From 0881db09a38a7c34a39467a55e19a3147384d0c2 Mon Sep 17 00:00:00 2001 From: Martin Milata Date: Thu, 18 Jul 2019 19:47:15 +0200 Subject: [PATCH 1/2] Sympa lists.try.otevrenamesta.cz test setup --- machines/mail.nix | 19 +++++++++++ machines/mesta-libvirt.nix | 2 ++ machines/sympa.nix | 65 +++++++++++++++++++++++++++++--------- morph.nix | 12 +++++++ 4 files changed, 83 insertions(+), 15 deletions(-) diff --git a/machines/mail.nix b/machines/mail.nix index 5642e74..f655ed3 100644 --- a/machines/mail.nix +++ b/machines/mail.nix @@ -37,5 +37,24 @@ #"abuse@try.otevrenamesta.cz" = "user1@try.otevrenamesta.cz"; }; + ## this was needed when sympa was hosting lists on @try.otevrenamesta.cz + #policydSPFExtraConfig = '' + # Whitelist = 192.168.122.101/32 + #''; + }; + + services.postfix = { + # relay ML domains to sympa & allow sympa to send outgoing email + networks = [ "192.168.122.101/32" ]; + relayDomains = [ "lists.try.otevrenamesta.cz" ]; + transport = '' + lists.try.otevrenamesta.cz relay:[192.168.122.101] + ''; + # aliases for mailing lists + virtual = '' + wwwybor@try.otevrenamesta.cz wwwybor@lists.try.otevrenamesta.cz + vratnice@try.otevrenamesta.cz vratnice@lists.try.otevrenamesta.cz + ustredna@try.otevrenamesta.cz ustredna@lists.try.otevrenamesta.cz + ''; }; } diff --git a/machines/mesta-libvirt.nix b/machines/mesta-libvirt.nix index 32121a2..1f0d665 100644 --- a/machines/mesta-libvirt.nix +++ b/machines/mesta-libvirt.nix @@ -15,6 +15,8 @@ { destination = "192.168.122.100:12340"; sourcePort = 12340;} # mail dovecot { destination = "192.168.122.101:22"; sourcePort = 10122;} # sympa ssh + { destination = "192.168.122.101:80"; sourcePort = 80;} # sympa http + { destination = "192.168.122.101:443"; sourcePort = 443;} # sympa https { destination = "192.168.122.102:22"; sourcePort = 10222;} # midpoint ssh diff --git a/machines/sympa.nix b/machines/sympa.nix index 81d62c4..5d44edb 100644 --- a/machines/sympa.nix +++ b/machines/sympa.nix @@ -6,28 +6,63 @@ #php gcc gnumake - perl528Packages.Appcpanminus ]; networking = { - #firewall.allowedTCPPorts = [ 80 ]; + firewall.allowedTCPPorts = [ 80 25 443 ]; domain = "otevrenamesta.cz"; hostName = "lists"; }; - #services.nginx.virtualHosts."webmail.otevrenamesta.cz" = { - # forceSSL = false; - # enableACME = false; - #}; - # - #services.postgresql.enable = true; - #services.postgresql.package = pkgs.postgresql_9_6; - - #services.roundcube = { - # enable = true; - # hostName = "webmail.otevrenamesta.cz"; - # database.password = "wSjL9R8T9qRL"; - #}; + services.mysql = { + enable = true; + package = pkgs.mysql; + bind = "127.0.0.1"; + ensureDatabases = [ "sympa" ]; + ensureUsers = [ + { + name = "sympa"; + ensurePermissions = { + "sympa.*" = "ALL PRIVILEGES"; + }; + } + ]; + }; + + #services.nginx.enable = true; + documentation.enable = false; + documentation.nixos.enable = false; + services.nginx.virtualHosts."lists.try.otevrenamesta.cz" = { default = true; }; + + services.postfix = { + enable = true; + relayHost = "192.168.122.100"; # do NOT use [brackets] here + }; + + services.sympa = { + enable = true; + mainDomain = "lists.try.otevrenamesta.cz"; + domains = { + "lists.try.otevrenamesta.cz" = { + webHost = "lists.try.otevrenamesta.cz"; + }; + ## disabled because we use aliases on try.otevrenamesta.cz