group hakkonaut so caddy can serve the static files from mailman-web directly - group = "hakkonaut"; - isSystemUser = true; - }; - - systemd.tmpfiles.rules = [ - "d '/var/lib/mailman' 0750 mailman hakkonaut - -" - ]; - - age.secrets.mailman-core-secrets = { - file = "${self}/secrets/mailman-core-secrets.age"; - mode = "600"; - owner = "mailman"; - }; - - age.secrets.mailman-web-secrets = { - file = "${self}/secrets/mailman-web-secrets.age"; - mode = "600"; - owner = "mailman"; - }; - - age.secrets.mailman-db-secrets = { - file = "${self}/secrets/mailman-db-secrets.age"; - mode = "600"; - owner = "mailman"; - }; - - virtualisation = { - docker = { - enable = true; - }; - - oci-containers = { - backend = "docker"; - containers."mailman-core" = { - image = "maxking/mailman-core:0.4"; - autoStart = true; - user = "993"; - volumes = [ - "/var/lib/mailman/core:/opt/mailman/" - ]; - extraOptions = [ - "--network=mailman-net" - ]; - environment = { - DATABASE_TYPE = "postgres"; - DATABASE_CLASS = "mailman.database.postgresql.PostgreSQLDatabase"; - MTA = "postfix"; - }; - environmentFiles = [ - config.age.secrets.mailman-core-secrets.path - ]; - ports = [ - "127.0.0.1:8001:8001" # API - "127.0.0.1:8024:8024" # LMTP - incoming emails - ]; - }; - - containers."mailman-web" = { - image = "maxking/mailman-web:0.4"; - autoStart = true; - user = "993"; - volumes = [ - "/var/lib/mailman/web:/opt/mailman-web-data" - ]; - extraOptions = [ - "--network=mailman-net" - ]; - environment = { - DATABASE_TYPE = "postgres"; - SERVE_FROM_DOMAIN = "list.pub.solar"; - MAILMAN_ADMIN_USER = "admin"; - MAILMAN_ADMIN_EMAIL = "admins@pub.solar"; - }; - environmentFiles = [ - config.age.secrets.mailman-web-secrets.path - ]; - ports = [ - "127.0.0.1:8000:8000" # HTTP - # "127.0.0.1:8080:8080" # uwsgi - ]; - }; - - containers."mailman-db" = { - image = "postgres:14-alpine"; - autoStart = true; - user = "993"; - extraOptions = [ - "--network=mailman-net" - ]; - volumes = [ - "/var/lib/mailman/database:/var/lib/postgresql/data" - ]; - environmentFiles = [ - config.age.secrets.mailman-db-secrets.path - ]; - }; - - containers."mailman-postfix" = { - image = "mailu/postfix:1.9.46"; - autoStart = true; - user = "993"; - extraOptions = [ - "--network=mailman-net" - ]; - volumes = [ - "/var/lib/mailman/postfix/overrides:/overrides:ro" - "/var/lib/mailman/postfix/mailqueue:/var/spool/postfix" - "/var/lib/mailman/postfix/data:/var/lib/postfix" - "/var/lib/mailman/core:/var/lib/mailman/core" - "${postfixConfig}:/etc/postfix/main.cf" - ]; - environmentFiles = [ - config.age.secrets.mailman-db-secrets.path - ]; - }; - }; - }; -} diff --git a/hosts/flora-6/postfix/main.cf b/hosts/flora-6/postfix/main.cf deleted file mode 100644 index 56fb7947..00000000 --- a/hosts/flora-6/postfix/main.cf +++ /dev/null @@ -1,692 +0,0 @@ -# Global Postfix configuration file. This file lists only a subset -# of all parameters. For the syntax, and for a complete parameter -# list, see the postconf(5) manual page (command: "man 5 postconf"). -# -# For common configuration examples, see BASIC_CONFIGURATION_README -# and STANDARD_CONFIGURATION_README. To find these documents, use -# the command "postconf html_directory readme_directory", or go to -# http://www.postfix.org/BASIC_CONFIGURATION_README.html etc. -# -# For best results, change no more than 2-3 parameters at a time, -# and test if Postfix still works after every change. - -# COMPATIBILITY -# -# The compatibility_level determines what default settings Postfix -# will use for main.cf and master.cf settings. These defaults will -# change over time. -# -# To avoid breaking things, Postfix will use backwards-compatible -# default settings and log where it uses those old backwards-compatible -# default settings, until the system administrator has determined -# if any backwards-compatible default settings need to be made -# permanent in main.cf or master.cf. -# -# When this review is complete, update the compatibility_level setting -# below as recommended in the RELEASE_NOTES file. -# -# The level below is what should be used with new (not upgrade) installs. -# -compatibility_level = 3.6 - -# SOFT BOUNCE -# -# The soft_bounce parameter provides a limited safety net for -# testing. When soft_bounce is enabled, mail will remain queued that -# would otherwise bounce. This parameter disables locally-generated -# bounces, and prevents the SMTP server from rejecting mail permanently -# (by