Commit Graph

323 Commits

Author SHA1 Message Date
Symphorien Gibol
52cf727a53 nixos/roundcube: do not write passwords to the store nor run php as root
If the database is local, use postgres peer authentication.
Otherwise, use a password file.

Leave database initialisation to postgresql.ensure*.
Leave /var/lib/roundcube creation to systemd.
Run php upgrade script as unpriviledged user.
2020-01-18 15:27:45 +01:00
Jan Tojnar
e85b34c484
tree-wide: fix more warning related to loaOf deprecation 2020-01-11 08:09:56 +01:00
Alyssa Ross
59c4035e58 nixos/spamassassin: allow initPreConf to be a path
Supporting a path here is important because it allows e.g. fetching a
configuration from a URL.  To do this and provide the configuration as
a string, IFD would be necessary.  It's just written into a path
anyway.
2020-01-10 21:49:06 +00:00
Milan Pässler
2a31a6a412 tree-wide: fix errors and warning related to loaOf deprecation 2020-01-07 06:23:28 +01:00
rnhmjoj
1d61efb7f1 treewide: use attrs instead of list for types.loaOf options 2020-01-06 10:39:18 -05:00
Silvan Mosberger
4ee3e8b21d
nixos/treewide: Move rename.nix imports to their respective modules
A centralized list for these renames is not good because:
- It breaks disabledModules for modules that have a rename defined
- Adding/removing renames for a module means having to find them in the
central file
- Merge conflicts due to multiple people editing the central file
2019-12-10 02:51:19 +01:00
Robin Gloster
5f7bcffe21
Merge pull request #71407 from f--t/fix/roundcube
roundcube: fix -- quoting string env variable
2019-11-20 09:25:10 +01:00
Aaron Andersen
07bba3fcd3
Merge pull request #73295 from aanderse/mailcatcher
nixos/mailcatcher: add http.path option
2019-11-19 17:15:52 -05:00
f--t
4c18309ca6
Merge branch 'master' into fix/roundcube 2019-11-19 13:16:16 -08:00
Victor Nawothnig
f42b402706 Specify correct type for fuzzy worker 2019-11-18 13:56:56 +01:00
Alyssa Ross
7813c249ef
nixos/postfix: add missing setgid wrapper
This is basically an alias for a special case of postqueue, which
already has a setgid wrapper.  Would be silly to allow postqueue -p
but not mailq.
2019-11-13 15:31:32 +00:00
Aaron Andersen
1759424fc6 nixos/mailcatcher: add http.path option 2019-11-12 10:11:24 -05:00
Florian Klink
e349b6e0fe nixos/opensmtpd: refactor to use tmpfiles to set up spool directories 2019-11-08 15:05:18 +01:00
ft
6a600b1c22 roundcube: fix -- quoting string env variable 2019-10-19 16:08:54 -07:00
Janne Heß
d6c08776ba treewide: Switch to system users 2019-10-12 22:25:28 +02:00
Victor Nawothnig
187c0b3aef Specify correct option type 2019-10-04 09:57:06 +02:00
Jörg Thalheim
bfed455de3
Merge pull request #68946 from volth/escape
treewide: fix string escapes
2019-09-24 04:19:12 +01:00
volth
6c038cd409
nixos/mailcatcher: add bind capabilities 2019-09-22 19:49:26 +00:00
volth
602a39c318
nixos/rspamd: fix fancy unicode quote 2019-09-16 23:40:32 +00:00
Alyssa Ross
27b459ce1e
nixos/mailman: types.string -> types.str 2019-09-11 14:14:09 +00:00
Peter Simons
d0dba96e1d nixos/mailman: properly wrap the mailman-web script 2019-09-11 15:22:37 +02:00
Peter Simons
a7941fe210 nixos/mailman: create "mailman" executable as a proper wrapper script 2019-09-11 15:11:34 +02:00
Peter Simons
1cb5cff611 nixos/mailman: clean up our variable names 2019-09-11 14:58:16 +02:00
Peter Simons
0cc37b3cfa nixos/mailman: httpd.services requires mailman-web in the systemd sense
When mailman-web restarts, it removes the generated "static" directory. This
breaks a currently running httpd process, which needs a re-start, too, to
obtain a new handle for the newly generated path.
2019-09-11 14:52:47 +02:00
Peter Simons
86f8895abb python-mailman-web: turn these Djando configuration files into a make-shift Python library
Suggested in https://github.com/NixOS/nixpkgs/pull/67951#issuecomment-530309702.
2019-09-11 14:48:51 +02:00
Peter Simons
72c7ba5aba nixos/mailman: add support for the Mailman Web UI (Postorius & Hyperkitty) 2019-09-11 12:19:23 +02:00
Léo Gaspard
a80eef922d rss2email: 3.9 -> 3.10 2019-09-09 18:03:17 +02:00
Vladimír Čunát
f21211ebfe
Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
Silvan Mosberger
478e7184f8
nixos/modules: Remove all usages of types.string
And replace them with a more appropriate type