instead + #"try.otevrenamesta.cz" = { + # webHost = "mx.otevrenamesta.cz"; + #}; + }; + listMasters = [ "martin@martinmilata.cz" "nesnera@email.cz" "ladislav.nesnera@liberix.cz" ]; + web = { + enable = true; + fcgiProcs = 2; + }; + database = { + type = "MySQL"; + host = "localhost"; + user = "sympa"; + #name = "sympa"; + }; + }; } diff --git a/morph.nix b/morph.nix index cc0d3e5..36a0f9b 100644 --- a/morph.nix +++ b/morph.nix @@ -7,6 +7,12 @@ let sha256 = "0gxd10djy6khbjb012s9fl3lpjzqaknfv2g4dpfjxwwj9cbkj04h"; }) {}; + # newPkgs with sympa changes on top + sympaPkgs = builtins.fetchTarball { + url = "https://github.com/mmilata/nixpkgs/archive/80ca8aec14371fad864bd24c315358271b4eba44.tar.gz"; + sha256 = "155fkrga5gzi42xrgzyf3h080j4g84i3g5zhh0dyyprv81wv50rb"; + }; + # for VZ nodes legacyPkgs = builtins.fetchTarball { url = "https://d3g5gsiof5omrk.cloudfront.net/nixos/17.09/nixos-17.09.3243.bca2ee28db4/nixexprs.tar.xz"; @@ -127,6 +133,12 @@ in ./machines/sympa.nix ]; + deployment = { + nixPath = [ + { prefix = "nixpkgs"; path = sympaPkgs; } + ]; + }; + fileSystems."/" = { device = "/dev/disk/by-uuid/3558270a-9c25-492b-bf4b-dcd2db2c5cfa"; fsType = "ext4"; From e7310abee3331c52080ff75579eda35bcf43fff0 Mon Sep 17 00:00:00 2001 From: Martin Milata Date: Wed, 24 Jul 2019 01:36:59 +0200 Subject: [PATCH 2/2] Sympa lists.otevrenamesta.cz prod setup --- machines/mail.nix | 14 +++++------ machines/mesta-libvirt.nix | 3 +-- machines/proxy.nix | 17 +++++++++++++ machines/sympa.nix | 50 +++++++++++++++++++++++++------------- morph.nix | 4 +-- 5 files changed, 60 insertions(+), 28 deletions(-) diff --git a/machines/mail.nix b/machines/mail.nix index f655ed3..09014d6 100644 --- a/machines/mail.nix +++ b/machines/mail.nix @@ -46,15 +46,15 @@ services.postfix = { # relay ML domains to sympa & allow sympa to send outgoing email networks = [ "192.168.122.101/32" ]; - relayDomains = [ "lists.try.otevrenamesta.cz" ]; + relayDomains = [ "lists.otevrenamesta.cz" ]; transport = '' - lists.try.otevrenamesta.cz relay:[192.168.122.101] + lists.otevrenamesta.cz relay:[192.168.122.101] ''; # aliases for mailing lists - virtual = '' - wwwybor@try.otevrenamesta.cz wwwybor@lists.try.otevrenamesta.cz - vratnice@try.otevrenamesta.cz vratnice@lists.try.otevrenamesta.cz - ustredna@try.otevrenamesta.cz ustredna@lists.try.otevrenamesta.cz - ''; +# virtual = '' +# wwwybor@try.otevrenamesta.cz wwwybor@lists.try.otevrenamesta.cz +# vratnice@try.otevrenamesta.cz vratnice@lists.try.otevrenamesta.cz +# ustredna@try.otevrenamesta.cz ustredna@lists.try.otevrenamesta.cz +# ''; }; } diff --git a/machines/mesta-libvirt.nix b/machines/mesta-libvirt.nix index 1f0d665..0ffdf63 100644 --- a/machines/mesta-libvirt.nix +++ b/machines/mesta-libvirt.nix @@ -15,8 +15,7 @@ { destination = "192.168.122.100:12340"; sourcePort = 12340;} # mail dovecot { destination = "192.168.122.101:22"; sourcePort = 10122;} # sympa ssh - { destination = "192.168.122.101:80"; sourcePort = 80;} # sympa http - { destination = "192.168.122.101:443"; sourcePort = 443;} # sympa https + { destination = "192.168.122.101:80"; sourcePort = 10180;} # sympa web { destination = "192.168.122.102:22"; sourcePort = 10222;} # midpoint ssh diff --git a/machines/proxy.nix b/machines/proxy.nix index 0d5b2ba..c497fc3 100644 --- a/machines/proxy.nix +++ b/machines/proxy.nix @@ -161,6 +161,23 @@ }; }; + "lists.otevrenamesta.cz" = { + forceSSL = true; + enableACME = true; + + locations = { + "/" = { + proxyPass = "http://37.205.14.17:10180"; + extraConfig = '' + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header Front-End-Https On; + ''; + + }; + }; + }; + "lpetl.otevrenamesta.cz" = { forceSSL = true; enableACME = true; diff --git a/machines/sympa.nix b/machines/sympa.nix index 5d44edb..01e9e85 100644 --- a/machines/sympa.nix +++ b/machines/sympa.nix @@ -2,23 +2,19 @@ { - environment.systemPackages = with pkgs; [ - #php - gcc - gnumake - ]; + environment.systemPackages = with pkgs; [ vim ]; + #environment.systemPackages = with pkgs; [ vim (let n = import ../../nixpkgs {}; in n.pgloader) ]; networking = { firewall.allowedTCPPorts = [ 80 25 443 ]; domain = "otevrenamesta.cz"; hostName = "lists"; - }; services.mysql = { enable = true; - package = pkgs.mysql; + package = pkgs.mariadb; bind = "127.0.0.1"; ensureDatabases = [ "sympa" ]; ensureUsers = [ @@ -31,38 +27,58 @@ ]; }; - #services.nginx.enable = true; documentation.enable = false; documentation.nixos.enable = false; - services.nginx.virtualHosts."lists.try.otevrenamesta.cz" = { default = true; }; + #services.nginx.virtualHosts."lists.try.otevrenamesta.cz" = { default = true; }; services.postfix = { enable = true; relayHost = "192.168.122.100"; # do NOT use [brackets] here }; + # workaround https reverse proxy + services.nginx.virtualHosts."lists.otevrenamesta.cz".locations."/".extraConfig = '' + fastcgi_param HTTPS on; + ''; + services.sympa = { enable = true; - mainDomain = "lists.try.otevrenamesta.cz"; + lang = "cs"; + mainDomain = "lists.otevrenamesta.cz"; domains = { - "lists.try.otevrenamesta.cz" = { - webHost = "lists.try.otevrenamesta.cz"; + "lists.otevrenamesta.cz" = { + webHost = "lists.otevrenamesta.cz"; }; - ## disabled because we use aliases on try.otevrenamesta.cz instead - #"try.otevrenamesta.cz" = { - # webHost = "mx.otevrenamesta.cz"; - #}; }; listMasters = [ "martin@martinmilata.cz" "nesnera@email.cz" "ladislav.nesnera@liberix.cz" ]; web = { enable = true; fcgiProcs = 2; + https = false; }; database = { type = "MySQL"; host = "localhost"; user = "sympa"; - #name = "sympa"; }; +# database = { +# type = "PostgreSQL"; +# host = "/run/postgresql"; +# user = "sympa"; +# }; + extraConfig = '' + cookie 00000000000000000000000000000001 + ''; }; + +# services.postgresql = { +# enable = true; +# package = pkgs.postgresql_11; +# authentication = "local all all trust"; +# initialScript = pkgs.writeText "postgresql-init" '' +# CREATE ROLE sympa NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT LOGIN; +# CREATE DATABASE sympa OWNER sympa ENCODING 'UNICODE'; +# ''; +# }; + } diff --git a/morph.nix b/morph.nix index 36a0f9b..e85bfb3 100644 --- a/morph.nix +++ b/morph.nix @@ -9,8 +9,8 @@ let # newPkgs with sympa changes on top sympaPkgs = builtins.fetchTarball { - url = "https://github.com/mmilata/nixpkgs/archive/80ca8aec14371fad864bd24c315358271b4eba44.tar.gz"; - sha256 = "155fkrga5gzi42xrgzyf3h080j4g84i3g5zhh0dyyprv81wv50rb"; + url = "https://github.com/mmilata/nixpkgs/archive/68bc3f764ed497e1ded594eba64e38e25e769cf4.tar.gz"; + sha256 = "0qmsmkjznx3ns20hyyqh1ym7jy29ypyjhd8yaxyglpfszrqffgk0"; }; # for VZ nodes