changing 5xx replies into 4xx replies). However, soft_bounce -# is no cure for address rewriting mistakes or mail routing mistakes. -# -#soft_bounce = no - -# LOCAL PATHNAME INFORMATION -# -# The queue_directory specifies the location of the Postfix queue. -# This is also the root directory of Postfix daemons that run chrooted. -# See the files in examples/chroot-setup for setting up Postfix chroot -# environments on different UNIX systems. -# -queue_directory = /var/spool/postfix - -# The command_directory parameter specifies the location of all -# postXXX commands. -# -command_directory = /usr/sbin - -# The daemon_directory parameter specifies the location of all Postfix -# daemon programs (i.e. programs listed in the master.cf file). This -# directory must be owned by root. -# -daemon_directory = /usr/libexec/postfix - -# The data_directory parameter specifies the location of Postfix-writable -# data files (caches, random numbers). This directory must be owned -# by the mail_owner account (see below). -# -data_directory = /var/lib/postfix - -# QUEUE AND PROCESS OWNERSHIP -# -# The mail_owner parameter specifies the owner of the Postfix queue -# and of most Postfix daemon processes. Specify the name of a user -# account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS -# AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM. In -# particular, don't specify nobody or daemon. PLEASE USE A DEDICATED -# USER. -# -mail_owner = postfix - -# The default_privs parameter specifies the default rights used by -# the local delivery agent for delivery to external file or command. -# These rights are used in the absence of a recipient user context. -# DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER. -# -#default_privs = nobody - -# INTERNET HOST AND DOMAIN NAMES -# -# The myhostname parameter specifies the internet hostname of this -# mail system. The default is to use the fully-qualified domain name -# from gethostname(). $myhostname is used as a default value for many -# other configuration parameters. -# -myhostname = list.pub.solar -#myhostname = virtual.domain.tld - -# The mydomain parameter specifies the local internet domain name. -# The default is to use $myhostname minus the first component. -# $mydomain is used as a default value for many other configuration -# parameters. -# -#mydomain = domain.tld - -# SENDING MAIL -# -# The myorigin parameter specifies the domain that locally-posted -# mail appears to come from. The default is to append $myhostname, -# which is fine for small sites. If you run a domain with multiple -# machines, you should (1) change this to $mydomain and (2) set up -# a domain-wide alias database that aliases each user to -# user@that.users.mailhost. -# -# For the sake of consistency between sender and recipient addresses, -# myorigin also specifies the default domain name that is appended -# to recipient addresses that have no @domain part. -# -#myorigin = $myhostname -#myorigin = $mydomain - -# RECEIVING MAIL - -# The inet_interfaces parameter specifies the network interface -# addresses that this mail system receives mail on. By default, -# the software claims all active interfaces on the machine. The -# parameter also controls delivery of mail to user@[ip.address]. -# -# See also the proxy_interfaces parameter, for network addresses that -# are forwarded to us via a proxy or network address translator. -# -# Note: you need to stop/start Postfix when this parameter changes. -# -#inet_interfaces = all -#inet_interfaces = $myhostname -#inet_interfaces = $myhostname, localhost - -# The proxy_interfaces parameter specifies the network interface -# addresses that this mail system receives mail on by way of a -# proxy or network address translation unit. This setting extends -# the address list specified with the inet_interfaces parameter. -# -# You must specify your proxy/NAT addresses when your system is a -# backup MX host for other domains, otherwise mail delivery loops -# will happen when the primary MX host is down. -# -#proxy_interfaces = -#proxy_interfaces = 1.2.3.4 - -# The mydestination parameter specifies the list of domains that this -# machine considers itself the final destination for. -# -# These domains are routed to the delivery agent specified with the -# local_transport parameter setting. By default, that is the UNIX -# compatible delivery agent that lookups all recipients in /etc/passwd -# and /etc/aliases or their equivalent. -# -# The default is $myhostname + localhost.