From 0d7a9738b0942d6216ba1c11485909b89d186afd Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Tue, 4 Jul 2023 15:10:00 +0200 Subject: [PATCH 1/8] manually patch the portunus regex --- flake.nix | 4 +-- .../0001-update-user-validation-regex.patch | 25 +++++++++++++++++++ modules/{ldap.nix => ldap/default.nix} | 23 +++++++---------- 3 files changed, 36 insertions(+), 16 deletions(-) create mode 100644 modules/ldap/0001-update-user-validation-regex.patch rename modules/{ldap.nix => ldap/default.nix} (86%) diff --git a/flake.nix b/flake.nix index 04919d3..86b419c 100755 --- a/flake.nix +++ b/flake.nix @@ -40,7 +40,7 @@ ./modules/options.nix ./modules/base.nix ./modules/sops.nix - ./modules/ldap.nix + ./modules/ldap # ./modules/keycloak.nix replaced by portunus ./modules/mail.nix ./modules/mailman.nix @@ -67,7 +67,7 @@ ./hosts/quitte/configuration.nix ./modules/options.nix ./modules/base.nix - ./modules/ldap.nix + ./modules/ldap # ./modules/keycloak.nix replaced by portunus ./modules/nginx.nix ./modules/mail.nix diff --git a/modules/ldap/0001-update-user-validation-regex.patch b/modules/ldap/0001-update-user-validation-regex.patch new file mode 100644 index 0000000..7911cdf --- /dev/null +++ b/modules/ldap/0001-update-user-validation-regex.patch @@ -0,0 +1,25 @@ +From a3fb0c82f09db0b5655c949d5e4dbea55279ff10 Mon Sep 17 00:00:00 2001 +From: Rouven Seifert +Date: Tue, 4 Jul 2023 15:02:02 +0200 +Subject: [PATCH] update user validation regex + +--- + internal/core/validation.go | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/internal/core/validation.go b/internal/core/validation.go +index 3be9dfa..b1368a7 100644 +--- a/internal/core/validation.go ++++ b/internal/core/validation.go +@@ -30,7 +30,7 @@ import ( + ) + + // this regexp copied from useradd(8) manpage +-const posixAccountNamePattern = `[a-z_][a-z0-9_-]*\$?` ++const posixAccountNamePattern = `[a-z_][a-z0-9._-]*\$?` + + var ( + errIsMissing = errors.New("is missing") +-- +2.41.0 + diff --git a/modules/ldap.nix b/modules/ldap/default.nix similarity index 86% rename from modules/ldap.nix rename to modules/ldap/default.nix index 66bf2e9..6d19618 100644 --- a/modules/ldap.nix +++ b/modules/ldap/default.nix @@ -65,7 +65,7 @@ in #tls = true; }; - seedPath = ../config/portunus_seeds.json; + seedPath = ../../config/portunus_seeds.json; }; #users.ldap = { @@ -124,17 +124,12 @@ in }; }; - # nixpkgs.overlays = [ - # (self: super: - # { - # portunus = super.portunus.overrideAttrs (old: { - # src = super.fetchFromGitHub { - # owner = "revol-xut"; - # repo = "portunus"; - # rev = "4dc29febacb11c613785bc95352fa00e0ca9b14a"; - # sha256 = "sha256-6O2392aHXhgvgZf6ftDY5Bh6hG3OzzCnlriig/Vkkz8="; - # }; - # }); - # }) - # ]; + nixpkgs.overlays = [ + (self: super: + { + portunus = super.portunus.overrideAttrs (old: { + patches = [ ./0001-update-user-validation-regex.patch ]; + }); + }) + ]; } From 5136effd168fe1acf0daee243254b233256d1b73 Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Tue, 4 Jul 2023 15:15:58 +0200 Subject: [PATCH 2/8] fix the portunus pach --- modules/ldap/0001-update-user-validation-regex.patch | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/ldap/0001-update-user-validation-regex.patch b/modules/ldap/0001-update-user-validation-regex.patch index 7911cdf..6ae40f9 100644 --- a/modules/ldap/0001-update-user-validation-regex.patch +++ b/modules/ldap/0001-update-user-validation-regex.patch @@ -1,6 +1,6 @@ -From a3fb0c82f09db0b5655c949d5e4dbea55279ff10 Mon Sep 17 00:00:00 2001 +From f5c68898be345fb0dca5ab7b596b9cbe674f5dfb Mon Sep 17 00:00:00 2001 From: Rouven Seifert -Date: Tue, 4 Jul 2023 15:02:02 +0200 +Date: Tue, 4 Jul 2023 15:14:00 +0200 Subject: [PATCH] update user validation regex --- @@ -8,13 +8,13 @@ Subject: [PATCH] update user validation regex 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/core/validation.go b/internal/core/validation.go -index 3be9dfa..b1368a7 100644 +index 3e168b5..10dfc0a 100644 --- a/internal/core/validation.go +++ b/internal/core/validation.go @@ -30,7 +30,7 @@ import ( ) - // this regexp copied from useradd(8) manpage + //this regexp copied from useradd(8) manpage -const posixAccountNamePattern = `[a-z_][a-z0-9_-]*\$?` +const posixAccountNamePattern = `[a-z_][a-z0-9._-]*\$?` From d5e881c63905c1253401efb0c651351166380d6b Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Tue, 4 Jul 2023 17:06:18 +0200 Subject: [PATCH 3/8] use portunus.package to override --- modules/ldap/default.nix | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/modules/ldap/default.nix b/modules/ldap/default.nix index 6d19618..d62c963 100644 --- a/modules/ldap/default.nix +++ b/modules/ldap/default.nix @@ -48,6 +48,9 @@ in services.portunus = { enable = true; + package = pkgs.portunus.overrideAttrs (old: { + patches = [ ./0001-update-user-validation-regex.patch ]; + }); user = "${portunusUser}"; group = "${portunusGroup}"; domain = "${domain}"; @@ -123,13 +126,4 @@ in }; }; }; - - nixpkgs.overlays = [ - (self: super: - { - portunus = super.portunus.overrideAttrs (old: { - patches = [ ./0001-update-user-validation-regex.patch ]; - }); - }) - ]; } From 1d9359416d7530a77a27ee5718ac3034870286a8 Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Wed, 5 Jul 2023 16:21:20 +0200 Subject: [PATCH 4/8] add postmaster alias --- modules/mail.