hosts/mermet/public-inbox.nix

   1 { lib, config, ... }:
   2 let
   3   inherit (config.services) public-inbox;
   4   inherit (config.users) groups;
   5   orga = "sourcephile";
   6   domain = "${orga}.fr";
   7   repositories = [
   8     "doclang"
   9     "majurity"
  10     "reloto"
  11     "haskell/symantic"
  12     "haskell/symantic-atom"
  13     "haskell/symantic-base"
  14     "haskell/symantic-cli"
  15     "haskell/symantic-compta"
  16     "haskell/symantic-document"
  17     "haskell/symantic-http"
  18     "haskell/symantic-parser"
  19     "haskell/symantic-xml"
  20   ];
  21 in
  22 # Pour supprimer un message :
  23   # curl https://mails.sourcephile.fr/inbox/environnement/8ea699887ca47797b4460053588cbef2d115829ab4@vieber.ru/raw |
  24   # sudo -u public-inbox public-inbox-learn rm
  25 {
  26   security.acme.certs."${domain}" = {
  27     postRun = "systemctl try-restart public-inbox-nntpd public-inbox-imapd";
  28   };
  29   networking.nftables.ruleset = ''
  30     table inet filter {
  31       chain input-net {
  32         tcp dport ${toString public-inbox.nntp.port} counter accept comment "public-inbox: NNTPS"
  33         tcp dport 1993 counter accept comment "public-inbox: IMAPS"
  34       }
  35       chain output-net {
  36       }
  37     }
  38   '';
  39   fileSystems."/var/lib/public-inbox" = {
  40     device = "rpool/var/public-inbox";
  41     fsType = "zfs";
  42   };
  43   systemd.services = {
  44     public-inbox-httpd = {
  45       confinement.enable = true;
  46       serviceConfig = {
  47         SupplementaryGroups = [ groups."git-daemon".name ];
  48         #BindReadOnlyPaths = [ "/var/lib/acme/${domain}" ];
  49       };
  50     };
  51     public-inbox-imapd = {
  52       confinement.enable = true;
  53       wants = [ "acme-selfsigned-${domain}.service" "acme-${domain}.service" ];
  54       after = [ "acme-selfsigned-${domain}.service" ];
  55       serviceConfig = {
  56         SupplementaryGroups = [ groups."acme".name ];
  57         BindReadOnlyPaths = [ "/var/lib/acme/${domain}" ];
  58       };
  59     };
  60     public-inbox-init = {
  61       confinement.enable = true;
  62     };
  63     public-inbox-nntpd = {
  64       confinement.enable = true;
  65       wants = [ "acme-selfsigned-${domain}.service" "acme-${domain}.service" ];
  66       after = [ "acme-selfsigned-${domain}.service" ];
  67       serviceConfig = {
  68         SupplementaryGroups = [ groups."acme".name ];
  69         BindReadOnlyPaths = [ "/var/lib/acme/${domain}" ];
  70       };
  71     };
  72   };
  73   services.public-inbox = {
  74     enable = true;
  75     postfix.enable = true;
  76     settings.publicinbox = {
  77       css = [ "href=https://mails.${domain}/style/light.css" ];
  78       nntpserver = [ "nntps://news.${domain}" ];
  79       wwwlisting = "match=domain";
  80       #imapserver = [ "mails.${domain}" ];
  81     };
  82     mda = {
  83       enable = true;
  84       args = [ "--no-precheck" ]; # Allow Bcc:
  85     };
  86     http = {
  87       enable = true;
  88       port = "/run/public-inbox-http.sock";
  89       #port = 8080;
  90       args = [ "-W0" ];
  91       mounts = [
  92         "https://mails.${domain}/inbox"
  93         "https://public-inbox.${domain}/inbox"
  94       ];
  95     };
  96     nntp = {
  97       enable = true;
  98       #port = 563;
  99       args = [ "-W0" ];
 100       cert = "/var/lib/acme/${domain}/fullchain.pem";
 101       key = "/var/lib/acme/${domain}/key.pem";
 102     };
 103     imap = {
 104       enable = true;
 105       # FIXME: find an IP or .onion to put 993
 106       port = null;
 107       args = [ "-W0" "--listen" "imaps://0.0.0.0:1993" ];
 108       #args = ["-W0"];
 109       cert = "/var/lib/acme/${domain}/fullchain.pem";
 110       key = "/var/lib/acme/${domain}/key.pem";
 111     };
 112     inboxes = {
 113       news = {
 114         address = [
 115           "news@${domain}"
 116         ];
 117         description = ''
 118           news@${domain} :
 119           annonces d'informations concernant importantes
 120         '';
 121         url = "https://mails.${domain}/inbox/news";
 122         newsgroup = "inbox.comp.${orga}.news";
 123         #coderepo = [ "sourcephile-txt" ];
 124       };
 125       chat = {
 126         address = [
 127           "chat@${domain}"
 128         ];
 129         description = ''
 130           chat@${domain} :
 131           discussions concernant l'informatique en général.
