blob: e87e34b537811d1f2b0c3bcd60502edf5c3c029c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
{
config,
inputs,
lib,
...
}:
with lib; {
imports = [inputs.simple-nixos-mailserver.nixosModule];
ark.directories = with config.mailserver; [
"/var/lib/dovecot"
"/var/lib/postfix"
config.security.dhparams.params.dovecot2.path
dkimKeyDirectory
mailDirectory
sieveDirectory
];
secrets = with config.mailserver; {
dkim-key-azahi-cc = {
file = "${inputs.self}/secrets/dkim-key-azahi-cc";
path = "${dkimKeyDirectory}/${my.domain.azahi}.${dkimSelector}.key";
owner = config.services.opendkim.user;
inherit (config.services.opendkim) group;
};
dkim-key-rohan-net = {
file = "${inputs.self}/secrets/dkim-key-rohan-net";
path = "${dkimKeyDirectory}/${my.domain.rohan}.${dkimSelector}.key";
owner = config.services.opendkim.user;
inherit (config.services.opendkim) group;
};
dkim-key-gondor-net = {
file = "${inputs.self}/secrets/dkim-key-gondor-net";
path = "${dkimKeyDirectory}/${my.domain.gondor}.${dkimSelector}.key";
owner = config.services.opendkim.user;
inherit (config.services.opendkim) group;
};
dkim-key-shire-net = {
file = "${inputs.self}/secrets/dkim-key-shire-net";
path = "${dkimKeyDirectory}/${my.domain.shire}.${dkimSelector}.key";
owner = config.services.opendkim.user;
inherit (config.services.opendkim) group;
};
};
nixfiles.modules = {
acme.enable = true;
redis.enable = true;
};
mailserver = let
cert = config.certs.${my.domain.shire};
in {
enable = true;
fqdn = config.networking.domain;
domains = with my.domain; [azahi gondor rohan shire];
localDnsResolver = false;
certificateScheme = "manual";
certificateFile = "${cert.directory}/fullchain.pem";
keyFile = "${cert.directory}/key.pem";
lmtpSaveToDetailMailbox = "no";
redis = with config.services.redis.servers.default; {
address = bind;
inherit port;
password = requirePass;
};
loginAccounts = with my.domain; {
"azahi@${shire}" = {
hashedPassword = "@HASHED_PASSWORD@";
aliases = [
"@${azahi}"
"@${rohan}"
"@${gondor}"
"abuse@${shire}"
"admin@${shire}"
"ceo@${shire}"
"postmaster@${shire}"
"root@${shire}"
];
};
"samwise@${shire}" = {
hashedPassword = "@HASHED_PASSWORD@";
aliases = ["chad@${shire}"];
quota = "1G";
};
};
};
# https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/issues/241
services.redis.servers.rspamd.enable = mkForce false;
systemd.services.rspamd = {
requires = mkForce ["redis-default.service"];
after = mkForce ["redis-default.service"];
};
services.fail2ban.jails = {
dovecot = ''
enabled = true
mode = aggressive
'';
postfix = ''
enabled = true
mode = aggressive
'';
};
}
|
