feat(modules/mail): init on server2

7 files changed, 181 insertions, 144 deletions

diff --git a/hosts/by-name/server2/configuration.nix b/hosts/by-name/server2/configuration.nix
index 70f663b..0e08f07 100644
--- a/hosts/by-name/server2/configuration.nix
+++ b/hosts/by-name/server2/configuration.nix
@@ -41,6 +41,10 @@
         "invidious-router.sils.li"
       ];
     };
+    mail = {
+      enable = true;
+      fqdn = "mail.foss-syndicate.org";
+    };
     nginx = {
       enable = true;
       redirects = {
diff --git a/modules/by-name/co/constants/module.nix b/modules/by-name/co/constants/module.nix
index fd00a34..4f241b6 100644
--- a/modules/by-name/co/constants/module.nix
+++ b/modules/by-name/co/constants/module.nix
@@ -31,6 +31,11 @@
       redis-mastodon = 991;
       matrix-synapse = 224;
       mautrix-whatsapp = 225;
+      knot-resolver = 997;
+      redis-rspamd = 989;
+      rspamd = 225;
+      opendkim = 221;
+      virtualMail = 5000;
 
       # As per the NixOS file, the uids should not be greater or equal to 400;
     };
@@ -47,6 +52,11 @@
       mastodon = 996;
       redis-mastodon = 991;
       matrix-synapse = 224;
+      knot-resolver = 997;
+      redis-rspamd = 989;
+      rspamd = 225;
+      opendkim = 221;
+      virtualMail = 5000;
 
       # The gid should match the uid. Thus should not be >= 400;
     };
diff --git a/modules/by-name/ma/mail/module.nix b/modules/by-name/ma/mail/module.nix
new file mode 100644
index 0000000..55f2fb8
--- /dev/null
+++ b/modules/by-name/ma/mail/module.nix
@@ -0,0 +1,167 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.vhack.mail;
+  all_admins = [
+    "sils@vhack.eu"
+    "soispha@vhack.eu"
+    "nightingale@vhack.eu"
+  ];
+in {
+  options.vhack.mail = {
+    enable = lib.mkEnableOption "sophisticated mail setup with simple-nixos-mailserver";
+    fqdn = lib.mkOption {
+      type = lib.types.str;
+      description = "The fqdn mailserver should be served on.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    vhack.persist.directories = [
+      {
+        directory = "/var/lib/mail/backup";
+        user = "virtualMail";
+        group = "virtualMail";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/mail/sieve";
+        user = "virtualMail";
+        group = "virtualMail";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/mail/vmail";
+        user = "virtualMail";
+        group = "virtualMail";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/mail/dkim";
+        user = "opendkim";
+        group = "opendkim";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/postfix/data";
+        user = "postfix";
+        group = "postfix";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/postfix/queue";
+        user = "postfix";
+        group = "postfix";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/rspamd";
+        user = "rspamd";
+        group = "rspamd";
+        mode = "0700";
+      }
+    ];
+    vhack.nginx.enable = true;
+    security.acme.certs = {
+      "${cfg.fqdn}" = {
+        domain = cfg.fqdn;
+      };
+    };
+    mailserver = {
+      enable = true;
+      inherit (cfg) fqdn;
+
+      useFsLayout = true;
+
+      extraVirtualAliases = {
+        "abuse@vhack.eu" = all_admins;
+        "postmaster@vhack.eu" = all_admins;
+        "admin@vhack.eu" = all_admins;
+      };
+
+      mailDirectory = "/var/lib/mail/vmail";
+      dkimKeyDirectory = "/var/lib/mail/dkim";
+      sieveDirectory = "/var/lib/mail/sieve";
+      backup.snapshotRoot = "/var/lib/mail/backup";