Also fix up some minor module problems along the way
2019-08-31 18:19:00 +02:00
Frederik Rietdijk
ad1d58c622 Merge staging-next into staging 2019-08-31 10:04:20 +02:00
Peter Simons
eedf3dc6e2 nixos/mailman: decouple the mailman module from the postfix module
https://github.com/NixOS/nixpkgs/pull/67708#discussion_r319579987 suggested
that simply appending the necessary maps to the appropriate attributes in
services.postfix.config gets the job done; we don't special support in the
postfix module to accomplish that.
2019-08-30 18:44:47 +02:00
Peter Simons
6b87772ca4 nixos/mailman: don't reserve a static uid in the system
Any system uid will do, so we let the system allocate
one for us. The 'mailman' group is gone entirely since
we don't need it. Users who wish to run the 'mailman'
administration utility can do so via 'sudo':

    $ sudo -u mailman mailman info

Also, simplify the syntax of our user.users entry to
rely on an attribute set rather than a list.
2019-08-30 18:00:36 +02:00
Peter Simons
5a81797119 nixos/mailman: cosmetic 2019-08-30 15:38:43 +02:00
Peter Simons
c1c1ce7221 mailman: add NixOS module to install and deploy the mailing list server 2019-08-29 20:29:35 +02:00
Frederik Rietdijk
5061fe0c2c Merge staging-next into staging 2019-08-28 08:26:42 +02:00
Maximilian Bosch
56a7bc05e1
nixos/treewide: drop dependencies to keys.target
The `keys.target` is used to indicate whether all NixOps keys were
successfully uploaded on an unattended reboot. However this can cause
startup issues e.g. with NixOS containers (see #67265) and can block
boots even though this might not be needed (e.g. with a dovecot2
instance running that doesn't need any of the NixOps keys).

As described in the NixOps manual[1], dependencies to keys should be
defined like this now:

``` nix
{
  systemd.services.myservice = {
    after = [ "secret-key.service" ];
    wants = [ "secret-key.service" ];
  };
}
```

However I'd leave the issue open until it's discussed whether or not to
keep `keys.target` in `nixpkgs`.

[1] https://nixos.org/nixops/manual/#idm140737322342384
2019-08-27 18:55:55 +02:00
volth
35d68ef143 treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
Alexander V. Nikolaev
885511cb5c rmilter: remove deprecated package (and module) 2019-08-24 17:33:48 +03:00
Aaron Andersen
400c6aac71 nixos/phpfpm: deprecate extraConfig options in favor of settings options 2019-08-23 07:56:27 -04:00
Aaron Andersen
0ce8317c46 nixos/phpfpm: deprecate poolConfigs option 2019-08-23 07:54:51 -04:00
Silvan Mosberger
88bb9fa403
nixos/modules: Replace all nested types.either's with types.oneOf's 2019-08-08 23:35:52 +02:00
Peter Simons
59bacaca3d nixos: add 'localRecipients' config option for Postfix
The new option services.postfix.localRecipients allows
configuring the postfix option 'local_recipient_maps'. When
set to a list of user names (or patterns), that map
effectively replaces the lookup in the system's user
database that's used by default to determine which local
users are valid.

This option is useful to explicitly set local users that are
allowed to receive e-mail from the outside world. For local
injection i.e. via the 'sendmail' command this option has no
effect.
2019-07-15 17:36:20 +02:00
Aaron Andersen
278d867a9b Revert "Merge pull request #63156 from Izorkin/phpfpm-rootless"
This reverts commit b5478fd1a2, reversing
changes made to dbb00bfcbf.
2019-06-28 21:47:43 -04:00
Elis Hirwing
b5478fd1a2
Merge pull request #63156 from Izorkin/phpfpm-rootless
phpfpm: do not run anything as root
2019-06-27 19:13:53 +02:00
Graham Christensen
38c28ef10c
Merge pull request #56265 from aanderse/permissions-start-only
replace deprecated usage of PermissionsStartOnly (part 2)
2019-06-25 18:04:22 -04:00
volth
f3282c8d1e treewide: remove unused variables (#63177)
* treewide: remove unused variables

