losurdo: enable hardened profile

[sourcephile-nix.git] / servers / mermet / public-inbox.nix

diff --git a/servers/mermet/public-inbox.nix b/servers/mermet/public-inbox.nix
index a65c18b1c794f4175800af1bcfde02836d378254..c6b23d8ff471b1a0c9de2a6cf3750bd667e9ca53 100644 (file)
--- a/servers/mermet/public-inbox.nix
+++ b/servers/mermet/public-inbox.nix
@@ -3,6 +3,9 @@ let inherit (config.users) groups;
     domain = "sourcephile.fr";
 in
 {
+systemd.services.public-inbox-httpd = {
+  serviceConfig.SupplementaryGroups = [ groups."git-daemon".name ];
+};
 services.public-inbox = {
   enable = true;
   path = with pkgs; [ /*spamassassin*/ ];
@@ -10,13 +13,14 @@ services.public-inbox = {
   mda.spamCheck = null;
   watch.spamCheck = null;
 
-  #config.publicinbox.css =
-  #  [ "href=https://${domain}/lists/public-inbox.css" ];
-
   http.mounts = [
-    "https://public-inbox.${domain}/archives"
+    "https://mails.${domain}/inbox"
+    "https://public-inbox.${domain}/inbox"
   ];
   wwwListing = "match=domain";
+  config.publicinbox = {
+    css = [ "href=https://mails.${domain}/style/light.css" ];
+  };
 
   nntpServer = [ "nntps://news.${domain}" ];
   nntp.cert = "/var/lib/acme/${domain}/fullchain.pem";
@@ -24,91 +28,147 @@ services.public-inbox = {
   nntp.extraGroups = [ groups.acme.name ];
 
