vaultwarden: use local mailer
Julien Malka committed
Jun 1, 2024 at 20:38 UTC
65963915c9a46142a59ad109035136d333e3f8d4
5 files changed
+106
-10
non-critical-infra/modules/postfix.nix
new
+48
@@ -0,0 +1,48 @@
1
+{ config, pkgs, ... }:
2
+
3
+{
4
+ sops.secrets.opendkim-private-key = {
5
+ sopsFile = ../secrets/opendkim-private-key.caliban;
6
+ format = "binary";
7
+ owner = config.services.postfix.user;
8
+ };
9
+ services.opendkim = {
10
+ enable = true;
11
+ domains = config.networking.fqdn;
12
+ selector = "mail";
13
+ user = config.services.postfix.user;
14
+ group = config.services.postfix.group;
15
+ keyPath = "/run/opendkim-keys";
16
+ };
17
+
18
+ systemd.services.opendkim.serviceConfig = {
19
+ ExecStartPre = [
20
+ (
21
+ "+${pkgs.writeShellScript "opendkim-keys" ''
22
+ install -o ${config.services.postfix.user} -g ${config.services.postfix.group} -D -m0700 ${config.sops.secrets.opendkim-private-key.path} /run/opendkim-keys/${config.services.opendkim.selector}.private
23
+ ''}"
24
+ )
25
+ ];
26
+ };
27
+
28
+ services.postfix = {
29
+ enable = true;
30
+ hostname = config.networking.fqdn;
31
+ domain = config.networking.fqdn;
32
+ config = {
33
+ smtp_tls_note_starttls_offer = "yes";
34
+ smtp_tls_security_level = "may";
35
+ tls_medium_cipherlist = "AES128+EECDH:AES128+EDH";
36
+ smtpd_relay_restrictions = "permit_mynetworks permit_sasl_authenticated defer_unauth_destination";
37
+ mydestination = "localhost.$mydomain, localhost, $myhostname";
38
+ myorigin = "$mydomain";
39
+ milter_default_action = "accept";
40
+ milter_protocol = "6";
41
+ smtpd_milters = "unix:/run/opendkim/opendkim.sock";
42
+ non_smtpd_milters = "unix:/run/opendkim/opendkim.sock";
43
+ inet_interfaces = "loopback-only";
44
+ inet_protocols = "all";
45
+ };
46
+ };
47
+
48
+}
non-critical-infra/modules/vaultwarden.nix
+7
-6
@@ -1,7 +1,8 @@
1
-{ config, ... }:
1
+{ config, pkgs, ... }:
2
{
3
imports = [
4
./backup.nix
5
+ ./postfix.nix
6
];
7
8
services.vaultwarden = {
@@ -15,10 +16,10 @@
16
ROCKET_ADDRESS = "127.0.0.1";
17
ROCKET_PORT = 8222;
18
ROCKET_LOG = "critical";
18
- SMTP_HOST = "mail.gandi.net";
19
- SMTP_PORT = 587;
20
- SMTP_SSL = true;
21
- SMTP_FROM = "vaultwarden@nixos.org";
19
+ SMTP_HOST = "localhost";
20
+ SMTP_PORT = 25;