* making ofborg happy
2019-06-16 19:59:05 +00:00
Izorkin
59a33f25e5 nixos/roundcube: fix work with phpfpm-rootless mode 2019-06-16 12:33:51 +03:00
Aaron Andersen
fbe5943237 nixos/opendkim: replace deprecated usage of PermissionsStartOnly
see https://github.com/NixOS/nixpkgs/issues/53852
2019-05-26 07:20:57 -04:00
Aaron Andersen
4775c59528 nixos/dspam: replace deprecated usage of PermissionsStartOnly
see https://github.com/NixOS/nixpkgs/issues/53852
2019-05-26 07:20:57 -04:00
Daniel Schaefer
786f02f7a4 treewide: Remove usage of isNull
isNull "is deprecated; just write e == null instead" says the Nix manual
2019-04-29 14:05:50 +02:00
Aaron Andersen
4a11ce7f26
cleanup redundant text in modules utilizing mkEnableOption
Closes #59911
2019-04-20 14:44:02 +02:00
Aaron Andersen
a585d29bfd nixos/rss2email: replace deprecated usage of PermissionsStartOnly
see https://github.com/NixOS/nixpkgs/issues/53852
2019-04-13 07:00:57 -04:00
Aaron Andersen
64fdacc580 nixos/nullmailer: replace deprecated usage of PermissionsStartOnly
see https://github.com/NixOS/nixpkgs/issues/53852
2019-04-13 07:00:57 -04:00
Robin Gloster
f370553f8f
Merge pull request #58804 from Ma27/roundcube-fixes
roundcube: minor fixes
2019-04-09 18:30:00 +00:00
Florian Klink
2457510db4
Merge pull request #51918 from bobvanderlinden/var-run
tree-wide: nixos: /var/run -> /run
2019-04-07 20:09:46 +02:00
Maximilian Bosch
6b6348eaba
nixos/roundcube: only configure postgres config if localhost is used as database
When using a different database, the evaluation fails as
`config.services.postgresql.package` is only set if `services.postgresql` is enabled.

Also, the systemd service shouldn't have a relation to postgres if a
remote database is used.
2019-04-02 16:02:53 +02:00
Aaron Andersen
01cec5155f nixos/davmail: set logging default to warn, instead of debug 2019-04-02 09:52:32 -04:00
Aaron Andersen
395ec8c0d4 nixos/mailcatcher: init module for existing package 2019-03-27 09:15:47 -04:00
Bob van der Linden
c67f2f0815 nixos/spamassassin: /var/run -> /run 2019-03-20 00:02:44 +01:00
Bob van der Linden
edd5c88086 nixos/postgrey: /var/run -> /run 2019-03-20 00:02:44 +01:00
Bob van der Linden
0438ad4712 nixos/pfix-srsd: /var/run -> /run 2019-03-20 00:02:44 +01:00
Silvan Mosberger
6ad76ff1ba
Merge pull request #52096 from furrycatherder/davmail
nixos/davmail: init
2019-03-09 22:41:55 +01:00
Sean Haugh
f2730d881b nixos/davmail: init
Co-authored-by: Aaron Andersen <aaron@fosslib.net>
Co-authored-by: Silvan Mosberger <infinisil@icloud.com>
2019-03-09 12:05:15 -06:00
Julien Moutinho
2a61c058c6 rmilter: fix inetSocket
IPv6 address has to be between [] and the port after.
2019-03-02 01:12:21 +00:00
Symphorien Gibol
a915b33315 nixos: add preferLocalBuild=true; on derivations for config files 2019-02-22 20:11:27 +01:00
Maximilian Bosch
6fb825b057 nixos/roundcube: add package option
With this option it's possible to specify a custom expression for
`roundcube`, i.e. a roundcube environment with third-party plugins as
shown in the testcase.
2019-02-08 13:35:09 +00:00
Robin Gloster
1262a5ca97
roundcube: apply code review suggestions 2018-11-28 18:53:37 +01:00
Robin Gloster
9ace7f6409
roundcube: clean-up and add test 2018-11-28 18:52:10 +01:00
Victor SENE
2f8073bd92
roundcube: IPv6 by default 2018-11-28 18:52:10 +01:00
Victor SENE
b5120953c6
nixos/roundcube: add roundcube module and default configuration 2018-11-28 18:52:08 +01:00
Brian Olsen
0d753af661
nixos/rspamd: Allow worker type to be proxy again
When reworking the rspamd workers I disallowed `proxy` as a type and
instead used `rspamd_proxy` which is the correct name for that worker
type. That change breaks peoples existing config and so I have made this
commit which allows `proxy` as a worker type again but makes it behave
as `rspamd_proxy` and prints a warning if you use it.
2018-11-25 16:03:34 +01:00
Léo Gaspard
0483ce0eee
rss2email module: init
Also adding `system-sendmail` package for sharing the code with other
modules or packages needing it.
2018-11-15 23:44:16 +09:00
Franz Pletz
8ba51ef5ec
Merge pull request #49809 from griff/rspamd-workers
nixos/rspamd: Multiple workers, extraConfig priority & postfix integration
2018-11-09 02:55:02 +00:00
Brian Olsen
e01605be15
nixos/rspamd: Add options for postfix integration
The `rmilter` module has options for configuring `postfix` to use it but
since that module is deprecated because rspamd now has a builtin worker
that supports the milter protocol this commit adds similar `postfix`
integration options directly to the `rspamd` module.
2018-11-09 01:31:27 +01:00
Brian Olsen
fba69f388b
nixos/rspamd: Put extraConfig in included files
The lines stored in `extraConfig` and `worker.<name?>.extraConfig`
should take precedent over values from included files but in order to do
this in rspamd UCL they need to be stored in a file that then gets
included with a high priority. This commit uses the overrides option to
store the value of the two `extraConfig` options in `extra-config.inc`
and `worker-<name?>.inc` respectively.
2018-11-06 00:34:23 +01:00
Brian Olsen
46ef075e7d
nixos/rspamd: Add defaults for rspamd_proxy worker 2018-11-06 00:32:14 +01:00
Brian Olsen
3a4459a305
nixos/rspamd: Support multiple workers
When the workers option for rspamd was originally implemented it was
based on a flawed understanding of how workers are configured in rspamd.
This meant that while rspamd supports configuring multiple workers of
the same type, so that different controller workers could have different
passwords, the NixOS module did not support this because it would write
an invalid configuration file if you tried.

