base/postfix: remove, base:nullmailer: init #151
@@ -30,9 +30,9 @@
|
||||
./services/journald-upload.nix
|
||||
./services/logrotate.nix
|
||||
./services/nginx.nix
|
||||
./services/nullmailer.nix
|
||||
./services/openssh.nix
|
||||
./services/polkit.nix
|
||||
./services/postfix.nix
|
||||
./services/prometheus-flake-input-exporter.nix
|
||||
./services/prometheus-node-exporter.nix
|
||||
./services/prometheus-systemd-exporter.nix
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
services.nullmailer = {
|
||||
enable = true;
|
||||
|
||||
config = {
|
||||
adminaddr = "root@pvv.ntnu.no";
|
||||
|
felixalb marked this conversation as resolved
Outdated
|
||||
defaultdomain = "pvv.ntnu.no";
|
||||
defaulthost = "pvv.ntnu.no";
|
||||
|
||||
me = lib.mkDefault config.networking.fqdn;
|
||||
remotes = lib.mkDefault "smtp.pvv.ntnu.no smtp port=465 tls";
|
||||
|
oysteikt marked this conversation as resolved
Outdated
felixalb
commented
Don't use starttls if it is at all possible to use TLS properly. See https://wiki.pvv.ntnu.no/wiki/Tjenester/Epost/Autentisert_SMTP and https://datatracker.ietf.org/doc/html/rfc8314, use SMTP over TLS on port 465. Don't use starttls if it is at all possible to use TLS properly. See https://wiki.pvv.ntnu.no/wiki/Tjenester/Epost/Autentisert_SMTP and https://datatracker.ietf.org/doc/html/rfc8314, use SMTP over TLS on port 465.
oysteikt
commented
I took this from the suggested config in I took this from the suggested config in https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/commit/d59a3f6ec090d2cdb17ded5d553ae233af808817/hosts/bekkalokk/services/well-known/root/autoconfig/mail/config-v1.1.xml, should we update this file as well? I'll make a separate issue
felixalb
commented
Yes, I think we should always advertise SSL/TLS from the beginning when possible. Yes, I think we should always advertise SSL/TLS from the beginning when possible.
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.postfix;
|
||||
in
|
||||
{
|
||||
services.postfix = {
|
||||
enable = true;
|
||||
|
||||
settings.main = {
|
||||
myhostname = "${config.networking.hostName}.pvv.ntnu.no";
|
||||
mydomain = "pvv.ntnu.no";
|
||||
|
||||
# Nothing should be delivered to this machine
|
||||
mydestination = [ ];
|
||||
|
||||
relayhost = [ "smtp.pvv.ntnu.no:465" ];
|
||||
|
||||
smtp_tls_wrappermode = "yes";
|
||||
smtp_tls_security_level = "encrypt";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,14 +1,13 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
services.postfix.enable = lib.mkForce false;
|
||||
assertions = [{
|
||||
|
felixalb marked this conversation as resolved
Outdated
felixalb
commented
Is this line necessary, is nullmailer not enabled by default already through /base/? Is this line necessary, is nullmailer not enabled by default already through /base/?
oysteikt
commented
It is not, I left it as a sort of assertion. If someone does anything that ends up disabling nullmailer, it should cause build-time problems for temmie, not runtime problems. I could rewrite it as a nix module assertion instead if that is clearer? It is not, I left it as a sort of assertion. If someone does anything that ends up disabling nullmailer, it should cause build-time problems for temmie, not runtime problems. I could rewrite it as a nix module assertion instead if that is clearer?
felixalb
commented
Putting it in the module sounds even weirder, but why would someone do that, what plausible situation are we guarding against? Putting it in the module sounds even weirder, but why would someone do that, what plausible situation are we guarding against?
oysteikt
commented
Sorry, I don't think I was clear. Should I rewrite the line as the following? I'm trying to enforce a strict dependency for temmie on nullmailer so that it will be obvious if someone tries to adjust the base in the future. A sort of "sure, go ahead and remove nullmailer or switch it out, but do make sure temmie userweb still works" type of check. Sorry, I don't think I was clear. Should I rewrite the line as the following?
```
assertions = [{
assertion = services.nullmailer.enable;
message = "nullmailer needs to be enabled in order for temmie userweb to work correctly";
}];
```
I'm trying to enforce a strict dependency for temmie on nullmailer so that it will be obvious if someone tries to adjust the base in the future. A sort of "sure, go ahead and remove nullmailer or switch it out, but do make sure temmie userweb still works" type of check.
felixalb
commented
Sure, if we need to require that specifically, disallowing other sendmail implementations, that looks good Sure, if we need to require that specifically, disallowing other sendmail implementations, that looks good
oysteikt
commented
I don't wanna bet on it at least > [...] if we need to require that specifically, disallowing other sendmail implementations [...]
I don't wanna bet on it at least
|
||||
assertion = config.services.nullmailer.enable;
|
||||
message = ''
|
||||
Expected nullmailer to be enabled for temmie userweb.
|
||||
|
||||
services.nullmailer = {
|
||||
enable = true;
|
||||
config = {
|
||||
me = config.networking.fqdn;
|
||||
remotes = "mail.pvv.ntnu.no smtp --port=25";
|
||||
};
|
||||
};
|
||||
If you change the default sendmail implementation, please make sure that temmie userweb works correctly!
|
||||
'';
|
||||
}];
|
||||
|
||||
services.bro = {
|
||||
enable = true;
|
||||
|
||||
Insta-resolve if too irrelevant, it is a digression, but should we label this better, like use
root+${config.networking.hostName}or something for easy sorting?I do think you get this info from the address in the
From:field, but sure?Sure, it is probably more standard/predictable to keep this as is, oops