21
+ SMTP_SSL = false;
22
+ SMTP_FROM = "vaultwarden@caliban.nixos.org";
23
SMTP_FROM_NAME = "NixOS Vaultwarden";
24
};
25
};
@@ -90,8 +91,8 @@
91
};
92
};
93
93
-
94
};
95
+
96
}
97
98
non-critical-infra/secrets/opendkim-private-key.caliban
new
+32
@@ -0,0 +1,32 @@
1
+{
2
+ "data": "ENC[AES256_GCM,data:z3zZ7En5zaQMZhpPUdAOLlbZxu1fel9KT8vVMqVvtAPMK4v/QA1nabPgUspSUORF2qgYzzIY/tDRa0xPenTLjvVRoyRu49jiOdt5d2u7Y06oD1PI12/Dik9euqYhmcXG+rRs5/wBEOdLDmhmsRsLCsHOGvLZAioVPSbhss1bIjRt1Fi6brTB2/pwYR0QBLxhqfZcPQqHqfT+eY6E4Helkghl+UnSUMU3q/SvABTMYedPo/9HH2zTk90hiU/JZIYrKDt6rpFfufY4SMsXGROshx5ECE2Sx8zYBuvrN4N56nsOQ66LjFsZa4MX7KV5cNMoeqQp8o395YfMWxmFuOYE0I1hxJ5Sg6/ehJjGdit2xvL2Ry16eNYA7bvdhUZ1VGBhMUMyvFP1KkCYk6B7N2FXmaAssHMEonfI0kEnrfERaAaPpYaYszb6GJGJYqRQyysvq7/3IOOXZ1TC5uZiCVkJVeav7zQxcPNkBfRttNZ+iAZHFKjV1ZQO50L8VRdK9+ARNrtoFl92+HbVdOx006S8W3UgBSMAzFqwSEew/ujgnHQG1/71lXgESRDtatyGFYhx6OXJtRAnDmE/fNaJw2QR5zl0bzB8GPYqSNyXBuAFe9SJ3OLf4eVFE7gIMFnNPXGAouUIZMQqwkgmmPiibNuYUwgQhcu8aFQrceQz9DPlH19dPXnj30z6kAPHQJmEA8FFT21GzouyUDuoLz7/Iaws+k2mQWm1/2yK2LZN6GlUaS7D4Vv7WEX6L7ej3QelZnrvF0hE05JC87j9Lv4sdl5lms4hRq4KiYMoWk6UUEsx0BKm4x4rZ1HfyopLFx6bW7lHjI+21gpEmVZp4rSSYFh2sCfv7l05vjUjAtC43UfPiOgC4Ho7QhxFE0G4u/9PEgKsOQTeRwDStZkaet4+XM8I9c57oT7+7tHJvQ7LoNdIWdP/xR3jhZeEWN+nrTRmfcsdNl/H4gQTV9VINn5F7BxbzJB3oL7eymilYpdDEgiEF6Yw2lxRQ5bXTw2jPH/LA8d8CAu6BzQplC6cTJnjRuXnRY3rlBkByE+4xU09ozJLh1uOkp3HeKD8lEoroS9kb3FR+6cPr2rrW/JM2eAkALJV2+sCmcgDVUREiFTes7qBOKfydFbEGRqYym8zSBDcRN8hurb9wpI5bUmdh+Sxae1FsR1RIghMByjr02kBAPXtxYol/dZ3tF21rd0AzENRne4G,iv:zqzOFTzWS4XSfOf+Di3EtBZctQrsvd3SnY0iT3tvOmU=,tag:1xC5T6WOiEUhjAD64Q34Ug==,type:str]",
3
+ "sops": {
4
+ "kms": null,
5
+ "gcp_kms": null,
6
+ "azure_kv": null,
7
+ "hc_vault": null,
8
+ "age": [
9
+ {
10
+ "recipient": "age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhTkRXQ3hFdGpEWEg3RG9C\nb3BDOE5taWNvU0dUSmJBUDltTlBENW84aTE0CjU5M3A3VXJlSUo3RHRJdms0WjNR\nbXFwWUU1MkZaU1BSOW1QOXFYVmN0V2MKLS0tIHJOUFNiWmJYVk56R0NhTHhpR3lw\nK3JnVG9nanpPY0VpT2xpN2FzWmlpSm8KIXVYhkAKOSVcZmPjtG6dKtpr7PxjdRa0\nwSMJ2dacHIglbgDk1jc7EyrAjn2B/ARC82R1xw/7GKzDuL/h49Mwmw==\n-----END AGE ENCRYPTED FILE-----\n"
12
+ },
13
+ {
14