$mydomain + localhost. On -# a mail domain gateway, you should also include $mydomain. -# -# Do not specify the names of virtual domains - those domains are -# specified elsewhere (see VIRTUAL_README). -# -# Do not specify the names of domains that this machine is backup MX -# host for. Specify those names via the relay_domains settings for -# the SMTP server, or use permit_mx_backup if you are lazy (see -# STANDARD_CONFIGURATION_README). -# -# The local machine is always the final destination for mail addressed -# to user@[the.net.work.address] of an interface that the mail system -# receives mail on (see the inet_interfaces parameter). -# -# Specify a list of host or domain names, /file/name or type:table -# patterns, separated by commas and/or whitespace. A /file/name -# pattern is replaced by its contents; a type:table is matched when -# a name matches a lookup key (the right-hand side is ignored). -# Continue long lines by starting the next line with whitespace. -# -# See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS". -# -#mydestination = $myhostname, localhost.$mydomain, localhost -#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain -#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, -# mail.$mydomain, www.$mydomain, ftp.$mydomain - -# REJECTING MAIL FOR UNKNOWN LOCAL USERS -# -# The local_recipient_maps parameter specifies optional lookup tables -# with all names or addresses of users that are local with respect -# to $mydestination, $inet_interfaces or $proxy_interfaces. -# -# If this parameter is defined, then the SMTP server will reject -# mail for unknown local users. This parameter is defined by default. -# -# To turn off local recipient checking in the SMTP server, specify -# local_recipient_maps = (i.e. empty). -# -# The default setting assumes that you use the default Postfix local -# delivery agent for local delivery. You need to update the -# local_recipient_maps setting if: -# -# - You define $mydestination domain recipients in files other than -# /etc/passwd, /etc/aliases, or the $virtual_alias_maps files. -# For example, you define $mydestination domain recipients in -# the $virtual_mailbox_maps files. -# -# - You redefine the local delivery agent in master.cf. -# -# - You redefine the "local_transport" setting in main.cf. -# -# - You use the "luser_relay", "mailbox_transport", or "fallback_transport" -# feature of the Postfix local delivery agent (see local(8)). -# -# Details are described in the LOCAL_RECIPIENT_README file. -# -# Beware: if the Postfix SMTP server runs chrooted, you probably have -# to access the passwd file via the proxymap service, in order to -# overcome chroot restrictions. The alternative, having a copy of -# the system passwd file in the chroot jail is just not practical. -# -# The right-hand side of the lookup tables is conveniently ignored. -# In the left-hand side, specify a bare username, an @domain.tld -# wild-card, or specify a user@domain.tld address. -# -#local_recipient_maps = unix:passwd.byname $alias_maps -#local_recipient_maps = proxy:unix:passwd.byname $alias_maps -#local_recipient_maps = - -# The unknown_local_recipient_reject_code specifies the SMTP server -# response code when a recipient domain matches $mydestination or -# ${proxy,inet}_interfaces, while $local_recipient_maps is non-empty -# and the recipient address or address local-part is not found. -# -# The default setting is 550 (reject mail) but it is safer to start -# with 450 (try again later) until you are certain that your -# local_recipient_maps settings are OK. -# -# unknown_local_recipient_reject_code = 550 - -# TRUST AND RELAY CONTROL - -# The mynetworks parameter specifies the list of "trusted" SMTP -# clients that have more privileges than "strangers". -# -# In particular, "trusted" SMTP clients are allowed to relay mail -# through Postfix. See the smtpd_recipient_restrictions parameter -# in postconf(5). -# -# You can specify the list of "trusted" network addresses by hand -# or you can let Postfix do it for you (which is the default). -# -# By default (mynetworks_style = subnet), Postfix "trusts" SMTP -# clients in the same IP subnetworks as the local machine. -# On Linux, this works correctly only with interfaces specified -# with the "ifconfig" command. -# -# Specify "mynetworks_style = class" when Postfix should "trust" SMTP -# clients in the same IP class A/B/C