Specifically a configuration like the one below:

```
workers.controller = {};
workers.controller2 = {
  type = "controller";
};
```

Would result in a rspamd configuration of:

```
worker {
  type = "controller";
  count = 1;
  .include "$CONFDIR/worker-controller.inc"
}
worker "controller2" {
  type = "controller";
  count = 1;
}
```

While to get multiple controller workers it should instead be:

```
worker "controller" {
  type = "controller";
  count = 1;
  .include "$CONFDIR/worker-controller.inc"
}
worker "controller" {
  type = "controller";
  count = 1;
}
```
2018-11-06 00:26:55 +01:00
Brian Olsen
c853b34824
nixos/rspamd: Fix enable for locals and overrides
When implementing #49620 I included an enable option for both the
locals and overrides options but the code writing the files didn't
actually look at enable and so would write the file regardless of its
value. I also set the type to loaOf which should have been attrsOf
since the code was not written to handle the options being lists.

This fixes both of those issues.
2018-11-05 17:50:34 +01:00
Brian Olsen
0810d631a4
nixos/rspamd: Add support for included files
By default rspamd will look for multiple files in /etc/rspamd/local.d
and /etc/rspamd/override.d to be included in subsections of the merged
final config for rspamd. Most of the config snippets in the official
rspamd documentation are made to these files and so it makes sense for
NixOS to support them and this is what this commit does.

As part of rspamd 1.8.1 support was added for having custom Lua
rules stored in $LOCAL_CONFDIR/rspamd.local.lua which means that it is
now possible for NixOS to support such rules and so this commit also
adds support for this to the rspamd module.
2018-11-02 01:46:57 +01:00
Léo Gaspard
930bcbda83
dkimproxy-out module: add self as maintainer 2018-10-31 01:06:04 +09:00
Léo Gaspard
9b34f47b7c
clamsmtp module: add self as maintainer 2018-10-31 01:05:49 +09:00
Drew Hess
fa388534e4
dovecot: dovenull user should have its own group.
Quoting from https://wiki.dovecot.org/UserIds#dovenulluser:

"It should belong to its own private dovenull group where no one else
belongs to..."
2018-10-22 15:01:47 -04:00
Jörg Thalheim
91ddc9d27f
postfix: add setgid wrapper for postqueue/postdrop
Both postqueue[1] and postdrop[2] implement a subset of administration
task that are supposed to be run unprivileged users
and require the setgid bit to full-fill this task.