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/mail.nix b/modules/mail.nix index 72029de..fd1c09d 100644 --- a/modules/mail.nix +++ b/modules/mail.nix @@ -47,6 +47,7 @@ in extraAliases = '' # Taken from kaki, maybe we can throw out some at some point # General redirections for pseudo accounts + postmaster: root bin: root daemon: root named: root From 9be95bc7d7eeff22433c912c9be5a248b126e0c7 Mon Sep 17 00:00:00 2001 From: Fugi Date: Thu, 6 Jul 2023 01:10:47 +0200 Subject: [PATCH 5/8] Fix IPv6 mail sending, add noreply alias --- modules/mail.nix | 64 +++++++++++++++++++++++++----------------------- 1 file changed, 33 insertions(+), 31 deletions(-) diff --git a/modules/mail.nix b/modules/mail.nix index fd1c09d..a1e93e3 100644 --- a/modules/mail.nix +++ b/modules/mail.nix @@ -39,7 +39,7 @@ in domain = "${domain}"; origin = "${domain}"; destination = [ "${hostname}" "${domain}" "localhost" ]; - networks = [ "127.0.0.1" "141.30.30.169" ]; + networksStyle = "host"; # localhost and own public IP sslCert = "/var/lib/acme/${hostname}/fullchain.pem"; sslKey = "/var/lib/acme/${hostname}/key.pem"; relayDomains = [ "hash:/var/lib/mailman/data/postfix_domains" ]; @@ -47,7 +47,6 @@ in extraAliases = '' # Taken from kaki, maybe we can throw out some at some point # General redirections for pseudo accounts - postmaster: root bin: root daemon: root named: root @@ -62,9 +61,13 @@ in dumper: root operator: root abuse: postmaster + postmaster: root # trap decode to catch security attacks decode: root + + # yeet into the void + noreply: /dev/null ''; config = { home_mailbox = "Maildir/"; @@ -153,37 +156,36 @@ in pkgs.dovecot_pigeonhole ]; extraConfig = '' - auth_username_format = %Ln - passdb { - driver = ldap - args = ${dovecot-ldap-args} + auth_username_format = %Ln + passdb { + driver = ldap + args = ${dovecot-ldap-args} + } + userdb { + driver = ldap + args = ${dovecot-ldap-args} + } + service auth { + unix_listener /var/lib/postfix/auth { + group = postfix + mode = 0660 + user = postfix } - userdb { - driver = ldap - args = ${dovecot-ldap-args} + } + service managesieve-login { + inet_listener sieve { + port = 4190 } - service auth { - unix_listener /var/lib/postfix/auth { - group = postfix - mode = 0660 - user = postfix - } + service_count = 1 + } + service lmtp { + unix_listener dovecot-lmtp { + group = postfix + mode = 0600 + user = postfix } - service managesieve-login { - inet_listener sieve { - port = 4190 - } - - service_count = 1 - } - service lmtp { - unix_listener dovecot-lmtp { - group = postfix - mode = 0600 - user = postfix - } - client_limit = 1 - } + client_limit = 1 + } ''; }; opendkim = { @@ -191,7 +193,7 @@ in domains = "csl:${config.fsr.domain}"; selector = config.networking.hostName; configFile = pkgs.writeText "opendkim-config" '' - UMask 0117 + UMask 0117 ''; }; rspamd = { From 6c542cadb9d0ab251797999c053d0558f9debc97 Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Fri, 7 Jul 2023 10:14:02 +0200 Subject: [PATCH 6/8] fix sending to aliases --- modules/mail.