networks as the local machine. -# Don't do this with a dialup site - it would cause Postfix to "trust" -# your entire provider's network. Instead, specify an explicit -# mynetworks list by hand, as described below. -# -# Specify "mynetworks_style = host" when Postfix should "trust" -# only the local machine. -# -#mynetworks_style = class -#mynetworks_style = subnet -#mynetworks_style = host - -# Alternatively, you can specify the mynetworks list by hand, in -# which case Postfix ignores the mynetworks_style setting. -# -# Specify an explicit list of network/netmask patterns, where the -# mask specifies the number of bits in the network part of a host -# address. -# -# You can also specify the absolute pathname of a pattern file instead -# of listing the patterns here. Specify type:table for table-based lookups -# (the value on the table right-hand side is not used). -# -mynetworks = mailman-core,mailman-web -#mynetworks = $config_directory/mynetworks -#mynetworks = hash:/etc/postfix/network_table - -# The relay_domains parameter restricts what destinations this system will -# relay mail to. See the smtpd_recipient_restrictions description in -# postconf(5) for detailed information. -# -# By default, Postfix relays mail -# - from "trusted" clients (IP address matches $mynetworks) to any destination, -# - from "untrusted" clients to destinations that match $relay_domains or -# subdomains thereof, except addresses with sender-specified routing. -# The default relay_domains value is $mydestination. -# -# In addition to the above, the Postfix SMTP server by default accepts mail -# that Postfix is final destination for: -# - destinations that match $inet_interfaces or $proxy_interfaces, -# - destinations that match $mydestination -# - destinations that match $virtual_alias_domains, -# - destinations that match $virtual_mailbox_domains. -# These destinations do not need to be listed in $relay_domains. -# -# Specify a list of hosts or domains, /file/name patterns or type:name -# lookup tables, separated by commas and/or whitespace. Continue -# long lines by starting the next line with whitespace. A file name -# is replaced by its contents; a type:name table is matched when a -# (parent) domain appears as lookup key. -# -# NOTE: Postfix will not automatically forward mail for domains that -# list this system as their primary or backup MX host. See the -# permit_mx_backup restriction description in postconf(5). -# -#relay_domains = $mydestination - -# INTERNET OR INTRANET - -# The relayhost parameter specifies the default host to send mail to -# when no entry is matched in the optional transport(5) table. When -# no relayhost is given, mail is routed directly to the destination. -# -# On an intranet, specify the organizational domain name. If your -# internal DNS uses no MX records, specify the name of the intranet -# gateway host instead. -# -# In the case of SMTP, specify a domain, host, host:port, [host]:port, -# [address] or [address]:port; the form [host] turns off MX lookups. -# -# If you're connected via UUCP, see also the default_transport parameter. -# -#relayhost = $mydomain -#relayhost = [gateway.my.domain] -#relayhost = [mailserver.isp.tld] -#relayhost = uucphost -#relayhost = [an.ip.add.ress] - -# REJECTING UNKNOWN RELAY USERS -# -# The relay_recipient_maps parameter specifies optional lookup tables -# with all addresses in the domains that match $relay_domains. -# -# If this parameter is defined, then the SMTP server will reject -# mail for unknown relay users. This feature is off by default. -# -# The right-hand side of the lookup tables is conveniently ignored. -# In the left-hand side, specify an @domain.tld wild-card, or specify -# a user@domain.tld address. -# -#relay_recipient_maps = hash:/etc/postfix/relay_recipients - -# INPUT RATE CONTROL -# -# The in_flow_delay configuration parameter implements mail input -# flow control. This feature is turned on by default, although it -# still needs further development (it's disabled on SCO UNIX due -# to an SCO bug). -# -# A Postfix process will pause for $in_flow_delay seconds before -# accepting a new message, when the message arrival rate exceeds the -# message delivery rate. With the default 100 SMTP server process -# limit, this limits the mail inflow to 100 messages a second more -# than the number of messages delivered per second. -# -# Specify 0 to disable the feature. Valid delays are 0..10. -# -#in_flow_delay = 1s - -# ADDRESS REWRITING -# -# The ADDRESS_REWRITING_README document gives information about -# address masquerading or other forms of address rewriting including -# username->Firstname.Lastname mapping. - -# ADDRESS REDIRECTION (VIRTUAL DOMAIN) -# -# The VIRTUAL_README document gives information about the many forms -# of domain hosting that Postfix supports. - -# "USER HAS MOVED" BOUNCE MESSAGES -# -# See the discussion in the ADDRESS_REWRITING_README document. - -# TRANSPORT MAP -# -# See the discussion in the ADDRESS_REWRITING_README document. - -# ALIAS DATABASE -# -# The alias_maps parameter specifies the list of alias databases used -# by the local delivery agent. The default list is system dependent. -# -# On systems with NIS, the default is to search the local alias -# database, then the NIS alias database. See aliases(5) for syntax -# details. -# -# If you change the alias database, run "postalias /etc/aliases" (or -# wherever your system stores the mail alias file), or simply run -# "newaliases" to build the necessary DBM or DB file. -# -# It will take a minute or so before changes become visible. Use -# "postfix reload" to eliminate the delay. -# -#alias_maps = dbm:/etc/aliases -#alias_maps = hash:/etc/aliases -#alias_maps = hash:/etc/aliases, nis:mail.aliases -#alias_maps = netinfo:/aliases - -# The alias_database parameter specifies the alias database(s) that -# are built with "newaliases" or "sendmail -bi". This is a separate -# configuration parameter, because alias_maps (see above) may specify -# tables that are not necessarily all under control by Postfix. -# -#alias_database = dbm:/etc/aliases -#alias_database = dbm:/etc/mail/aliases -#alias_database = hash:/etc/aliases -#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases - -# ADDRESS EXTENSIONS (e.g., user+foo) -# -# The recipient_delimiter parameter specifies the separator between -# user names and address extensions (user+foo). See canonical(5), -# local(8), relocated(5) and virtual(5) for the effects this has on -# aliases, canonical, virtual, relocated and .forward file lookups. -# Basically, the software tries user+foo and .forward+foo before -# trying user and .forward. -# -#recipient_delimiter = + - -# DELIVERY TO MAILBOX -# -# The home_mailbox parameter specifies the optional pathname of a -# mailbox file relative to a user's home directory. The default -# mailbox file is /var/spool/mail/user or /var/mail/user. Specify -# "Maildir/" for qmail-style delivery (the / is required). -# -#home_mailbox = Mailbox -#home_mailbox = Maildir/ - -# The mail_spool_directory parameter specifies the directory where -# UNIX-style mailboxes are kept. The default setting depends on the -# system type. -# -#mail_spool_directory = /var/mail -#mail_spool_directory = /var/spool/mail - -# The mailbox_command parameter specifies the optional external -# command to use instead of mailbox delivery. The command is run as -# the recipient with proper HOME, SHELL and LOGNAME environment settings. -# Exception: delivery for root is done as $default_user. -# -# Other environment variables of interest: USER (recipient username), -# EXTENSION (address extension), DOMAIN (domain part of address), -# and LOCAL (the address localpart). -# -# Unlike other Postfix configuration parameters, the mailbox_command -# parameter is not subjected to $parameter substitutions. This is to -# make it easier to specify shell syntax (see example below). -# -# Avoid shell meta characters because they will force Postfix to run -# an expensive shell process. Procmail alone is expensive enough. -# -# IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN -# ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER. -# -#mailbox_command = /some/where/procmail -#mailbox_command = /some/where/procmail -a "$EXTENSION" - -# The mailbox_transport specifies the optional transport in master.cf -# to use after processing aliases and .forward files. This parameter -# has precedence over the mailbox_command, fallback_transport and -# luser_relay parameters. -# -# Specify a string of the form transport:nexthop, where transport is -# the name of a mail delivery transport defined in master.cf. The -# :nexthop part is optional. For more details see the sample transport -# configuration file. -# -# NOTE: if you use this feature for accounts not in the UNIX password -# file, then you must update the "local_recipient_maps" setting in -# the main.cf