hosts/mermet/public-inbox.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config.services) public-inbox;
   4   inherit (config.users) groups;
   5   orga = "sourcephile";
   6   domain = "${orga}.fr";
   7   inboxes = [
   8     "doclang"
   9     "majurity"
  10     "reloto"
  11     "symantic"
  12     "symantic-atom"
  13     "symantic-base"
  14     "symantic-cli"
  15     "symantic-compta"
  16     "symantic-document"
  17     "symantic-http"
  18     "symantic-parser"
  19     "symantic-xml"
  20   ];
  21 in
  22 # Pour supprimer un message :
  23 # curl https://mails.sourcephile.fr/inbox/environnement/8ea699887ca47797b4460053588cbef2d115829ab4@vieber.ru/raw |
  24 # sudo -u public-inbox public-inbox-learn rm
  25 {
  26 security.acme.certs."${domain}" = {
  27   postRun = "systemctl try-restart public-inbox-nntpd public-inbox-imapd";
  28 };
  29 networking.nftables.ruleset = ''
  30   add rule inet filter net2fw tcp dport ${toString public-inbox.nntp.port} counter accept comment "NNTPS"
  31   add rule inet filter net2fw tcp dport 1993 counter accept comment "IMAPS"
  32 '';
  33 fileSystems."/var/lib/public-inbox" = {
  34   device = "rpool/var/public-inbox";
  35   fsType = "zfs";
  36 };
  37 systemd.services = {
  38   public-inbox-httpd = {
  39     serviceConfig = {
  40       SupplementaryGroups = [ groups."git-daemon".name ];
  41       BindReadOnlyPaths = [ "/var/lib/acme/${domain}" ];
  42     };
  43   };
  44   public-inbox-imapd = {
  45     wants = [ "acme-selfsigned-${domain}.service" "acme-${domain}.service"];
  46     after = [ "acme-selfsigned-${domain}.service" ];
  47     serviceConfig = {
  48       SupplementaryGroups = [ groups."acme".name ];
  49       BindReadOnlyPaths = [ "/var/lib/acme/${domain}" ];
  50     };
  51   };
  52   public-inbox-nntpd = {
  53     wants = [ "acme-selfsigned-${domain}.service" "acme-${domain}.service"];
  54     after = [ "acme-selfsigned-${domain}.service" ];
  55     serviceConfig = {
  56       SupplementaryGroups = [ groups."acme".name ];
  57       BindReadOnlyPaths = [ "/var/lib/acme/${domain}" ];
  58     };
  59   };
  60 };
  61 services.public-inbox = {
  62   enable = true;
  63   settings.publicinbox = {
  64     css = [ "href=https://mails.${domain}/style/light.css" ];
  65     nntpserver = [ "nntps://news.${domain}" ];
  66     wwwlisting = "match=domain";
  67   };
  68   mda = {
  69     enable = true;
  70     args = [ "--no-precheck" ]; # Allow Bcc:
  71   };
  72   http = {
  73     enable = true;
  74     port = "/run/public-inbox-http.sock";
  75     #port = 8080;
  76     args = ["-W0"];
  77     mounts = [
  78       "https://mails.${domain}/inbox"
  79       "https://public-inbox.${domain}/inbox"
  80     ];
  81   };
  82   nntp = {
  83     enable = true;
  84     #port = 563;
  85     args = ["-W0"];
  86     cert = "/var/lib/acme/${domain}/fullchain.pem";
  87     key = "/var/lib/acme/${domain}/key.pem";
  88   };
  89   imap = {
  90     enable = true;
  91     # FIXME: find an IP or .onion to put 993
  92     port = null;
  93     args = [ "-W0" "--listen" "imaps://0.0.0.0:1993" ];
  94     #args = ["-W0"];
  95     cert = "/var/lib/acme/${domain}/fullchain.pem";
  96     key = "/var/lib/acme/${domain}/key.pem";
  97   };
  98   inboxes = {
  99     news = {
 100       address = [
 101         "news@${domain}"
 102         "public-inbox+news@${domain}"
 103       ];
 104       description = ''
 105         news@${domain} :
 106         annonces d'informations concernant importantes
 107       '';
 108       url = "https://mails.${domain}/inbox/news";
 109       newsgroup = "inbox.comp.${orga}.news";
 110       #coderepo = [ "sourcephile-txt" ];
 111     };
 112     chat = {
 113       address = [
 114         "chat@${domain}"
 115         "public-inbox+chat@${domain}"
 116       ];
 117       description = ''
 118         chat@${domain} :
 119         discussions concernant l'informatique en général.
