feat(modules/mail): init on server2

2 files changed, 177 insertions, 0 deletions

diff --git a/modules/by-name/co/constants/module.nix b/modules/by-name/co/constants/module.nix
index fd00a34..4f241b6 100644
--- a/modules/by-name/co/constants/module.nix
+++ b/modules/by-name/co/constants/module.nix
@@ -31,6 +31,11 @@
       redis-mastodon = 991;
       matrix-synapse = 224;
       mautrix-whatsapp = 225;
+      knot-resolver = 997;
+      redis-rspamd = 989;
+      rspamd = 225;
+      opendkim = 221;
+      virtualMail = 5000;
 
       # As per the NixOS file, the uids should not be greater or equal to 400;
     };
@@ -47,6 +52,11 @@
       mastodon = 996;
       redis-mastodon = 991;
       matrix-synapse = 224;
+      knot-resolver = 997;
+      redis-rspamd = 989;
+      rspamd = 225;
+      opendkim = 221;
+      virtualMail = 5000;
 
       # The gid should match the uid. Thus should not be >= 400;
     };
diff --git a/modules/by-name/ma/mail/module.nix b/modules/by-name/ma/mail/module.nix
new file mode 100644
index 0000000..55f2fb8
--- /dev/null
+++ b/modules/by-name/ma/mail/module.nix
@@ -0,0 +1,167 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.vhack.mail;
+  all_admins = [
+    "sils@vhack.eu"
+    "soispha@vhack.eu"
+    "nightingale@vhack.eu"
+  ];
+in {
+  options.vhack.mail = {
+    enable = lib.mkEnableOption "sophisticated mail setup with simple-nixos-mailserver";
+    fqdn = lib.mkOption {
+      type = lib.types.str;
+      description = "The fqdn mailserver should be served on.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    vhack.persist.directories = [
+      {
+        directory = "/var/lib/mail/backup";
+        user = "virtualMail";
+        group = "virtualMail";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/mail/sieve";
+        user = "virtualMail";
+        group = "virtualMail";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/mail/vmail";
+        user = "virtualMail";
+        group = "virtualMail";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/mail/dkim";
+        user = "opendkim";
+        group = "opendkim";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/postfix/data";
+        user = "postfix";
+        group = "postfix";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/postfix/queue";
+        user = "postfix";
+        group = "postfix";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/rspamd";
+        user = "rspamd";
+        group = "rspamd";
+        mode = "0700";
+      }
+    ];
+    vhack.nginx.enable = true;
+    security.acme.certs = {
+      "${cfg.fqdn}" = {
+        domain = cfg.fqdn;
+      };
+    };
+    mailserver = {
+      enable = true;
+      inherit (cfg) fqdn;
+
+      useFsLayout = true;
+
+      extraVirtualAliases = {
+        "abuse@vhack.eu" = all_admins;
+        "postmaster@vhack.eu" = all_admins;
+        "admin@vhack.eu" = all_admins;
+      };
+
+      mailDirectory = "/var/lib/mail/vmail";
+      dkimKeyDirectory = "/var/lib/mail/dkim";
+      sieveDirectory = "/var/lib/mail/sieve";
+      backup.snapshotRoot = "/var/lib/mail/backup";
+
+      enableImap = false;
+      enableImapSsl = true;
+      enablePop3 = false;
+      enablePop3Ssl = true;
+      # SMTP
+      enableSubmission = false;
+      enableSubmissionSsl = true;
+      openFirewall = true;
+
+      keyFile = "/var/lib/acme/${cfg.fqdn}/key.pem";
+      certificateScheme = "acme";
+      certificateFile = "/var/lib/acme/${cfg.fqdn}/fullchain.pem";
+
+      domains = [
+        "vhack.eu"
+
+        "s-schoeffel.de"
+        "b-peetz.de"
+
+        "sils.li"
+        "nightingale.sils.li"
+        "sils.sils.li"
+      ];
+
+      loginAccounts = {
+        "sils@vhack.eu" = {
+          hashedPassword = "$2b$05$RW/Svgk7iGxvP5W7ZwUZ1e.a3fj4fteevb2MtfFYYD0d1DQ17y9Fm";
+        };
+        "soispha@vhack.eu" = {
+          hashedPassword = "$2b$05$XX36sJuHNbTFvi8DFldscOeQBHahluSkiUqD9QGzQaET7NJusSuQW";
+        };
+
+        "benedikt.peetz@b-peetz.de" = {
+          hashedPassword = "$2b$05$MfET8utot2OolPZNASqoDe4VXNoG2chnEWhdfQ2E92mit0TvI2gBy";
+          aliases = ["@b-peetz.de"];
+        };
+        "silas.schoeffel@s-schoeffel.de" = {
+          hashedPassword = "$2b$05$Qb8rl7ncpCcTbsSdsduJBuOITp8RTD6sfOTjuxJsVtD9vjAYY9n8e";
+          aliases = ["@s-schoeffel.de"];
+        };
+
+        "nightingale@vhack.eu" = {
+          hashedPassword = "$2b$05$nDKVVq1EktKXWqGFhnOLP.plLovXFyvWSuptK9GIkxA5DScKFx6YS";
+          aliases = [
+            "@nightingale.sils.li"
+          ];
+        };
+        "sils@sils.li" = {
+          hashedPassword = "$2b$05$Ebzh2ZhuWkz1p4tqJ172IejNZg10FtCxPDY4k6umYrpirXg7ezIRq";
+          aliases = [
+            "@sils.sils.li"
+            "@sils.li"
+          ];
+        };
+
+        # Mail-Account used by hosted software
+        "mastodon@vhack.eu" = {
+          hashedPassword = "$2b$05$pSby3x2p3cHg0FyAE8IiJ.nYUqtAIR10JA8HNpHwMAiLXqc.ltSK.";
+        };
+        "peertube@vhack.eu" = {
+          hashedPassword = "$y$j9T$hyWQ8Awd2Xrc6qsK.2hwE1$LxACfaeW.yHGbkQL95dWtID9.zXL/aMwT6lp.yU/0g0";
+        };
+      };
+    };
+
+    users = {
+      users = {
+        knot-resolver.uid = config.vhack.constants.ids.uids.knot-resolver;
+        redis-rspamd.uid = config.vhack.constants.ids.uids.redis-rspamd;
+        rspamd.uid = config.vhack.constants.ids.uids.rspamd;
+      };
+      groups = {
+        knot-resolver.gid = lib.mkForce config.vhack.constants.ids.gids.knot-resolver;
+        redis-rspamd.gid = config.vhack.constants.ids.gids.redis-rspamd;
+        rspamd.gid = config.vhack.constants.ids.gids.rspamd;
+      };
+    };
+  };
+}