+
+      enableImap = false;
+      enableImapSsl = true;
+      enablePop3 = false;
+      enablePop3Ssl = true;
+      # SMTP
+      enableSubmission = false;
+      enableSubmissionSsl = true;
+      openFirewall = true;
+
+      keyFile = "/var/lib/acme/${cfg.fqdn}/key.pem";
+      certificateScheme = "acme";
+      certificateFile = "/var/lib/acme/${cfg.fqdn}/fullchain.pem";
+
+      domains = [
+        "vhack.eu"
+
+        "s-schoeffel.de"
+        "b-peetz.de"
+
+        "sils.li"
+        "nightingale.sils.li"
+        "sils.sils.li"
+      ];
+
+      loginAccounts = {
+        "sils@vhack.eu" = {
+          hashedPassword = "$2b$05$RW/Svgk7iGxvP5W7ZwUZ1e.a3fj4fteevb2MtfFYYD0d1DQ17y9Fm";
+        };
+        "soispha@vhack.eu" = {
+          hashedPassword = "$2b$05$XX36sJuHNbTFvi8DFldscOeQBHahluSkiUqD9QGzQaET7NJusSuQW";
+        };
+
+        "benedikt.peetz@b-peetz.de" = {
+          hashedPassword = "$2b$05$MfET8utot2OolPZNASqoDe4VXNoG2chnEWhdfQ2E92mit0TvI2gBy";
+          aliases = ["@b-peetz.de"];
+        };
+        "silas.schoeffel@s-schoeffel.de" = {
+          hashedPassword = "$2b$05$Qb8rl7ncpCcTbsSdsduJBuOITp8RTD6sfOTjuxJsVtD9vjAYY9n8e";
+          aliases = ["@s-schoeffel.de"];
+        };
+
+        "nightingale@vhack.eu" = {
+          hashedPassword = "$2b$05$nDKVVq1EktKXWqGFhnOLP.plLovXFyvWSuptK9GIkxA5DScKFx6YS";
+          aliases = [
+            "@nightingale.sils.li"
+          ];
+        };
+        "sils@sils.li" = {
+          hashedPassword = "$2b$05$Ebzh2ZhuWkz1p4tqJ172IejNZg10FtCxPDY4k6umYrpirXg7ezIRq";
+          aliases = [
+            "@sils.sils.li"
+            "@sils.li"
+          ];
+        };
+
+        # Mail-Account used by hosted software
+        "mastodon@vhack.eu" = {
+          hashedPassword = "$2b$05$pSby3x2p3cHg0FyAE8IiJ.nYUqtAIR10JA8HNpHwMAiLXqc.ltSK.";
+        };
+        "peertube@vhack.eu" = {
+          hashedPassword = "$y$j9T$hyWQ8Awd2Xrc6qsK.2hwE1$LxACfaeW.yHGbkQL95dWtID9.zXL/aMwT6lp.yU/0g0";
+        };
+      };
+    };
+
+    users = {
+      users = {
+        knot-resolver.uid = config.vhack.constants.ids.uids.knot-resolver;
+        redis-rspamd.uid = config.vhack.constants.ids.uids.redis-rspamd;
+        rspamd.uid = config.vhack.constants.ids.uids.rspamd;
+      };
+      groups = {
+        knot-resolver.gid = lib.mkForce config.vhack.constants.ids.gids.knot-resolver;
+        redis-rspamd.gid = config.vhack.constants.ids.gids.redis-rspamd;
+        rspamd.gid = config.vhack.constants.ids.gids.rspamd;
+      };
+    };
+  };
+}
diff --git a/system/services/default.nix b/system/services/default.nix
index 4d3700d..2b13f32 100644
--- a/system/services/default.nix
+++ b/system/services/default.nix
@@ -1,7 +1,6 @@
 {...}: {
   imports = [
     ./invidious
-    ./mail
     ./minecraft
     ./taskserver
   ];
diff --git a/system/services/mail/default.nix b/system/services/mail/default.nix
deleted file mode 100644
index c69e6bd..0000000
--- a/system/services/mail/default.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{lib, ...}: let
-  all_admins = [
-    "sils@vhack.eu"
-    "soispha@vhack.eu"
-    "nightingale@vhack.eu"
-  ];
-  users = import ./users.nix {};
-in {
-  imports = [
-    ./impermanence.nix
-  ];
-
-  mailserver =
-    lib.recursiveUpdate {
-      enable = true;
-      fqdn = "server1.vhack.eu";
-
-      useFsLayout = true;
-
-      extraVirtualAliases = {
-        "abuse@vhack.eu" = all_admins;
-        "postmaster@vhack.eu" = all_admins;
-        "admin@vhack.eu" = all_admins;