file, otherwise the SMTP server will reject mail for -# non-UNIX accounts with "User unknown in local recipient table". -# -# Cyrus IMAP over LMTP. Specify ``lmtpunix cmd="lmtpd" -# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf. -#mailbox_transport = lmtp:unix:/var/imap/socket/lmtp -# -# Cyrus IMAP via command line. Uncomment the "cyrus...pipe" and -# subsequent line in master.cf. -#mailbox_transport = cyrus - -# The fallback_transport specifies the optional transport in master.cf -# to use for recipients that are not found in the UNIX passwd database. -# This parameter has precedence over the luser_relay parameter. -# -# Specify a string of the form transport:nexthop, where transport is -# the name of a mail delivery transport defined in master.cf. The -# :nexthop part is optional. For more details see the sample transport -# configuration file. -# -# NOTE: if you use this feature for accounts not in the UNIX password -# file, then you must update the "local_recipient_maps" setting in -# the main.cf file, otherwise the SMTP server will reject mail for -# non-UNIX accounts with "User unknown in local recipient table". -# -#fallback_transport = lmtp:unix:/file/name -#fallback_transport = cyrus -#fallback_transport = - -# The luser_relay parameter specifies an optional destination address -# for unknown recipients. By default, mail for unknown@$mydestination, -# unknown@[$inet_interfaces] or unknown@[$proxy_interfaces] is returned -# as undeliverable. -# -# The following expansions are done on luser_relay: $user (recipient -# username), $shell (recipient shell), $home (recipient home directory), -# $recipient (full recipient address), $extension (recipient address -# extension), $domain (recipient domain), $local (entire recipient -# localpart), $recipient_delimiter. Specify ${name?value} or -# ${name:value} to expand value only when $name does (does not) exist. -# -# luser_relay works only for the default Postfix local delivery agent. -# -# NOTE: if you use this feature for accounts not in the UNIX password -# file, then you must specify "local_recipient_maps =" (i.e. empty) in -# the main.cf file, otherwise the SMTP server will reject mail for -# non-UNIX accounts with "User unknown in local recipient table". -# -#luser_relay = $user@other.host -#luser_relay = $local@other.host -#luser_relay = admin+$local - -# JUNK MAIL CONTROLS -# -# The controls listed here are only a very small subset. The file -# SMTPD_ACCESS_README provides an overview. - -# The header_checks parameter specifies an optional table with patterns -# that each logical message header is matched against, including -# headers that span multiple physical lines. -# -# By default, these patterns also apply to MIME headers and to the -# headers of attached messages. With older Postfix versions, MIME and -# attached message headers were treated as body text. -# -# For details, see "man header_checks". -# -#header_checks = regexp:/etc/postfix/header_checks - -# FAST ETRN SERVICE -# -# Postfix maintains per-destination logfiles with information about -# deferred mail, so that mail can be flushed quickly with the SMTP -# "ETRN domain.tld" command, or by executing "sendmail -qRdomain.tld". -# See the ETRN_README document for a detailed description. -# -# The fast_flush_domains parameter controls what destinations are -# eligible for this service. By default, they are all domains that -# this server is willing to relay mail to. -# -#fast_flush_domains = $relay_domains - -# SHOW SOFTWARE VERSION OR NOT -# -# The smtpd_banner parameter specifies the text that follows the 220 -# code in the SMTP server's greeting banner. Some people like to see -# the mail version advertised. By default, Postfix shows no version. -# -# You MUST specify $myhostname at the start of the text. That is an -# RFC requirement. Postfix itself does not care. -# -#smtpd_banner = $myhostname ESMTP $mail_name -#smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) - -# PARALLEL DELIVERY TO THE SAME DESTINATION -# -# How many parallel deliveries to the same user or domain? With local -# delivery, it does not make sense to do massively parallel delivery -# to the same user, because mailbox updates must happen sequentially, -# and expensive pipelines in .forward files can cause disasters when -# too many are run at the same time. With SMTP deliveries, 10 -# simultaneous connections to the same domain could be sufficient to -# raise