Sympa setup - lists.otevrenamesta.cz

machines/mail.nix

@@ -37,5 +37,24 @@
         #"abuse@try.otevrenamesta.cz" = "user1@try.otevrenamesta.cz";
     };
 
+    ## this was needed when sympa was hosting lists on @try.otevrenamesta.cz
+    #policydSPFExtraConfig = ''
+    #  Whitelist = 192.168.122.101/32
+    #'';
+  };
+
+  services.postfix = {
+    # relay ML domains to sympa & allow sympa to send outgoing email
+    networks = [ "192.168.122.101/32" ];
+    relayDomains = [ "lists.otevrenamesta.cz" ];
+    transport = ''
+      lists.otevrenamesta.cz    relay:[192.168.122.101]
+    '';
+    # aliases for mailing lists
+#    virtual = ''
+#      wwwybor@try.otevrenamesta.cz  wwwybor@lists.try.otevrenamesta.cz
+#      vratnice@try.otevrenamesta.cz vratnice@lists.try.otevrenamesta.cz
+#      ustredna@try.otevrenamesta.cz ustredna@lists.try.otevrenamesta.cz
+#    '';
   };
 }

machines/mesta-libvirt.nix

@@ -15,6 +15,7 @@
        { destination = "192.168.122.100:12340"; sourcePort = 12340;} # mail dovecot
 
        { destination = "192.168.122.101:22"; sourcePort = 10122;}    # sympa ssh
+       { destination = "192.168.122.101:80"; sourcePort = 10180;}    # sympa web
 
        { destination = "192.168.122.102:22"; sourcePort = 10222;}    # midpoint ssh
 

machines/proxy.nix

@@ -161,6 +161,23 @@
         };
       };
 
+      "lists.otevrenamesta.cz" = {
+        forceSSL = true;
+        enableACME = true;
+
+        locations = {
+          "/" = {
+            proxyPass = "http://37.205.14.17:10180";
+            extraConfig = ''
+              proxy_set_header Host $host;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_set_header Front-End-Https On;
+            '';
+
+          };
+        };
+      };
+
       "lpetl.otevrenamesta.cz" = {
         forceSSL = true;
         enableACME = true;

machines/sympa.nix

@@ -2,32 +2,83 @@
 
 {
 
-  environment.systemPackages = with pkgs; [
-     #php
-     gcc
-     gnumake
-     perl528Packages.Appcpanminus
-  ];
+  environment.systemPackages = with pkgs; [ vim ];
+  #environment.systemPackages = with pkgs; [ vim (let n = import ../../nixpkgs {}; in n.pgloader) ];
 
   networking = {
-     #firewall.allowedTCPPorts = [ 80 ];
+     firewall.allowedTCPPorts = [ 80 25 443 ];
 
      domain = "otevrenamesta.cz";
      hostName =  "lists";
+  };
+
+  services.mysql = {
+    enable = true;
+    package = pkgs.mariadb;
+    bind = "127.0.0.1";
+    ensureDatabases = [ "sympa" ];
+    ensureUsers = [
+      {
+        name = "sympa";
+        ensurePermissions = {
+          "sympa.*" = "ALL PRIVILEGES";
+        };
+      }
+    ];
+  };
+
+  documentation.enable = false;
+  documentation.nixos.enable = false;
+  #services.nginx.virtualHosts."lists.try.otevrenamesta.cz" = { default = true; };
 
+  services.postfix = {
+    enable = true;
+    relayHost = "192.168.122.100"; # do NOT use [brackets] here
   };
 
-  #services.nginx.virtualHosts."webmail.otevrenamesta.cz" = {
-  #  forceSSL = false;
-  #  enableACME = false; 
-  #};
-  #
-  #services.postgresql.enable = true;
-  #services.postgresql.package = pkgs.postgresql_9_6;
-
-  #services.roundcube = {
-  #  enable = true;
-  #  hostName = "webmail.otevrenamesta.cz";
-  #  database.password = "wSjL9R8T9qRL";
-  #};
+  # workaround https reverse proxy
+  services.nginx.virtualHosts."lists.otevrenamesta.cz".locations."/".extraConfig = ''
+    fastcgi_param HTTPS on;
+  '';
+
+  services.sympa = {
+    enable = true;
+    lang = "cs";
+    mainDomain = "lists.otevrenamesta.cz";
+    domains = {
+      "lists.otevrenamesta.cz" = {
+        webHost = "lists.otevrenamesta.cz";
+      };
+    };
+    listMasters = [ "martin@martinmilata.cz" "nesnera@email.cz" "ladislav.nesnera@liberix.cz" ];
+    web = {
+      enable = true;
+      fcgiProcs = 2;
+      https = false;
+    };
+    database = {
+      type = "MySQL";
+      host = "localhost";
+      user = "sympa";
+    };
+#    database = {
+#      type = "PostgreSQL";
+#      host = "/run/postgresql";
+#      user = "sympa";
+#    };
+    extraConfig = ''
+      cookie 00000000000000000000000000000001
+    '';
+  };
+
+#  services.postgresql = {
+#    enable = true;
+#    package = pkgs.postgresql_11;
+#    authentication = "local all all trust";
+#    initialScript = pkgs.writeText "postgresql-init" ''
+#      CREATE ROLE sympa NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT LOGIN;
+#      CREATE DATABASE sympa OWNER sympa ENCODING 'UNICODE';
+#    '';
+#  };
+
 }

morph.nix

@@ -7,6 +7,12 @@ let
     sha256 = "0gxd10djy6khbjb012s9fl3lpjzqaknfv2g4dpfjxwwj9cbkj04h";
   }) {};
 
+  # newPkgs with sympa changes on top
+  sympaPkgs = builtins.fetchTarball {
+    url = "https://github.com/mmilata/nixpkgs/archive/68bc3f764ed497e1ded594eba64e38e25e769cf4.tar.gz";
+    sha256 = "0qmsmkjznx3ns20hyyqh1ym7jy29ypyjhd8yaxyglpfszrqffgk0";
+  };
+
   # for VZ nodes
   legacyPkgs = builtins.fetchTarball {
     url    = "https://d3g5gsiof5omrk.cloudfront.net/nixos/17.09/nixos-17.09.3243.bca2ee28db4/nixexprs.tar.xz";
@@ -127,6 +133,12 @@ in
       ./machines/sympa.nix
     ];
 
+    deployment = {
+      nixPath = [
+        { prefix = "nixpkgs"; path = sympaPkgs; }
+      ];
+    };
+
     fileSystems."/" =
       { device = "/dev/disk/by-uuid/3558270a-9c25-492b-bf4b-dcd2db2c5cfa";
         fsType = "ext4";