style: format tree
This commit is contained in:
nhnn
@@ -1,4 +1,9 @@
|
||||
{ config, lib, pkgs, ... }@nixos-args:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}@nixos-args:
|
||||
let
|
||||
sp = config.selfprivacy;
|
||||
|
||||
@@ -11,26 +16,22 @@ let
|
||||
mailserver-service-account = {
|
||||
mailserver-service-account-name = "sp.mailserver.service-account";
|
||||
mailserver-service-account-token-name = "mailserver-service-account-token";
|
||||
mailserver-service-account-token-fp =
|
||||
"/run/keys/${group}/kanidm-service-account-token"; # FIXME sync with auth module
|
||||
mailserver-service-account-token-fp = "/run/keys/${group}/kanidm-service-account-token"; # FIXME sync with auth module
|
||||
};
|
||||
in
|
||||
lib.mkIf sp.modules.simple-nixos-mailserver.enable (lib.mkMerge [
|
||||
{
|
||||
assertions = [
|
||||
{
|
||||
assertion =
|
||||
config.selfprivacy.modules.simple-nixos-mailserver.enableSso
|
||||
-> config.selfprivacy.sso.enable;
|
||||
message =
|
||||
"SSO cannot be enabled for Mailserver when SSO is disabled globally.";
|
||||
}
|
||||
];
|
||||
fileSystems = lib.mkIf sp.useBinds
|
||||
{
|
||||
lib.mkIf sp.modules.simple-nixos-mailserver.enable (
|
||||
lib.mkMerge [
|
||||
{
|
||||
assertions = [
|
||||
{
|
||||
assertion =
|
||||
config.selfprivacy.modules.simple-nixos-mailserver.enableSso -> config.selfprivacy.sso.enable;
|
||||
message = "SSO cannot be enabled for Mailserver when SSO is disabled globally.";
|
||||
}
|
||||
];
|
||||
fileSystems = lib.mkIf sp.useBinds {
|
||||
"/var/vmail" = {
|
||||
device =
|
||||
"/volumes/${sp.modules.simple-nixos-mailserver.location}/vmail";
|
||||
device = "/volumes/${sp.modules.simple-nixos-mailserver.location}/vmail";
|
||||
options = [
|
||||
"bind"
|
||||
"x-systemd.required-by=postfix.service"
|
||||
@@ -38,8 +39,7 @@ lib.mkIf sp.modules.simple-nixos-mailserver.enable (lib.mkMerge [
|
||||
];
|
||||
};
|
||||
"/var/sieve" = {
|
||||
device =
|
||||
"/volumes/${sp.modules.simple-nixos-mailserver.location}/sieve";
|
||||
device = "/volumes/${sp.modules.simple-nixos-mailserver.location}/sieve";
|
||||
options = [
|
||||
"bind"
|
||||
"x-systemd.required-by=dovecot2.service"
|
||||
@@ -48,114 +48,120 @@ lib.mkIf sp.modules.simple-nixos-mailserver.enable (lib.mkMerge [
|
||||
};
|
||||
};
|
||||
|
||||
users.users = {
|
||||
virtualMail = {
|
||||
isNormalUser = false;
|
||||
};
|
||||
};
|
||||
|
||||
users.groups.acmereceivers.members = [ "dovecot2" "postfix" "virtualMail" ];
|
||||
|
||||
mailserver = {
|
||||
enable = true;
|
||||
fqdn = sp.domain;
|
||||
domains = [ sp.domain ];
|
||||
localDnsResolver = false;
|
||||
|
||||
# A list of all login accounts. To create the password hashes, use
|
||||
# mkpasswd -m sha-512 "super secret password"
|
||||
loginAccounts = ({
|
||||
"${sp.username}@${sp.domain}" = {
|
||||
hashedPassword = sp.hashedMasterPassword;
|
||||
sieveScript = ''
|
||||
require ["fileinto", "mailbox"];
|
||||
if header :contains "Chat-Version" "1.0"
|
||||
{
|
||||
fileinto :create "DeltaChat";
|
||||
stop;
|
||||
}
|
||||
'';
|
||||
users.users = {
|
||||
virtualMail = {
|
||||
isNormalUser = false;
|
||||
};
|
||||
