Merge branch 'main' into kpp

modules/ldap/0001-update-user-validation-regex.patch

@@ -0,0 +1,25 @@
+From f5c68898be345fb0dca5ab7b596b9cbe674f5dfb Mon Sep 17 00:00:00 2001
+From: Rouven Seifert <rouven@rfive.de>
+Date: Tue, 4 Jul 2023 15:14:00 +0200
+Subject: [PATCH] update user validation regex
+
+---
+ internal/core/validation.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/internal/core/validation.go b/internal/core/validation.go
+index 3e168b5..10dfc0a 100644
+--- a/internal/core/validation.go
++++ b/internal/core/validation.go
+@@ -30,7 +30,7 @@ import (
+ )
+ 
+ //this regexp copied from useradd(8) manpage
+-const posixAccountNamePattern = `[a-z_][a-z0-9_-]*\$?`
++const posixAccountNamePattern = `[a-z_][a-z0-9._-]*\$?`
+ 
+ var (
+ 	errIsMissing      = errors.New("is missing")
+-- 
+2.41.0
+

modules/ldap/default.nix

@@ -48,6 +48,9 @@ in
 
   services.portunus = {
     enable = true;
+    package = pkgs.portunus.overrideAttrs (old: {
+      patches = [ ./0001-update-user-validation-regex.patch ];
+    });
     user = "${portunusUser}";
     group = "${portunusGroup}";
     domain = "${domain}";
@@ -65,7 +68,7 @@ in
       #tls = true;
     };
 
-    seedPath = ../config/portunus_seeds.json;
+    seedPath = ../../config/portunus_seeds.json;
   };
 
   #users.ldap = {
@@ -123,18 +126,4 @@ in
       };
     };
   };
-
-  # nixpkgs.overlays = [
-  #   (self: super:
-  #     {
-  #       portunus = super.portunus.overrideAttrs (old: {
-  #         src = super.fetchFromGitHub {
-  #           owner = "revol-xut";
-  #           repo = "portunus";
-  #           rev = "4dc29febacb11c613785bc95352fa00e0ca9b14a";
-  #           sha256 = "sha256-6O2392aHXhgvgZf6ftDY5Bh6hG3OzzCnlriig/Vkkz8=";
-  #         };
-  #       });
-  #     })
-  # ];
 }

modules/mail.nix

@@ -39,7 +39,7 @@ in
       domain = "${domain}";
       origin = "${domain}";
       destination = [ "${hostname}" "${domain}" "localhost" ];
-      networks = [ "127.0.0.1" "141.30.30.169" ];
+      networksStyle = "host"; # localhost and own public IP
       sslCert = "/var/lib/acme/${hostname}/fullchain.pem";
       sslKey = "/var/lib/acme/${hostname}/key.pem";
       relayDomains = [ "hash:/var/lib/mailman/data/postfix_domains" ];
@@ -61,9 +61,13 @@ in
         dumper:         root
         operator:       root
         abuse:          postmaster
+        postmaster:     root
 
         # trap decode to catch security attacks
         decode:         root
+
+        # yeet into the void
+        noreply:        /dev/null
       '';
       config = {
         home_mailbox = "Maildir/";
@@ -98,6 +102,7 @@ in
         ];
         # smtpd_sender_login_maps = [ "ldap:${ldap-senders}" ];
         alias_maps = [ "hash:/etc/aliases" ];
+        alias_database = [ "hash:/etc/aliases" ];
         # alias_maps = [ "hash:/etc/aliases" "ldap:${ldap-aliases}" ];
         smtpd_milters = [ "local:/run/opendkim/opendkim.sock" ];
         non_smtpd_milters = [ "local:/var/run/opendkim/opendkim.sock" ];
@@ -105,10 +110,10 @@ in
         smtpd_sasl_path = "/var/lib/postfix/auth";
         smtpd_sasl_type = "dovecot";
         #mailman stuff
-        local_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
+        mailbox_transport = "lmtp:unix:/run/dovecot2/dovecot-lmtp";
 
         transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
-        local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" "ldap:${config.sops.secrets."postfix_ldap_aliases".path}" ];
+        local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" "ldap:${config.sops.secrets."postfix_ldap_aliases".path}" "$alias_maps" ];
       };
     };
     dovecot2 = {
@@ -152,37 +157,36 @@ in
         pkgs.dovecot_pigeonhole
       ];
       extraConfig = ''
-          auth_username_format = %Ln
-          passdb {
-            driver = ldap
-            args = ${dovecot-ldap-args}
+        auth_username_format = %Ln
+        passdb {
+          driver = ldap
+          args = ${dovecot-ldap-args}
+        }
+        userdb {
+          driver = ldap
+          args = ${dovecot-ldap-args}
+        }
+        service auth {
+          unix_listener /var/lib/postfix/auth {
+            group = postfix
+            mode = 0660
+            user = postfix
           }
-          userdb {
-            driver = ldap
-            args = ${dovecot-ldap-args}
+        }
+        service managesieve-login {
+          inet_listener sieve {
+            port = 4190
           }
-          service auth {
-            unix_listener /var/lib/postfix/auth {
-                 group = postfix
-                 mode = 0660
-                 user = postfix
-              }
+          service_count = 1
+        }
+        service lmtp {
+          unix_listener dovecot-lmtp {
+            group = postfix
+            mode = 0600
+            user = postfix
           }
-        	service managesieve-login {
-        	  inet_listener sieve {
-        	    port = 4190
-        	  }
-        	
-        	  service_count = 1
-        	}
-        	service lmtp {
-        	 unix_listener dovecot-lmtp {
-        	   group = postfix
-        	   mode = 0600
-        	   user = postfix
-        	  }
-        	  client_limit = 1
-        	}
+          client_limit = 1
+        }
       '';
     };
     opendkim = {
@@ -190,7 +194,7 @@ in
       domains = "csl:${config.fsr.domain}";
       selector = config.networking.hostName;
       configFile = pkgs.writeText "opendkim-config" ''
-        UMask                   0117
+        UMask 0117
       '';
     };
     rspamd = {