 132         '';
 133         url = "https://mails.${domain}/inbox/chat";
 134         newsgroup = "inbox.comp.${orga}.chat";
 135       };
 136       contact = {
 137         address = [
 138           "contact@${domain}"
 139         ];
 140         description = ''
 141           contact@${domain} :
 142           discussions avec le grand public.
 143         '';
 144         url = "https://mails.${domain}/inbox/contact";
 145         newsgroup = "inbox.comp.${orga}.contact";
 146         #coderepo = [ "${orga}" ];
 147       };
 148       environnement = {
 149         address = [
 150           "environnement@${domain}"
 151         ];
 152         description = ''
 153           environnement@${domain} :
 154           discussions sur les impacts environnementaux de l'informatique.
 155         '';
 156         url = "https://mails.${domain}/inbox/environnement";
 157         newsgroup = "inbox.comp.${orga}.environnement";
 158         #coderepo = [ "sourcephile-txt" ];
 159       };
 160       labo = {
 161         address = [
 162           "labo@${domain}"
 163         ];
 164         description = ''
 165           labo@${domain} :
 166           discussions concernant la science de l'informatique.
 167         '';
 168         url = "https://mails.${domain}/inbox/labo";
 169         newsgroup = "inbox.comp.${orga}.labo";
 170         # TODO: list many source code repositories
 171         #coderepo = [ "sourcephile-txt" ];
 172       };
 173       prod = {
 174         address = [
 175           "prod@${domain}"
 176         ];
 177         description = ''
 178           prod@${domain} :
 179           discussions concernant l'administration technique de l'infrastructure informatique.
 180         '';
 181         url = "https://mails.${domain}/inbox/prod";
 182         newsgroup = "inbox.comp.${orga}.prod";
 183         #coderepo = [ "sourcephile-txt" "sourcephile-nix" ];
 184       };
 185       orga = {
 186         address = [
 187           "orga@${domain}"
 188         ];
 189         description = ''
 190           orga@${domain} :
 191           discussions à l'attention de l'ensemble des personnes à bord.
 192         '';
 193         url = "https://mails.${domain}/inbox/orga";
 194         newsgroup = "inbox.comp.${orga}.orga";
 195         #coderepo = [ "sourcephile-txt" ];
 196       };
 197       test = {
 198         address = [
 199           "test@${domain}"
 200         ];
 201         description = ''
 202           test@${domain} :
 203           une cible de test pour effectuer des tirs de mails.
 204         '';
 205         url = "https://mails.${domain}/inbox/test";
 206         newsgroup = "inbox.comp.${orga}.test";
 207         hide = [ /* FIXME: doesn't work for IMAP */ "imap" "www" "manifest" ];
 208       };
 209     } // lib.genAttrs (map baseNameOf repositories) (name: {
 210       address = [
 211         "${name}@${domain}"
 212       ];
 213       description = ''
 214         ${name}@${domain} :
 215         discussions about ${name}.
 216       '';
 217       url = "https://mails.${domain}/inbox/${name}";
 218       newsgroup = "inbox.comp.${orga}.${name}";
 219       coderepo = [ name ];
 220     });
 221     settings.coderepo = {
 222       sourcephile-txt = {
 223         dir = "/var/lib/gitolite/repositories/sourcephile-txt.git";
 224         cgitUrl = "https://code.${domain}/sourcephile-txt.git";
 225       };
 226       sourcephile-nix = {
 227         dir = "/var/lib/gitolite/repositories/sourcephile-nix.git";
 228         cgitUrl = "https://code.${domain}/sourcephile-nix.git";
 229       };
 230     } // lib.listToAttrs (map
 231       (path: lib.nameValuePair (baseNameOf path) {
 232         dir = "/var/lib/gitolite/repositories/${path}.git";
 233         cgitUrl = "https://code.${domain}/${path}.git";
 234       })
 235       repositories);
 236   };
 237   services.sanoid.datasets."rpool/var/public-inbox" = {
 238     use_template = [ "snap" ];
 239     daily = 7;
 240   };
 241 }