+ "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzUWJxTjZTMStURmk0WmE3\nYXM0NjA0eFpkdnZ2RTVRdytyU0hrZ2s4MDJZCnNsVklEL0twaE83dklnM1c2Mjc4\nNTFHYXUrUm5ybzRqNkNZMjRLTWxRN2MKLS0tIGVTNVltc0p1bEt0elUyeG9TYnZq\nSUd4T0RQTDZtc2U3US96L2dXYzFwYWsKizu8FCGL8x9iNIAyc9vEoeVE2v8RD+mh\nejIHfNKd9Sgqy1du/vqbcKlwrecD7/lTf3f8fsDpnBC0qghfs83+1A==\n-----END AGE ENCRYPTED FILE-----\n"
16
+ },
17
+ {
18
+ "recipient": "age1qlwzeg37fwwn2l6fm3quvkn787nn0m89xrjtrhgf9uedtfv2kqlqnec976",
19
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLaTNqdjhiOWp1aTZzZzk4\nL0tRRXhtSVJZQkdtOHNNU2V5SWdYK2tMRkFZCnBqNklyZjczT0YzUjJEb2NjY1FP\nSFg3aGhSZE10bnNCWGxtMGwwT0dxWVEKLS0tIEVDbTBvOHN3UE42bGVySGppQ3pr\nOW0xUDNUc0NrbWZXTnZRZE5POVZtYzAKzNkH6mxOsXpWv+r0bYhbCVJ6z2k0PkBC\n+oRdYpolMLNj2pb4KAgQbdRSlWTcz51JYTMAYJmth5ZT9WQeIsMs8g==\n-----END AGE ENCRYPTED FILE-----\n"
20
+ },
21
+ {
22
+ "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
23
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHSS8zdnZOR3R4VlJ5YzhF\nTkhhQ2FmOEdBaEMvTnFvVkN5eVN1dUdoQ2dBCnlpVXpYSXk3MitmYUt2YTBQZGQ1\nMXlaSGNxL25aNlgyWFV4d2pzTG1aUncKLS0tIEFodXdxdFFjczduSXZXbXNGTGsz\nRWsybFl0aXA3VG1VUnpSclZwOFpxSU0KmoVMzE8magbq/Ox1LpgNte3nKy10IaDB\nbNRyjSev8IGgUXclq6XIVFf2sznBdBvcXnA2SIEHulv1OgxzkaPDyw==\n-----END AGE ENCRYPTED FILE-----\n"
24
+ }
25
+ ],
26
+ "lastmodified": "2024-06-04T10:10:56Z",
27
+ "mac": "ENC[AES256_GCM,data:CenZP4kiDARE/mK2lOsFBZVI7f+Vz8tlRFdi5+eipFWiUnyghZx022K7t/TjuNjHxK7DJqn29VURAjj6+4flIQbJLEb6Dmu+eY40EbtFXEvKZrxEvCTN7e8yp6ds5dg+Nuj9tRE0pp8o7Wg6wNQWr6wIxqgjGYHrBJ2fYg6Mogs=,iv:+lxJwYB9wbs+tfF75NLu8EcIhd3k3q2VR9AqyRX2pR0=,tag:2W0YXbdFq5zOOs70nxzwrQ==,type:str]",
28
+ "pgp": null,
29
+ "unencrypted_suffix": "_unencrypted",
30
+ "version": "3.8.1"
31
+ }
32
+}
\ No newline at end of file
non-critical-infra/secrets/vaultwarden-env.caliban
+4
-4
@@ -1,5 +1,5 @@
1
{
2
- "data": "ENC[AES256_GCM,data:rMUrzw6AwN5QNUPeujhR5srzXXAulElsZpRIxECedCTJ72ovf+naFfkfrApD8Jd6LdtAYvclYs/KBBEi9XlqWJuianie+nVkVy341Z8fWiGaTb07m9UjzxF62lXpBbBu2xv+eS9/2kY83KZSgRYHxiJ/Z4of2ixc1L7Np56UwZD1+uxP1Ecu7WPQGwJRxKLaKd/JHJ7z+B9twA/N0Otn67ilRMss0rxYqA+yHH+I8r/6QF4Ulq/ULhAoXRKs3jpKIOLYGkRe5T4m0B/U5tR+P42XTdPtdFMR67Tk73Hb,iv:+LkKeny2z5QU+oztPnwJkSkHVUvYIzzMecQX6Wc0aYE=,tag:L3FKtuWWj32rMagR+fw8aA==,type:str]",
2