eyebrows. -# -# Each message delivery transport has its XXX_destination_concurrency_limit -# parameter. The default is $default_destination_concurrency_limit for -# most delivery transports. For the local delivery agent the default is 2. - -#local_destination_concurrency_limit = 2 -#default_destination_concurrency_limit = 20 - -# DEBUGGING CONTROL -# -# The debug_peer_level parameter specifies the increment in verbose -# logging level when an SMTP client or server host name or address -# matches a pattern in the debug_peer_list parameter. -# -debug_peer_level = 2 - -# The debug_peer_list parameter specifies an optional list of domain -# or network patterns, /file/name patterns or type:name tables. When -# an SMTP client or server host name or address matches a pattern, -# increase the verbose logging level by the amount specified in the -# debug_peer_level parameter. -# -#debug_peer_list = 127.0.0.1 -#debug_peer_list = some.domain - -# The debugger_command specifies the external command that is executed -# when a Postfix daemon program is run with the -D option. -# -# Use "command .. & sleep 5" so that the debugger can attach before -# the process marches on. If you use an X-based debugger, be sure to -# set up your XAUTHORITY environment variable before starting Postfix. -# -debugger_command = - PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin - ddd $daemon_directory/$process_name $process_id & sleep 5 - -# If you can't use X, use this to capture the call stack when a -# daemon crashes. The result is in a file in the configuration -# directory, and is named after the process name and the process ID. -# -# debugger_command = -# PATH=/bin:/usr/bin:/usr/local/bin; export PATH; (echo cont; -# echo where) | gdb $daemon_directory/$process_name $process_id 2>&1 -# >$config_directory/$process_name.$process_id.log & sleep 5 -# -# Another possibility is to run gdb under a detached screen session. -# To attach to the screen session, su root and run "screen -r -# " where uniquely matches one of the detached -# sessions (from "screen -list"). -# -# debugger_command = -# PATH=/bin:/usr/bin:/sbin:/usr/sbin; export PATH; screen -# -dmS $process_name gdb $daemon_directory/$process_name -# $process_id & sleep 1 - -# INSTALL-TIME CONFIGURATION INFORMATION -# -# The following parameters are used when installing a new Postfix version. -# -# sendmail_path: The full pathname of the Postfix sendmail command. -# This is the Sendmail-compatible mail posting interface. -# -sendmail_path = /usr/sbin/sendmail - -# newaliases_path: The full pathname of the Postfix newaliases command. -# This is the Sendmail-compatible command to build alias databases. -# -newaliases_path = /usr/bin/newaliases - -# mailq_path: The full pathname of the Postfix mailq command. This -# is the Sendmail-compatible mail queue listing command. -# -mailq_path = /usr/bin/mailq - -# setgid_group: The group for mail submission and queue management -# commands. This must be a group name with a numerical group ID that -# is not shared with other accounts, not even with the Postfix account. -# -setgid_group = postdrop - -# html_directory: The location of the Postfix HTML documentation. -# -html_directory = no - -# manpage_directory: The location of the Postfix on-line manual pages. -# -manpage_directory = /usr/share/man - -# sample_directory: The location of the Postfix sample configuration files. -# This parameter is obsolete as of Postfix 2.1. -# -sample_directory = /etc/postfix - -# readme_directory: The location of the Postfix README files. -# -readme_directory = /usr/share/doc/postfix/readme -inet_protocols = ipv4 -meta_directory = /etc/postfix -shlib_directory = /usr/lib/postfix - - -# Config below taken and adapted from -# https://github.com/maxking/docker-mailman#postfix -recipient_delimiter = + -unknown_local_recipient_reject_code = 550 -owner_request_special = no - -transport_maps = - regexp:/var/lib/mailman/core/var/data/postfix_lmtp -local_recipient_maps = - regexp:/var/lib/mailman/core/var/data/postfix_lmtp -relay_domains = - regexp:/var/lib/mailman/core/var/data/postfix_domains diff --git a/hosts/flora-6/triton-vmtools.nix b/hosts/flora-6/triton-vmtools.nix deleted file mode 100644 index 19b838d2..00000000 --- a/hosts/flora-6/triton-vmtools.nix +++ /dev/null @@ -1,9 +0,0 @@ -{ - pkgs, - inputs, - ... -}: { - environment.systemPackages = with pkgs; [ - inputs.triton-vmtools.packages.${pkgs.system}.default - ]; -}