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/mail.nix b/modules/mail.nix index a1e93e3..c68a5d3 100644 --- a/modules/mail.nix +++ b/modules/mail.nix @@ -102,6 +102,7 @@ in ]; # smtpd_sender_login_maps = [ "ldap:${ldap-senders}" ]; alias_maps = [ "hash:/etc/aliases" ]; + alias_database = [ "hash:/etc/aliases" ]; # alias_maps = [ "hash:/etc/aliases" "ldap:${ldap-aliases}" ]; smtpd_milters = [ "local:/run/opendkim/opendkim.sock" ]; non_smtpd_milters = [ "local:/var/run/opendkim/opendkim.sock" ]; @@ -109,7 +110,7 @@ in smtpd_sasl_path = "/var/lib/postfix/auth"; smtpd_sasl_type = "dovecot"; #mailman stuff - local_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp"; + mailbox_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp"; transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ]; local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" "ldap:${config.sops.secrets."postfix_ldap_aliases".path}" ]; From bbda0accc42c11ee8e9c4a5eda5bcce5977bbbb1 Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Fri, 7 Jul 2023 10:55:23 +0200 Subject: [PATCH 7/8] fix postfix ldap query --- secrets/quitte.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/secrets/quitte.yaml b/secrets/quitte.yaml index 70daf77..2c2add9 100644 --- a/secrets/quitte.yaml +++ b/secrets/quitte.yaml @@ -15,7 +15,7 @@ mediawiki: postgres: ENC[AES256_GCM,data:XRfUc2PRMJcoILAnm5MWr2Cg5u4e/IhGMUnz/oIQSzY=,iv:8U+qlD1SQzxUyD/6QK4SdwRCDyMODK/lP0IDrLlcQ4U=,tag:2spNMj9dY2wWilOusq24yQ==,type:str] initial_admin: ENC[AES256_GCM,data:iET5rz9rygx49NDBjKwqAlRgpeS+jq5iM5zmjnoKcyk=,iv:11iDbCrpzjCdyAB22R8NknJ6vzcpVZXCXB3iWsGWXw0=,tag:1RCyg1ysOWaXKdqqdHqRrw==,type:str] ldapprovider: ENC[AES256_GCM,data:CPsrWmUviUpFIVVN/2a1lRjJCoZCWR9zrHm3T5Tv/YuXSYXStZGfBgXN96zhJUUpZcwiJq95o1sajyit+6itZCcGAPu0BTHSnNXRu1fgifonXE0ghw6rvzwkYpfBS+rfmBcG2wxX+7uZG3ulANYpvvGMxpKgM5IzQjE1sAytRDir6QeMGcFHP2gV4xQAdTNUZK2V+EKOlrcV5vTSzDSy3eXg18TVUgZqdxaQFfwnr2UN0eEEZ4Dn83G3QWsROZ0A7R3tuEmdAzmR8AdWBxfqCcOA8vZaOIOWb1AyobLCUaqQOj/SbGdgehMOQn1UcbRHpYQ2E9mvxD572uc/U5kzy/TbOLM34pkvckNrGfxwvqwbvXZrVP3gONY5CnJpk5XfVdT5Au/uwE5ZRs83ZEx31+85mpK3HecyBWRfWID0z2XS8PAU6G7ASQsXCh6sd5LFhL7zhxBQ4ENjT8pDi0OLYvw9VzPhPrdzooULeMytGitVWRtLsSzCn/D+U4x6EJLivLW6jv9SAIKg54fAjNEBYHh7GuHbr/VGtmiWKj6av2e3/BLgPOIyINzNv+X5QSsopZ2/yamPs+ARTOqAZvSyRgqereYoLZ5ZV15jIWiGc7HVfj/+Bk7cN4+VwFhzSuttp1DmvNNIWueeX69rdSqe41Y2lqKZ4ajOSIJ+YLP/dR0wvrVbd7QSP2OVRAnMugmeekbIuyIKPNsNJ183Z4y1m/ihIdRAzLnjSYuYCdWw3LXl5gM0ZTtGb7K+cIYcyJrS3fcaErDmqyI/LJoXNTo5CJI=,iv:ycKt8/awCo3HoO6Oa8H77GH9+m+xgR4kiXb7Cbf0wSY=,tag:b6pBoZs+E4CP+V9oZXrcoQ==,type:str] -postfix_ldap_aliases: ENC[AES256_GCM,data:SFCncYQAY2ZOA4d8YO58HQvUIRpevU6dX3BDv/pnB1JlvNmQH7oy4NZ4zf24/1i11EV7Z0NvPsa4sAqj8xRR++yyzeG9RQk3Pcst3AkFtA+MkNP0ueZJYsvLKyUE6G7UpzVVuLI+L5R121JrRp6+r5xqckOBNCBo73ulb7tC67hSfLA+ZNmDw+bKbshHej4l3hvM/c2sHLbcPp/+vxLXqthPR+y8lf6J/QgZ8Yzw1JxFVDO8ypaWpWZZvA3HbAzRJXxk2zxg+lpmgFsyzTXLZGhvf7NdRHUmTP9OgDFt/efhxpUvDYpDinzVOuFrYJGL/4U0LLvxtGQQaQ==,iv:dUx+BsJWaiZ6MeNB+OhrSxQf+co2USjJM5rKt7OP5GI=,tag:nOVLxEyIRSNnxGa8eHMmFQ==,type:str] +postfix_ldap_aliases: ENC[AES256_GCM,data:kpffdciWI08Of2fm2B1lZ4rOYIhWtoBTnpU1N0iwiStA81Yl/NMDgHDCVv79XY6SuFTCBd6npKNz/0ibBy1WDSrDQymV5MIUmWVPwLcBSNMjD0d69PJYdUDVLmyhNkjB2hEL9JaH1PiO4iBM5y9yZx1LT+zlauAZEJPFgO/MvjkMknHZPKnRpBtT8wKTWTYUtBvzQtlACLKdIF0t37Q2DZAMtWrAgsrH811zUbsxJbYDInvNDPDHZHS+ZfF0Q1vXDLWUm+zZij6KRAJdOuEU9dyzhU/t93+LO9zKADwyF1Xk+2Uh,iv:cEui6fcDDINpUUcLZxGwPBMP1PjQVNMdScgaWdnIJ80=,tag:/7/mZckPJ7YLuJMp/BqbOQ==,type:str] mautrix-telegram_env: ENC[AES256_GCM,data:2p5vYV+/vEDrrZItTcT1vxddv2tM7dLGBUmG+OXHccTzJ2UhyYpDGgUMr5KgObxvyssYBZTsvbV7QFN3sjcU/jVPx1qEUn6zyKO0HBQjrviVU3urx5zNOnCEHwDKyDrZ1Hu/CE6lpGNrtGlpewgOs/+84JZIZhC9qSuzDhN38sr4OGfMr29fMzafYC+TGHoZyA64GI9xz0KvXhwg6ci1hLtVWYEOFW2Nf8uLY8qkNLuDzA6bYx8rn3CEXoxiv0n4,iv:jmcWTyVkqu9nDc1ws2NxkMKrHPZ13i3jqDkk4Y0kejw=,tag:BjhmPc4lSbsZBmZ/q2CqGg==,type:str] sops: kms: [] @@ -32,8 +32,8 @@ sops: NEJBTHE2end1RDlHRTNFYlZjTjhib2cKmQRHpBKZ2DbQ5CfOwcSPfZAm9fnnpxUk +LcR8haK//O3N2uNf9etDW3VsT5ipPucCdFU1m/v9L5tcN6ZP8WP+w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2023-07-04T07:41:45Z" - mac: ENC[AES256_GCM,data:YLC02dhSSLl9C1B7wo/AJcY4a4zc1LIaA0PKH0H8uZ8I9Kh105yk4sc2cz15FVMLtkMeIdfnhmWxbnPyLbM0mA9bAYT9MQn65quEgDumr+XH0UW6m1e2S23/2fxTFH1xRWsu7/Kon/gdzLb5hf2m30eJAP7MrdpxDz28Q7ut1P4=,iv:9UC71WxpDt1bxWSu16Sc+OKpy6KmX0Ru+Q54LYuQCBU=,tag:CpNKSJem+XHimm+yzRpwaw==,type:str] + lastmodified: "2023-07-07T08:54:55Z" + mac: ENC[AES256_GCM,data:JlITbCiRVYkS9wWLxAOX3ZUtgtmBFiS4JeNt+3/prTScPVC3cqhZPx6UWfPh8hzS1NZGSJEy9J2roWm1DEZnj73cRmjwROAx/RiiGXJIkfxgUik4HFleIpKuOJ31Jkvl7m+YaEcgNail+KakKSy7H3Jf21Qu08fLGrN3kwt+JUA=,iv:GtuJrjnId9aU5f9o5hGYMNBN5FRB1OSLWCp9zFimhzA=,tag:RTL70JdR4C0UhXnMH01LPQ==,type:str] pgp: - created_at: "2023-04-23T17:48:54Z" enc: | From 105b2a0476d564a58b5dd28229ef7b544c5f9d18 Mon Sep 17 00:00:00 2001 From: Rouven Seifert Date: Fri, 7 Jul 2023 11:03:57 +0200 Subject: [PATCH 8/8] mail: include aliases in local recipient maps --- modules/mail.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/mail.nix b/modules/mail.nix index c68a5d3..3124c88 100644 --- a/modules/mail.nix +++ b/modules/mail.nix @@ -113,7 +113,7 @@ in mailbox_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp"; transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ]; - local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" "ldap:${config.sops.secrets."postfix_ldap_aliases".path}" ]; + local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" "ldap:${config.sops.secrets."postfix_ldap_aliases".path}" "$alias_maps" ]; }; }; dovecot2 = {