   inboxes = {
-    bistrot = {
+    atelier = {
       address = [
-        "public-inbox+bistrot@${domain}"
-        "bistrot@${domain}"
+        "atelier@${domain}"
+        "public-inbox+atelier@${domain}"
       ];
       description = ''
-        Discussions publiques sans sujet particulier,
-        simplement pour la camaraderie à bord de Sourcephile.
+        atelier@${domain} :
+        discussions concernant le développement logiciel.
       '';
-      url = "https://${domain}/mails/archives/bistrot";
-      newsgroup = "inbox.comp.sourcephile.bistrot";
+      url = "https://mails.${domain}/inbox/atelier";
+      newsgroup = "inbox.comp.sourcephile.atelier";
+      config.coderepo = [
+        "sourcephile-txt"
+        # TODO: list many source code repositories
+      ];
     };
-    entraide = {
+    bar = {
       address = [
-        "public-inbox+entraide@${domain}"
-        "entraide@${domain}"
+        "bar@${domain}"
+        "public-inbox+bar@${domain}"
       ];
       description = ''
-        Discussions publiques pour l'entraide à bord de Sourcephile.
+        bar@${domain} :
+        discussions concernant l'informatique en général.
       '';
-      url = "https://public-inbox.${domain}/archives/entraide";
-      newsgroup = "inbox.comp.sourcephile.entraide";
+      url = "https://mails.${domain}/inbox/bar";
+      newsgroup = "inbox.comp.sourcephile.bar";
     };
-    environnement = {
+    contact = {
       address = [
-        "public-inbox+environnement@${domain}"
-        "environnement@${domain}"
+        "contact@${domain}"
+        "public-inbox+contact@${domain}"
       ];
       description = ''
-        Discussions publiques pour se soucier de l'environnement
-        des activités de Sourcephile.
+        contact@${domain} :
+        discussions avec le grand public.
       '';
-      url = "https://public-inbox.${domain}/archives/environnement";
-      newsgroup = "inbox.comp.sourcephile.environnement";
+      url = "https://mails.${domain}/inbox/contact";
+      newsgroup = "inbox.comp.sourcephile.contact";
+      #config.coderepo = [ "sourcephile" ];
     };
-    infra = {
+    ecole = {
       address = [
-        "public-inbox+infra@${domain}"
-        "infra@${domain}"
+        "ecole@${domain}"
+        "public-inbox+ecole@${domain}"
+      ];
+      description = ''
+        ecole@${domain} :
+        discussions pour s'entraider en informatique.
+      '';
+      url = "https://mails.${domain}/inbox/ecole";
+      newsgroup = "inbox.comp.sourcephile.ecole";
+      config.coderepo = [ "sourcephile-txt" ];
+    };
+    environnement = {
+      address = [
+        "environnement@${domain}"
+        "public-inbox+environnement@${domain}"
       ];
       description = ''
-        Discussions publiques à propos de l'infrastructure,
-        notamment informatique, de Sourcephile.
+        environnement@${domain} :
+        discussions sur les impacts environnementaux de l'informatique.
       '';
-      url = "https://public-inbox.${domain}/archives/infra";
-      newsgroup = "inbox.comp.sourcephile.infra";
+      url = "https://mails.${domain}/inbox/environnement";
+      newsgroup = "inbox.comp.sourcephile.environnement";
+      config.coderepo = [ "sourcephile-txt" ];
     };
     labo = {
       address = [
-        "public-inbox+labo@${domain}"
         "labo@${domain}"
+        "public-inbox+labo@${domain}"
       ];
       description = ''
-        Discussions publiques concernant les recherches scientifiques
-        et développements informatiques de Sourcephile.
+        labo@${domain} :
+        discussions concernant la science de l'informatique.
       '';
-      url = "https://public-inbox.${domain}/archives/labo";
+      url = "https://mails.${domain}/inbox/labo";
       newsgroup = "inbox.comp.sourcephile.labo";
+      config.coderepo = [
+        "sourcephile-txt"
+        # TODO: list many source code repositories
+      ];
     };
-    membres = {
+    machines = {
       address = [
-        "public-inbox+membres@${domain}"
-        "membres@${domain}"
+        "machines@${domain}"
+        "public-inbox+machines@${domain}"
       ];
       description = ''
-        Discussions ou annonces publiques à l'attention
-        de l'ensemble des personnes à bord de Sourcephile.
+        machines@${domain} :
+        discussions concernant l'administration technique de l'infrastructure informatique.
       '';
-      url = "https://public-inbox.${domain}/archives/membres";
-      newsgroup = "inbox.comp.sourcephile.membres";
-      #config.coderepo = [ "sourcephile" ];
+      url = "https://mails.${domain}/inbox/machines";
+      newsgroup = "inbox.comp.sourcephile.machines";
+      config.coderepo = [ "sourcephile-txt" "sourcephile-nix" ];
+    };
+    pont = {
+      address = [
+        "pont@${domain}"
+        "public-inbox+pont@${domain}"
+      ];
+      description = ''
+        pont@${domain} :
+        discussions à l'attention de l'ensemble des personnes à bord.
+      '';
+      url = "https://mails.${domain}/inbox/pont";
+      newsgroup = "inbox.comp.sourcephile.pont";
+      config.coderepo = [ "sourcephile-txt" ];
+    };
+    test = {
+      address = [
+        "test@${domain}"
+        "public-inbox+test@${domain}"
+      ];
+      description = ''
+        test@${domain} :
+        une cible de test pour effectuer des tirs de mails.
+      '';
+      url = "https://mails.${domain}/inbox/test";
+      newsgroup = "inbox.comp.sourcephile.test";
+      config = {
+        hide = [ "www" "manifest" ];
+      };
     };
   };
 
-  /*
-  config.coderepo.sourcephile-nix = {
-    dir = "/var/lib/git/repositories/sourcephile.git";
-    cgitUrl = "https://${domain}/git/sourcephile";
+  config.coderepo = {
+    sourcephile-txt = {
+      dir = "/var/lib/gitolite/repositories/sourcephile-txt.git";
+      cgitUrl = "https://code.${domain}/sourcephile-txt.git";
+    };
+    sourcephile-nix = {
+      dir = "/var/lib/gitolite/repositories/sourcephile-nix.git";
+      cgitUrl = "https://code.${domain}/sourcephile-nix.git";
+    };
   };
-  */
 };
 security.acme.certs."${domain}" = {
-  postRun = "systemctl reload public-inbox-nntp";
+  postRun = "systemctl restart public-inbox-nntpd";
 };
-systemd.services.public-inbox = {
+systemd.services.public-inbox-nntpd = {
   wants = [ "acme-selfsigned-${domain}.service" "acme-${domain}.service"];
   after = [ "acme-selfsigned-${domain}.service" ];
 };