-      };
-
-      mailDirectory = "/var/lib/mail/vmail";
-      dkimKeyDirectory = "/var/lib/mail/dkim";
-      sieveDirectory = "/var/lib/mail/sieve";
-      backup.snapshotRoot = "/var/lib/mail/backup";
-
-      enableImap = false;
-      enableImapSsl = true;
-      enablePop3 = false;
-      enablePop3Ssl = true;
-      # SMTP
-      enableSubmission = false;
-      enableSubmissionSsl = true;
-      openFirewall = true;
-
-      keyFile = "/var/lib/acme/server1.vhack.eu/key.pem";
-      certificateScheme = "acme";
-      certificateFile = "/var/lib/acme/server1.vhack.eu/fullchain.pem";
-    }
-    users;
-}
diff --git a/system/services/mail/impermanence.nix b/system/services/mail/impermanence.nix
deleted file mode 100644
index 22a5318..0000000
--- a/system/services/mail/impermanence.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{...}: {
-  vhack.persist.directories = [
-    {
-      directory = "/var/lib/mail/backup";
-      user = "virtualMail";
-      group = "virtualMail";
-      mode = "0700";
-    }
-    {
-      directory = "/var/lib/mail/sieve";
-      user = "virtualMail";
-      group = "virtualMail";
-      mode = "0700";
-    }
-    {
-      directory = "/var/lib/mail/vmail";
-      user = "virtualMail";
-      group = "virtualMail";
-      mode = "0700";
-    }
-    {
-      directory = "/var/lib/mail/dkim";
-      user = "opendkim";
-      group = "opendkim";
-      mode = "0700";
-    }
-    {
-      directory = "/var/lib/postfix/data";
-      user = "postfix";
-      group = "postfix";
-      mode = "0700";
-    }
-    {
-      directory = "/var/lib/postfix/queue";
-      user = "postfix";
-      group = "postfix";
-      mode = "0700";
-    }
-    {
-      directory = "/var/lib/rspamd";
-      user = "rspamd";
-      group = "rspamd";
-      mode = "0700";
-    }
-  ];
-}
diff --git a/system/services/mail/users.nix b/system/services/mail/users.nix
deleted file mode 100644
index 0bae1a7..0000000
--- a/system/services/mail/users.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{...}: {
-  domains = [
-    "vhack.eu"
-
-    "s-schoeffel.de"
-    "b-peetz.de"
-
-    "sils.li"
-    "nightingale.sils.li"
-    "sils.sils.li"
-  ];
-
-  loginAccounts = {
-    "sils@vhack.eu" = {
-      hashedPassword = "$2b$05$RW/Svgk7iGxvP5W7ZwUZ1e.a3fj4fteevb2MtfFYYD0d1DQ17y9Fm";
-    };
-    "soispha@vhack.eu" = {
-      hashedPassword = "$2b$05$XX36sJuHNbTFvi8DFldscOeQBHahluSkiUqD9QGzQaET7NJusSuQW";
-    };
-
-    "benedikt.peetz@b-peetz.de" = {
-      hashedPassword = "$2b$05$MfET8utot2OolPZNASqoDe4VXNoG2chnEWhdfQ2E92mit0TvI2gBy";
-      aliases = ["@b-peetz.de"];
-    };
-    "silas.schoeffel@s-schoeffel.de" = {
-      hashedPassword = "$2b$05$Qb8rl7ncpCcTbsSdsduJBuOITp8RTD6sfOTjuxJsVtD9vjAYY9n8e";
-      aliases = ["@s-schoeffel.de"];
-    };
-
-    "nightingale@vhack.eu" = {
-      hashedPassword = "$2b$05$nDKVVq1EktKXWqGFhnOLP.plLovXFyvWSuptK9GIkxA5DScKFx6YS";
-      aliases = [
-        "@nightingale.sils.li"
-      ];
-    };
-    "sils@sils.li" = {
-      hashedPassword = "$2b$05$Ebzh2ZhuWkz1p4tqJ172IejNZg10FtCxPDY4k6umYrpirXg7ezIRq";
-      aliases = [
-        "@sils.sils.li"
-        "@sils.li"
-      ];
-    };
-
-    # Mail-Account used by hosted software
-    "mastodon@vhack.eu" = {
-      hashedPassword = "$2b$05$pSby3x2p3cHg0FyAE8IiJ.nYUqtAIR10JA8HNpHwMAiLXqc.ltSK.";
-    };
-    "peertube@vhack.eu" = {
-      hashedPassword = "$y$j9T$hyWQ8Awd2Xrc6qsK.2hwE1$LxACfaeW.yHGbkQL95dWtID9.zXL/aMwT6lp.yU/0g0";
-    };
-  };
-}