} // builtins.listToAttrs (builtins.map
|
||||
(user: {
|
||||
name = "${user.username}@${sp.domain}";
|
||||
value = {
|
||||
hashedPassword = user.hashedPassword;
|
||||
sieveScript = ''
|
||||
require ["fileinto", "mailbox"];
|
||||
if header :contains "Chat-Version" "1.0"
|
||||
{
|
||||
fileinto :create "DeltaChat";
|
||||
stop;
|
||||
}
|
||||
'';
|
||||
};
|
||||
})
|
||||
sp.users));
|
||||
|
||||
extraVirtualAliases = {
|
||||
"admin@${sp.domain}" = "${sp.username}@${sp.domain}";
|
||||
};
|
||||
|
||||
certificateScheme = "manual";
|
||||
certificateFile = "/var/lib/acme/root-${sp.domain}/fullchain.pem";
|
||||
keyFile = "/var/lib/acme/root-${sp.domain}/key.pem";
|
||||
users.groups.acmereceivers.members = [
|
||||
"dovecot2"
|
||||
"postfix"
|
||||
"virtualMail"
|
||||
];
|
||||
|
||||
# Enable IMAP and POP3
|
||||
enableImap = true;
|
||||
enableImapSsl = true;
|
||||
enablePop3 = false;
|
||||
enablePop3Ssl = false;
|
||||
dkimSelector = "selector";
|
||||
mailserver = {
|
||||
enable = true;
|
||||
fqdn = sp.domain;
|
||||
domains = [ sp.domain ];
|
||||
localDnsResolver = false;
|
||||
|
||||
# Enable the ManageSieve protocol
|
||||
enableManageSieve = true;
|
||||
# A list of all login accounts. To create the password hashes, use
|
||||
# mkpasswd -m sha-512 "super secret password"
|
||||
loginAccounts = (
|
||||
{
|
||||
"${sp.username}@${sp.domain}" = {
|
||||
hashedPassword = sp.hashedMasterPassword;
|
||||
sieveScript = ''
|
||||
require ["fileinto", "mailbox"];
|
||||
if header :contains "Chat-Version" "1.0"
|
||||
{
|
||||
fileinto :create "DeltaChat";
|
||||
stop;
|
||||
}
|
||||
'';
|
||||
};
|
||||
}
|
||||
// builtins.listToAttrs (
|
||||
builtins.map (user: {
|
||||
name = "${user.username}@${sp.domain}";
|
||||
value = {
|
||||
hashedPassword = user.hashedPassword;
|
||||
sieveScript = ''
|
||||
require ["fileinto", "mailbox"];
|
||||
if header :contains "Chat-Version" "1.0"
|
||||
{
|
||||
fileinto :create "DeltaChat";
|
||||
stop;
|
||||
}
|
||||
'';
|
||||
};
|
||||
}) sp.users
|
||||
)
|
||||
);
|
||||
|
||||
virusScanning = false;
|
||||
extraVirtualAliases = {
|
||||
"admin@${sp.domain}" = "${sp.username}@${sp.domain}";
|
||||
};
|
||||
|
||||
mailDirectory = "/var/vmail";
|
||||
};
|
||||
certificateScheme = "manual";
|
||||
certificateFile = "/var/lib/acme/root-${sp.domain}/fullchain.pem";
|
||||
keyFile = "/var/lib/acme/root-${sp.domain}/key.pem";
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
dovecot2.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
postfix.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
rspamd.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
redis-rspamd.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
opendkim.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
# Enable IMAP and POP3
|
||||
enableImap = true;
|
||||
enableImapSsl = true;
|
||||
enablePop3 = false;
|
||||
enablePop3Ssl = false;
|
||||
dkimSelector = "selector";
|
||||
|
||||
# Enable the ManageSieve protocol
|
||||
enableManageSieve = true;
|
||||
|
||||
virusScanning = false;
|
||||
|
||||
mailDirectory = "/var/vmail";
|
||||
};
|
||||
slices."simple_nixos_mailserver" = {
