parsedmarc: init

hosts/falkenstein/modules/monitoring/default.nix

@@ -3,6 +3,9 @@
   age.secrets."maxmind" = {
     file = ../../../../secrets/shared/maxmind.age;
   };
+  imports = [
+    ./dmarc.nix
+  ];
   users.users."promtail".extraGroups = [ "caddy" "systemd-journal" ];
   services.prometheus = {
     exporters = {

hosts/falkenstein/modules/monitoring/dmarc.nix

@@ -1,10 +1,35 @@
-{ ... }:
+{ config, ... }:
 {
+  age.secrets.dmarc = {
+    file = ../../../../secrets/falkenstein/dmarc.age;
+  };
   users.users.dmarc = {
     description = "DMARC Report recipient";
     isNormalUser = true;
   };
-  # services.parsedmarc = {
-  #   enable = true;
-  # };
+  networking.firewall.allowedTCPPorts = [ config.services.elasticsearch.tcp_port ];
+  services.parsedmarc = {
+    enable = true;
+    provision = {
+      grafana = {
+        dashboard = false;
+        datasource = false;
+      };
+      localMail.enable = false;
+      elasticsearch = false;
+      geoIp = false;
+    };
+    settings = {
+      imap = {
+        user = "dmarc@rfive.de";
+        port = 993;
+        host = "mail.rfive.de";
+        password = {
+          _secret = config.age.secrets.dmarc.path;
+        };
+      };
+      opensearch.hosts = "localhost:9200";
+    };
+  };
+  services.opensearch.enable = true;
 }

hosts/nuc/modules/monitoring/default.nix

@@ -3,9 +3,6 @@ let
   domain = "monitoring.${config.networking.domain}";
 in
 {
-  imports = [
-    ./dmarc.nix
-  ];
   age.secrets."grafana/oidc_secret" = {
     file = ../../../../secrets/nuc/grafana/oidc.age;
     owner = "grafana";

secrets.nix

@@ -36,6 +36,7 @@ in
   "secrets/falkenstein/wireguard/dorm/preshared.age".publicKeys = [ rouven falkenstein ];
   "secrets/falkenstein/borg/passphrase.age".publicKeys = [ rouven falkenstein ];
   "secrets/falkenstein/borg/key.age".publicKeys = [ rouven falkenstein ];
+  "secrets/falkenstein/dmarc.age".publicKeys = [ rouven falkenstein ];
 
   #shared
   "secrets/shared/maxmind.age".publicKeys = [ rouven nuc falkenstein ];

secrets/falkenstein/dmarc.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 uWbAHQ OVBZwLNH5ryKgNruVU0XRV2F5dDu7W9R3qMWz08Krzs
+vrXngscbxNRGfITXKM1uRNFRjUZRaWNpZ9ijSy+pERw
+-> ssh-ed25519 slrRig AIO7ny4bykCYWzLgCfd75dt00myFSd+waEv2/MEOpUY
+65u83G9Ew+idajuExoTb5URAnM1paEGFYsfQ3HqKvGg
+--- YoSI0kDXGCKQQCebjG8vzsTJMomjJ3RZWY0j+eG5U6U
+n„NÀSò]6e<36>™¸åp
‚!±ÍY° "²D&uöü2¾ÇŠÒy˜¾¯`<60>j