[1] http://www.postfix.org/postqueue.1.html
[2] http://www.postfix.org/postdrop.1.html
2018-10-15 13:14:41 +01:00
Jörg Thalheim
156d2fbf5d
Merge pull request #48272 from avnik/fix/rmilter
nixos/rmilter: don't enable by default, if rspamd enabled
2018-10-12 22:34:08 +01:00
Alexander V. Nikolaev
b61dd2bcb7 nixos/rmilter: don't enable by default, if rspamd enabled 2018-10-12 17:39:06 +03:00
Pavel Goran
858b263bf0 nixos: correct improper uses of mkEnableOption, clarify service descriptions
Several service definitions used `mkEnableOption` with text starting
with "Whether to", which produced funny option descriptions like
"Whether to enable Whether to run the rspamd daemon..".

This commit corrects this, and adds short descriptions of services
to affected service definitions.
2018-10-05 13:14:45 +07:00
Brian Olsen
783a58f363
nixos/rspamd: Remove non-working socket activation
The socket activation I added to the rspamd module doesn't actually work
and can't be made to work without changes to rspamd.

See: #47421
See: rspamd/rspamd#2035
2018-09-28 19:43:34 +02:00
Jörg Thalheim
2dc1d75eb4
Merge pull request #35690 from griff/rspamd-socketruntime
nixos/rspamd: Preserve runtime directory when using socket activation
2018-09-27 14:09:12 +01:00
Alexander V. Nikolaev
868040ee22 rmilter: deprecation notice 2018-09-23 18:51:40 +03:00
Alexander V. Nikolaev
08f266490b rmilter: move rmilter.sock out of /run/rmilter
/run/rmilter is set by systemd, and have root:root ownership, which
prevent pid file to write.

This fix suggested to be promoted to 18.09 branch.
(Although rmilter itself is deprecated, and I plan to remove it, after
18.09 would be released)
2018-09-22 20:57:08 +03:00
pacien
d73ed4264f exim: parametrise package
This allows the definition of a custom derivation of Exim,
which can be used to enable custom features such as LDAP and PAM support.

The default behaviour remains unchanged (defaulting to pkgs.exim).
2018-09-16 15:19:29 +02:00
volth
2e979e8ceb [bot] nixos/*: remove unused arguments in lambdas 2018-07-20 20:56:59 +00:00
volth
87f5930c3f [bot]: remove unreferenced code 2018-07-20 18:48:37 +00:00
Florian Klink
fff5923686 nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
Léo Gaspard
bb08686f1e opensmtpd module: allow changing the package 2018-06-18 09:49:01 +02:00
Janne Heß
b3e7923b94 nixos/exim: Add unit restart trigger (#41418) 2018-06-03 21:22:55 +02:00
aszlig
67a8c66f68
nixos/dovecot: Fix usage of dhparams option
The pull request that added dhparams (#39507) was made at the time where
the dhparams module overhaul (#39526) wasn't done yet, so it's still
using the old mechanics of the module.

As stated in the release notes:

  Module implementers should not set a specific bit size in order to let
  users configure it by themselves if they want to have a different bit
  size than the default (2048).

  An example usage of this would be:

    { config, ... }:

    {
      security.dhparams.params.myservice = {};
      environment.etc."myservice.conf".text = ''
        dhparams = ${config.security.dhparams.params.myservice.path}
      '';
    }

Signed-off-by: aszlig <aszlig@nix.build>
Cc: @qknight, @abbradar, @hrdinka, @leenaars
2018-05-10 08:29:29 +02:00
Joachim Schiele
851d5d72a3 dovecot2: added ssl_dh using security.dhparams
The 18.03 channel includes dovecot 2.3, which requires ssl_dh to be set.
-> fixes https://github.com/nixcloud/nixcloud-webservices/issues/21
2018-05-08 15:51:39 +03:00
Franz Pletz
6a15c8d6f7
nixos/dovecot: set group in config
The dovecot bump to 2.3.1 caused the dovecot service to fail to start
because it would try to chgrp sockets to dovecot whereas our default
dovecot group is called dovecot2.
2018-03-28 19:16:41 +02:00
Brian Olsen
458bcc8f7a
nixos/rspamd: Preserve runtime directory when using socket activation 2018-02-26 23:57:44 +01:00