Berwn
1cb6f39ea2
mx1 runs Simple NixOS Mailserver (Postfix/Dovecot/Rspamd/OpenDKIM) for cnx.email. The TLS cert is obtained via ACME DNS-01 using a dedicated, scoped TSIG key (acme_mx1) that ns1 authorizes for only _acme-challenge.mx1 and _acme-challenge.mta-sts on the cnx.email zone, so the credential can write nothing else. Mailbox passwords are auto-minted by a clan vars generator (four-word passphrase + number). DANE TLSA (3 1 1) is published for _25._tcp.mx1; --reuse-key keeps the key digest stable across renewals. MTA-STS is enforced via a Caddy vhost serving the policy on :443 from the same cert (mta-sts SAN). Firewall opens 25/587/465/143/993/443; 80 stays closed.
72 lines
2.1 KiB
Nix
72 lines
2.1 KiB
Nix
{
|
|
inputs.clan-core.url = "https://git.clan.lol/clan/clan-core/archive/25.11.tar.gz";
|
|
inputs.nixpkgs.follows = "clan-core/nixpkgs";
|
|
inputs.treefmt-nix.url = "github:numtide/treefmt-nix";
|
|
inputs.treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
|
|
# Simple NixOS Mailserver, pinned to the branch matching clan-core's nixpkgs.
|
|
inputs.nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-25.11";
|
|
inputs.nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";
|
|
|
|
outputs =
|
|
{
|
|
self,
|
|
clan-core,
|
|
nixpkgs,
|
|
...
|
|
}@inputs:
|
|
let
|
|
# Usage see: https://docs.clan.lol
|
|
clan = clan-core.lib.clan {
|
|
inherit self;
|
|
imports = [ ./clan.nix ];
|
|
specialArgs = { inherit inputs; };
|
|
|
|
# Customize nixpkgs
|
|
# pkgsForSystem =
|
|
# system:
|
|
# import nixpkgs {
|
|
# inherit system;
|
|
# config = {
|
|
# allowUnfree = true;
|
|
# };
|
|
# overlays = [];
|
|
# };
|
|
secrets.age.plugins = [
|
|
"age-plugin-yubikey"
|
|
"age-plugin-fido2-hmac"
|
|
];
|
|
};
|
|
|
|
systems = [
|
|
"x86_64-linux"
|
|
"aarch64-linux"
|
|
"aarch64-darwin"
|
|
"x86_64-darwin"
|
|
];
|
|
forAllSystems = nixpkgs.lib.genAttrs systems;
|
|
pkgsFor = system: clan-core.inputs.nixpkgs.legacyPackages.${system};
|
|
treefmtFor = system: inputs.treefmt-nix.lib.evalModule (pkgsFor system) ./fmt.nix;
|
|
in
|
|
{
|
|
inherit (clan.config) nixosConfigurations nixosModules clanInternals;
|
|
clan = clan.config;
|
|
|
|
# `nix fmt` and the `nix flake check` formatting gate.
|
|
formatter = forAllSystems (system: (treefmtFor system).config.build.wrapper);
|
|
checks = forAllSystems (system: {
|
|
formatting = (treefmtFor system).config.build.check self;
|
|
});
|
|
|
|
# Add the Clan cli tool to the dev shell.
|
|
# Use "nix develop" to enter the dev shell.
|
|
devShells = forAllSystems (system: {
|
|
default = (pkgsFor system).mkShell {
|
|
packages = [
|
|
clan-core.packages.${system}.clan-cli
|
|
(treefmtFor system).config.build.wrapper
|
|
];
|
|
};
|
|
});
|
|
};
|
|
}
|