modules/mail: Allow configuration of pre-generated dkim keys

That is essential for tests, as we cannot start the server and _then_
manually adjust the DNS settings.
But also for general usage, using pre-generated keys is kinda nice, as
we don't need to remember to update the DNS settings upon server
re-deploy.

1 files changed, 52 insertions, 1 deletions

diff --git a/modules/vhack/ma/mail/module.nix b/modules/vhack/ma/mail/module.nix
index 75e20bb..034924a 100644
--- a/modules/vhack/ma/mail/module.nix
+++ b/modules/vhack/ma/mail/module.nix
@@ -222,6 +222,43 @@ in {
       '';
       default = {};
     };
+
+    security = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          dkimKeys = lib.mkOption {
+            type = lib.types.nullOr (lib.types.attrsOf (lib.types.submodule {
+              options = {
+                dkimPublicKey = lib.mkOption {
+                  type = lib.types.str;
+                  description = ''
+                    The base 64 encoded representation of the public dkim key.
+                  '';
+                };
+                dkimPrivateKeyPath = lib.mkOption {
+                  type = lib.types.path;
+                  description = ''
+                    Path to the file for the pre-generated dkim key file.
+                    Should not point to the nixos store.
+                  '';
+                };
+                keyAlgorithm = lib.mkOption {
+                  type = lib.types.enum ["ed25519-sha256" "rsa-sha-256" "rsa-sha-1"];
+                  description = "The algorithm of the used key";
+                };
+              };
+            }));
+            description = ''
+              Which key to use for which domain. The attr keys are the domains
+            '';
+            default = null;
+          };
+        };
+      };
+      description = ''
+        Security options.
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -284,7 +321,21 @@ in {
         path = "/var/lib/mail/vmail";
       };
 
-      dkim.keyDirectory = "/var/lib/mail/dkim";
+      dkim = let
+        dkimKeys =
+          builtins.mapAttrs (name: value: {
+            selectors."mail".keyFile =
+              value.dkimPrivateKeyPath;
+          })
+          cfg.security.dkimKeys;
+      in {
+        # domains."${cfg.fqdn}".selectors."mail" = lib.mkIf (cfg.dkimKey != null) {
+        #   keyFile = cfg.dkimKey;
+        # };
+        domains = lib.mkIf (cfg.security.dkimKeys != null) dkimKeys;
+        keyDirectory = lib.mkIf (cfg.security.dkimKeys == null) "/var/lib/mail/dkim";
+      };
+
       backup.snapshotRoot = "/var/lib/mail/backup";
 
       enableImap = false;