 120       '';
 121       url = "https://mails.${domain}/inbox/chat";
 122       newsgroup = "inbox.comp.${orga}.chat";
 123     };
 124     contact = {
 125       address = [
 126         "contact@${domain}"
 127         "public-inbox+contact@${domain}"
 128       ];
 129       description = ''
 130         contact@${domain} :
 131         discussions avec le grand public.
 132       '';
 133       url = "https://mails.${domain}/inbox/contact";
 134       newsgroup = "inbox.comp.${orga}.contact";
 135       #coderepo = [ "${orga}" ];
 136     };
 137     environnement = {
 138       address = [
 139         "environnement@${domain}"
 140         "public-inbox+environnement@${domain}"
 141       ];
 142       description = ''
 143         environnement@${domain} :
 144         discussions sur les impacts environnementaux de l'informatique.
 145       '';
 146       url = "https://mails.${domain}/inbox/environnement";
 147       newsgroup = "inbox.comp.${orga}.environnement";
 148       #coderepo = [ "sourcephile-txt" ];
 149     };
 150     labo = {
 151       address = [
 152         "labo@${domain}"
 153         "public-inbox+labo@${domain}"
 154       ];
 155       description = ''
 156         labo@${domain} :
 157         discussions concernant la science de l'informatique.
 158       '';
 159       url = "https://mails.${domain}/inbox/labo";
 160       newsgroup = "inbox.comp.${orga}.labo";
 161       # TODO: list many source code repositories
 162       #coderepo = [ "sourcephile-txt" ];
 163     };
 164     prod = {
 165       address = [
 166         "prod@${domain}"
 167         "public-inbox+prod@${domain}"
 168       ];
 169       description = ''
 170         prod@${domain} :
 171         discussions concernant l'administration technique de l'infrastructure informatique.
 172       '';
 173       url = "https://mails.${domain}/inbox/prod";
 174       newsgroup = "inbox.comp.${orga}.prod";
 175       #coderepo = [ "sourcephile-txt" "sourcephile-nix" ];
 176     };
 177     orga = {
 178       address = [
 179         "orga@${domain}"
 180         "public-inbox+orga@${domain}"
 181       ];
 182       description = ''
 183         orga@${domain} :
 184         discussions à l'attention de l'ensemble des personnes à bord.
 185       '';
 186       url = "https://mails.${domain}/inbox/orga";
 187       newsgroup = "inbox.comp.${orga}.orga";
 188       #coderepo = [ "sourcephile-txt" ];
 189     };
 190     test = {
 191       address = [
 192         "test@${domain}"
 193         "public-inbox+test@${domain}"
 194       ];
 195       description = ''
 196         test@${domain} :
 197         une cible de test pour effectuer des tirs de mails.
 198       '';
 199       url = "https://mails.${domain}/inbox/test";
 200       newsgroup = "inbox.comp.${orga}.test";
 201       hide = [ /* FIXME: doesn't work for IMAP */"imap" "www" "manifest" ];
 202     };
 203   } // lib.genAttrs inboxes (name: {
 204     address = [
 205       "${name}@${domain}"
 206       "public-inbox+${name}@${domain}"
 207     ];
 208     description = ''
 209       ${name}@${domain} :
 210       discussions concernant ${name}.
 211     '';
 212     url = "https://mails.${domain}/inbox/${name}";
 213     newsgroup = "inbox.comp.${orga}.${name}";
 214     coderepo = [ name ];
 215   });
 216   settings.coderepo = {
 217     sourcephile-txt = {
 218       dir = "/var/lib/gitolite/repositories/sourcephile-txt.git";
 219       cgitUrl = "https://code.${domain}/sourcephile-txt.git";
 220     };
 221     sourcephile-nix = {
 222       dir = "/var/lib/gitolite/repositories/sourcephile-nix.git";
 223       cgitUrl = "https://code.${domain}/sourcephile-nix.git";
 224     };
 225   } // lib.genAttrs inboxes (name: {
 226     dir = "/var/lib/gitolite/repositories/${name}.git";
 227     cgitUrl = "https://code.${domain}/${name}.git";
 228   });
 229 };
 230 services.postfix.virtual = lib.concatMapStringsSep "\n" (name: ''
 231   ${name}@${domain} public-inbox@localhost
 232 '') inboxes;
 233 services.sanoid.datasets."rpool/var/public-inbox" = {
 234   use_template = [ "local" ];
 235   daily = 7;
 236 };
 237 }