chore: restructure LDAP related nix files

sp-modules/simple-nixos-mailserver/config.nix

@@ -1,6 +1,71 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 let
   sp = config.selfprivacy;
+
+  inherit (import ./common.nix {inherit config pkgs;})
+    auth-passthru
+    domain
+    is-auth-enabled
+    ;
+
+  mailserver-service-account-name = "sp.mailserver.service-account";
+  mailserver-service-account-token-name = "mailserver-service-account-token";
+  mailserver-service-account-token-fp =
+    "/run/keys/mailserver/kanidm-service-account-token"; # FIXME sync with auth module
+  kanidmExecStartPostScriptRoot = pkgs.writeShellScript
+    "mailserver-kanidm-ExecStartPost-root-script.sh"
+    ''
+      # set-group-ID bit allows for kanidm user to create files,
+      mkdir -p -v --mode=u+rwx,g+rs,g-w,o-rwx /run/keys/mailserver
+      chown kanidm:kanidm /run/keys/mailserver
+    '';
+  kanidmExecStartPostScript = pkgs.writeShellScript
+    "mailserver-kanidm-ExecStartPost-script.sh"
+    ''
+      export HOME=$RUNTIME_DIRECTORY/client_home
+      readonly KANIDM="${pkgs.kanidm}/bin/kanidm"
+
+      # get Kanidm service account for mailserver
+      KANIDM_SERVICE_ACCOUNT="$($KANIDM service-account list --name idm_admin | grep -E "^name: ${mailserver-service-account-name}$")"
+      echo KANIDM_SERVICE_ACCOUNT: "$KANIDM_SERVICE_ACCOUNT"
+      if [ -n "$KANIDM_SERVICE_ACCOUNT" ]
+      then
+          echo "kanidm service account \"${mailserver-service-account-name}\" is found"
+      else
+          echo "kanidm service account \"${mailserver-service-account-name}\" is not found"
+          echo "creating new kanidm service account \"${mailserver-service-account-name}\""
+          if $KANIDM service-account create --name idm_admin ${mailserver-service-account-name} ${mailserver-service-account-name} idm_admin
+          then
+              "kanidm service account \"${mailserver-service-account-name}\" created"
+          else
+              echo "error: cannot create kanidm service account \"${mailserver-service-account-name}\""
+              exit 1
+          fi
+      fi
+
+      # add Kanidm service account to `idm_mail_servers` group
+      $KANIDM group add-members idm_mail_servers ${mailserver-service-account-name}
+
+      # create a new read-only token for mailserver
+      if ! KANIDM_SERVICE_ACCOUNT_TOKEN_JSON="$($KANIDM service-account api-token generate --name idm_admin ${mailserver-service-account-name} ${mailserver-service-account-token-name} --output json)"
+      then
+          echo "error: kanidm CLI returns an error when trying to generate service-account api-token"
+          exit 1
+      fi
+      if ! KANIDM_SERVICE_ACCOUNT_TOKEN="$(echo "$KANIDM_SERVICE_ACCOUNT_TOKEN_JSON" | ${lib.getExe pkgs.jq} -r .result)"
+      then
+          echo "error: cannot get service-account API token from JSON"
+          exit 1
+      fi
+
+      if ! install --mode=640 \
+      <(printf "%s" "$KANIDM_SERVICE_ACCOUNT_TOKEN") \
+      ${mailserver-service-account-token-fp}
+      then
+          echo "error: cannot write token to \"${mailserver-service-account-token-fp}\""
+          exit 1
+      fi
+    '';
 in
 lib.mkIf sp.modules.simple-nixos-mailserver.enable
 {
@@ -42,7 +107,7 @@ lib.mkIf sp.modules.simple-nixos-mailserver.enable
 
     # A list of all login accounts. To create the password hashes, use
     # mkpasswd -m sha-512 "super secret password"
-    loginAccounts = {
+    loginAccounts = lib.mkIf (!is-auth-enabled) ({
       "${sp.username}@${sp.domain}" = {
         hashedPassword = sp.hashedMasterPassword;
         sieveScript = ''
@@ -69,9 +134,9 @@ lib.mkIf sp.modules.simple-nixos-mailserver.enable
           '';
         };
       })
-      sp.users);
+      sp.users));
 
-    extraVirtualAliases = {
+    extraVirtualAliases = lib.mkIf (!is-auth-enabled) {
       "admin@${sp.domain}" = "${sp.username}@${sp.domain}";
     };
 
@@ -90,6 +155,26 @@ lib.mkIf sp.modules.simple-nixos-mailserver.enable
     enableManageSieve = true;
 
     virusScanning = false;
+
+    mailDirectory = "/var/vmail";
+
+    # LDAP is needed for Postfix to query Kanidm about email address ownership.
+    # LDAP is needed for Dovecot also.
+    ldap = lib.mkIf is-auth-enabled {
+      # false; otherwise, simple-nixos-mailserver enables auth via LDAP
+      enable = false;
+
+      # bind.dn = "uid=mail,ou=persons," + ldap_base_dn;
+      bind.dn = "dn=token";
+      # TODO change in this file should trigger system restart dovecot
+      bind.passwordFile = "/run/keys/mailserver/kanidm-service-account-token"; # FIXME
+
+      # searchBase = "ou=persons," + ldap_base_dn;
+      searchBase = auth-passthru.ldap-base-dn; # TODO refine this
+
+      # NOTE: 127.0.0.1 instead of localhost doesn't work (maybe because of TLS)
+      uris = [ "ldaps://localhost:${toString auth-passthru.ldap-port}" ];
+    };
   };
 
   systemd = {
@@ -99,6 +184,15 @@ lib.mkIf sp.modules.simple-nixos-mailserver.enable
       rspamd.serviceConfig.Slice = "simple_nixos_mailserver.slice";
       redis-rspamd.serviceConfig.Slice = "simple_nixos_mailserver.slice";
       opendkim.serviceConfig.Slice = "simple_nixos_mailserver.slice";
+      # FIXME set auth module option instead
+      kanidm.serviceConfig.ExecStartPost =
+        lib.mkIf is-auth-enabled
+          (lib.mkAfter
+            [
+              ("+" + kanidmExecStartPostScriptRoot)
+              kanidmExecStartPostScript
+            ]
+          );
     };
     slices."simple_nixos_mailserver" = {
       name = "simple_nixos_mailserver.slice";