|
||||
name = "simple_nixos_mailserver.slice";
|
||||
description = "Simple NixOS Mailserver service slice";
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
dovecot2.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
postfix.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
rspamd.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
redis-rspamd.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
opendkim.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
};
|
||||
slices."simple_nixos_mailserver" = {
|
||||
name = "simple_nixos_mailserver.slice";
|
||||
description = "Simple NixOS Mailserver service slice";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
# the following parts are active only when "auth" module is enabled
|
||||
(lib.mkIf is-auth-enabled {
|
||||
mailserver = {
|
||||
extraVirtualAliases = lib.mkForce { };
|
||||
loginAccounts = lib.mkForce { };
|
||||
# LDAP is needed for Postfix to query Kanidm about email address ownership.
|
||||
# LDAP is needed for Dovecot also.
|
||||
ldap = {
|
||||
# false; otherwise, simple-nixos-mailserver enables auth via LDAP
|
||||
enable = false;
|
||||
}
|
||||
# the following parts are active only when "auth" module is enabled
|
||||
(lib.mkIf is-auth-enabled {
|
||||
mailserver = {
|
||||
extraVirtualAliases = lib.mkForce { };
|
||||
loginAccounts = lib.mkForce { };
|
||||
# LDAP is needed for Postfix to query Kanidm about email address ownership.
|
||||
# LDAP is needed for Dovecot also.
|
||||
ldap = {
|
||||
# false; otherwise, simple-nixos-mailserver enables auth via LDAP
|
||||
enable = false;
|
||||
|
||||
# bind.dn = "uid=mail,ou=persons," + ldap_base_dn;
|
||||
bind.dn = "dn=token";
|
||||
# TODO change in this file should trigger system restart dovecot
|
||||
bind.passwordFile =
|
||||
mailserver-service-account.mailserver-service-account-token-fp;
|
||||
# bind.dn = "uid=mail,ou=persons," + ldap_base_dn;
|
||||
bind.dn = "dn=token";
|
||||
# TODO change in this file should trigger system restart dovecot
|
||||
bind.passwordFile = mailserver-service-account.mailserver-service-account-token-fp;
|
||||
|
||||
# searchBase = "ou=persons," + ldap_base_dn;
|
||||
searchBase = auth-passthru.ldap-base-dn; # TODO refine this
|
||||
# searchBase = "ou=persons," + ldap_base_dn;
|
||||
searchBase = auth-passthru.ldap-base-dn; # TODO refine this
|
||||
|
||||
# NOTE: 127.0.0.1 instead of localhost doesn't work (maybe because of TLS)
|
||||
uris = [ "ldaps://localhost:${toString auth-passthru.ldap-port}" ];
|
||||
# NOTE: 127.0.0.1 instead of localhost doesn't work (maybe because of TLS)
|
||||
uris = [ "ldaps://localhost:${toString auth-passthru.ldap-port}" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
})
|
||||
(lib.mkIf is-auth-enabled
|
||||
(import ./auth-dovecot.nix mailserver-service-account nixos-args))
|
||||
(lib.mkIf is-auth-enabled (import ./auth-postfix.nix nixos-args))
|
||||
])
|
||||
})
|
||||
(lib.mkIf is-auth-enabled (import ./auth-dovecot.nix mailserver-service-account nixos-args))
|
||||
(lib.mkIf is-auth-enabled (import ./auth-postfix.nix nixos-args))
|
||||
]
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user