Berwn
1cb6f39ea2
mx1 runs Simple NixOS Mailserver (Postfix/Dovecot/Rspamd/OpenDKIM) for cnx.email. The TLS cert is obtained via ACME DNS-01 using a dedicated, scoped TSIG key (acme_mx1) that ns1 authorizes for only _acme-challenge.mx1 and _acme-challenge.mta-sts on the cnx.email zone, so the credential can write nothing else. Mailbox passwords are auto-minted by a clan vars generator (four-word passphrase + number). DANE TLSA (3 1 1) is published for _25._tcp.mx1; --reuse-key keeps the key digest stable across renewals. MTA-STS is enforced via a Caddy vhost serving the policy on :443 from the same cert (mta-sts SAN). Firewall opens 25/587/465/143/993/443; 80 stays closed.
34 lines
809 B
Nix
34 lines
809 B
Nix
# treefmt config, evaluated per-system in flake.nix and exposed as
|
|
# `nix fmt` (the formatter) plus a `nix flake check` formatting gate.
|
|
{ ... }:
|
|
{
|
|
projectRootFile = "flake.nix";
|
|
|
|
programs = {
|
|
nixfmt.enable = true;
|
|
prettier.enable = true;
|
|
yamlfmt.enable = true;
|
|
shfmt.enable = true;
|
|
};
|
|
|
|
settings = {
|
|
on-unmatched = "fatal";
|
|
global.excludes = [
|
|
# Secrets and clan-managed state — never reformat.
|
|
"sops/*"
|
|
"vars/*"
|
|
"inventory.json"
|
|
|
|
# Generated — don't reformat (regeneration would churn the diff).
|
|
"*facter.json"
|
|
|
|
# No formatter, or reformatting would corrupt them.
|
|
"*.zone" # Knot zone files
|
|
"docs/book.toml" # mdBook config; no TOML formatter enabled
|
|
"flake.lock"
|
|
".envrc"
|
|
".gitignore"
|
|
];
|
|
};
|
|
}
|