+ "data": "ENC[AES256_GCM,data:5PPXJqE8FM9QqqqnbBM9UbQMWMJFs7/iJ55RTTD8Byl2++h84UdzuOcG/9X6nWeZPcdi5YalrDJIhcRgSQ16x1oSV4Y2YGif62NzfCCZHNfkOO0tLhx4wlHD9QtZHDxIYoLZ/5TMvg+usFq6Y1s51x0ofigZpruK5sVhlnFAotK00FbOov98JHO+MJKZtF+E7Gtj,iv:KvhTmOSb4+A/7p4WrkEf3vzRm7xrIHUnMQACD07yPtM=,tag:uU8IBYdIlLXBAEVvx2DKBA==,type:str]",
3
"sops": {
4
"kms": null,
5
"gcp_kms": null,
@@ -23,10 +23,10 @@
23
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFUTBvTWY4VFFsSkdsWGlD\nSjBLRGVoWXBMbDRRRWVuYnVpaW05ZDRvR25RCjBTNmFkM3ptZTQrTWcvczJQWUlT\nbFMrRlZjSUlFVDlsWVRiZzZEK203QlkKLS0tIHE5Si9mYkpSRFNQa0J1ZXhvZ2dk\nSHpNYldXMjNHMDMwV3JqdUQ1Z3VZWTgKK8pb/aVyhvX5xPlcz211NZX3/sxGO3ff\nL9uC++BcZntVyZiY7mDn1bqXFjdqKa4sLAbSqcZLOPaY5DA9skdpsg==\n-----END AGE ENCRYPTED FILE-----\n"
24
}
25
],
26
- "lastmodified": "2023-10-16T16:40:23Z",
27
- "mac": "ENC[AES256_GCM,data:/Dt2+LpFW1HPwngXtDClE/eu+hbHroTJoZ6AG69/i5yiwtuU4obudvs4cdLRw6Wu3jQQrU4jx/sDip/hplAYtEYA/4tphU6rqt5EgZ0dNYdy9KOSKQ6M1nRRopzd2xX5xhdy6YekSUwpwWwADik9zBiFu3UhRlEIsSGJUDYt74M=,iv:G3BRfPu+bmy1cxtNra3pTQPaEfjUW104tpW8g2ruk4U=,tag:St0/jLz5MZTEifiE5In1ug==,type:str]",
26
+ "lastmodified": "2024-06-01T18:35:49Z",
27
+ "mac": "ENC[AES256_GCM,data:xw0+obDWdG//sTEDpF857DCVkisLUI4k088C3dbjpHgl8O7IpnUqk1yLivjM4jPcNqhW5Wrc5h8QJuy7PkXyXETz83+DbjPXiOUnuMHZQNgVqg08VnYzvwQ5FLRm9Bn51mrHLOYMaXLJMbKQWlxS3lNreLDycJGrxm+KTE6VskA=,iv:B/ArtyQffyoyaAZe9zE/p4B/gFGnesCa+lXRhxjd/Js=,tag:U32JBzTvWpfZ6zibtnuTYg==,type:str]",
28
"pgp": null,
29
"unencrypted_suffix": "_unencrypted",
30
- "version": "3.7.3"
30
+ "version": "3.8.1"
31
}
32
}
\ No newline at end of file
terraform/dns.tf
+15
@@ -281,6 +281,21 @@ locals {
281
type = "CNAME"
282
value = "caliban.nixos.org"
283
},
284
+ {
285
+ hostname = "caliban.nixos.org"
286
+ type = "TXT"
287
+ value = "v=spf1 ip4:65.109.26.213 ip6:2a01:4f9:5a:186c::2 ~all"
288
+ },
289
+ {
290
+ hostname = "mail._domainkey.caliban.nixos.org"
291
+ type = "TXT"
292
+ value = "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDCLtvNH4Ly+9COXf7InptMvoA7I5O347D7+j+saECt7RRe8yNz4TmhJTyJik+bg7e3+l7EJM0vE6k7xtpGBXACY6CCmg/8EgUi6YnDd126ttJHWpoqO96w4SWX93G+ZnoSC8O5rTPqdaTTkntYDTrw5u5n+7RA8GarZadgmaEzwIDAQAB"
293
+ },
294
+ {
295
+ hostname = "_dmarc.caliban.nixos.org"
296
+ type = "TXT"
297
+ value = "v=DMARC1; p=none"
298
+ },
299
{
300
hostname = "survey.staging.nixos.org"
301
type = "CNAME"