jackos1998
d51f2d62b6
Add a top-level README mapping the boxes and a full docs/ tree: topic pages (architecture, networking, deployment), per-site box pages for colony and home with containers nested under their hosts, remote and mobile boxes, the installer, and the home switch fabric reference (folded in from home-switches.md, with AGENTS.md and code comments retargeted to its new home). Box pages carry marked assignment tables that CI regenerates from nixos.allAssignments. AGENTS.md points at the new docs and keeps its terse agent version of the mechanics, referring to the topic pages for depth.
1.5 KiB
1.5 KiB
A Debian VM running mailcow (mail.nul.ie) — the
mail server for nul.ie. Declared in colony's my.vms.instances but not
a NixOS system: everything inside the VM is configured out of band.
- Source (host-side only): the
mailinstance innixos/boxes/colony/vms/default.nixand the90-vm-mailnetwork innixos/boxes/colony/default.nix - Host: VM on
colony
Role
- Runs the full mailcow stack (Postfix/Dovecot/SOGo/Rspamd) for
nul.ie. Other colony services send through it asmail.nul.ie(e.g. Gitea, and the disabled Mastodon config). - 3 cores, 6 GiB RAM;
rootanddataLVM disks (thevm-mail-dataLV is included incolony'sborgthinbackups).
Networking
- Attaches to a dedicated, unbridged TAP (
vm-mail, MAC52:54:00:a8:d1:03).colonyputs the point-to-point address (custRouting.mail-vm) on the host side, link-routes the public /3294.142.241.227down the tap, and serves the IPv6 /642a0e:97c0:4d2:2000::/64with RAs. - DNS:
mail-vm.ams1.int.nul.ie(andmail.nul.iepublicly, incl. the PTR in estuary's reverse zone).estuaryaccepts traffic to the customer prefixes without per-port filtering;colonyforwards it on ("trust for now").
Notes
- ACME certificates are issued on
middlemanand pushed to the VM over SSH (acme@mail.nul.ie mailcow-ssl-reload, keymiddleman/mailcow-ssh.key); the VM's SSH host key is pinned at.keys/mail-vm-host.pub.