wurzel/fruitbasket
9
1
Fork 0
Code Issues 5 Pull requests Packages Projects Releases Wiki Activity

fixed sogo

Browse source
This commit is contained in:
Rouven Seifert 2023-07-04 12:45:51 +02:00
parent 4a5e91fb67
commit 7354c31da8
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
1 changed files with 74 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

67
modules/sogo.nix
View file

@ -1,4 +1,4 @@
{ config, pkgs, ... }:
{ config, pkgs, lib, ... }:
let
sogo-hostname = "mail.${config.fsr.domain}";
domain = config.fsr.domain;
@ -13,6 +13,7 @@ in
};
services = {
memcached.enable = true;
sogo = {
enable = true;
language = "German";
@ -22,6 +23,8 @@ in
type = ldap;
CNFieldName = cn;
UIDFieldName = uid;
IDFieldName = uid;
baseDN = "ou=users, dc=ifsr, dc=de";
bindDN = "uid=search, ou=users, dc=ifsr, dc=de";
bindPassword = LDAP_SEARCH;
@ -31,9 +34,9 @@ in
});
SOGoProfileURL = "postgresql://sogo:POSTGRES_PASSWORD@localhost:${pg-port}/sogo/sogo_user_profile";
SOGoFolderInfoURL = "postgreql://sogo:POSTGRES_PASSWORD@localhost:${pg-port}/sogo/sogo_folder_info";
OCSSessionsFolderURL = "postgresql://sogo:POSTGRES_PASSWORD@localhost:${pg-port}/sogo/sogo_sessions_folder";
''; # Hier ist bindPassword noch nicht vollständig
OCSFolderInfoURL = "postgresql://sogo:POSTGRES_PASSWORD@localhost:${pg-port}/sogo/sogo_folder_info";
'';
configReplaces = {
"LDAP_SEARCH" = config.sops.secrets.ldap_search.path;
"POSTGRES_PASSWORD" = config.sops.secrets.postgres_sogo.path;
@ -57,13 +60,41 @@ in
nginx = {
recommendedProxySettings = true;
virtualHosts."${sogo-hostname}" = {
extraConfig = ''
proxy_busy_buffers_size 64k;
proxy_buffers 8 64k;
proxy_buffer_size 64k;
'';
forceSSL = true;
enableACME = true;
locations = {
"/" = {
proxyPass = "http://127.0.0.1:20000";
proxyWebsockets = true;
};
"^~/SOGo".extraConfig = lib.mkForce ''
proxy_pass http://127.0.0.1:20000;
proxy_redirect http://127.0.0.1:20000 default;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_set_header x-webobjects-server-protocol HTTP/1.0;
proxy_set_header x-webobjects-remote-host 127.0.0.1;
proxy_set_header x-webobjects-server-port $server_port;
proxy_set_header x-webobjects-server-name $server_name;
proxy_set_header x-webobjects-server-url $scheme://$host;
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 90;
proxy_buffer_size 64k;
proxy_buffers 8 64k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
client_max_body_size 50m;
client_body_buffer_size 128k;
break;
'';
};
};
};
@ -71,6 +102,28 @@ in
systemd.services.sogo.after = [ "sogo-pgsetup.service" ];
# one of these prevents access to sendmail, don't know which one
systemd.services.sogo.serviceConfig = {
LockPersonality = lib.mkForce false;
MemoryDenyWriteExecute = lib.mkForce false;
NoNewPrivileges = lib.mkForce false;
PrivateDevices = lib.mkForce false;
PrivateUsers = lib.mkForce false;
ProtectClock = lib.mkForce false;
ProtectHostname = lib.mkForce false;
ProtectKernelLogs = lib.mkForce false;
ProtectKernelModules = lib.mkForce false;
ProtectKernelTunables = lib.mkForce false;
RestrictAddressFamilies = lib.mkForce [ ];
RestrictRealtime = lib.mkForce false;
RestrictSUIDSGID = lib.mkForce false;
SystemCallArchitectures = lib.mkForce "";
SystemCallFilter = lib.mkForce [ ];
ReadWriteDirectories = "/var/lib/postfix/queue/maildrop";
};
systemd.services.sogo-pgsetup = {
description = "Prepare Sogo postgres database";
wantedBy = [ "multi-user.target" ];