module/stalwart-mail: Init initial version

5 files changed, 947 insertions, 0 deletions

diff --git a/modules/by-name/st/stalwart-mail/module.nix b/modules/by-name/st/stalwart-mail/module.nix
new file mode 100644
index 0000000..e5a681e
--- /dev/null
+++ b/modules/by-name/st/stalwart-mail/module.nix
@@ -0,0 +1,334 @@
+{
+  lib,
+  config,
+  pkgs,
+  pkgsUnstable,
+  nixLib,
+  ...
+}: let
+  cfg = config.vhack.stalwart-mail;
+  topCfg = config.services.stalwart-mail;
+
+  configFormat = pkgs.formats.toml {};
+  configFile = configFormat.generate "stalwart-mail.toml" topCfg.settings;
+
+  spamfilter = pkgs.callPackage ./spam-filter.nix {};
+
+  stalwart-mail = pkgsUnstable.stalwart-mail.overrideAttrs (final: prev: {
+    passthru = nixLib.warnMerge (prev.passthru or {}) {
+      inherit spamfilter;
+    } "stalwart-mail passthru";
+
+    checkFlags =
+      (prev.checkFlags or [])
+      ++ [
+        # This started to fail?
+        # TODO(@bpeetz): Find out why. <2025-02-08>
+        "--skip=smtp::outbound::lmtp::lmtp_delivery"
+      ];
+
+    # `stalwart-mail` does enable their `enterprise` feature per default.
+    # We want a AGPL only build (i.e., without unfree dependencies), therefore disable the
+    # `enterprise` feature here.
+    # We cannot use the `buildFeatures` attribute because it does not actually change the
+    # correct features. As such we simply patch the correct `Cargo.toml` file.
+    patches =
+      (prev.patches or [])
+      ++ [
+        ./patches/build-crates-main-Cargo.toml-Activate-appropriate-de.patch
+        ./patches/fix-crates-directory-Guard-all-enterprise-only-featu.patch
+      ];
+
+    # Check that the enterprise feature is really disabled.
+    postCheck =
+      (prev.postCheck or "")
+      +
+      # bash
+      ''
+        if grep "enterprise" ./target/*/release/stalwart-mail.d; then
+          echo "ERROR: Proprietary 'enterprise' feature active."
+          exit 1
+        fi
+      '';
+  });
+in {
+  imports = [
+    ./settings.nix
+  ];
+
+  options.vhack.stalwart-mail = {
+    enable = lib.mkEnableOption "starwart-mail";
+
+    # package = lib.mkPackageOption pkgsUnstable "stalwart-mail" {pkgsText = "pkgsUnstable";};
+    package = lib.mkOption {
+      description = "The stalwart-mail package to use";
+      type = lib.types.package;
+      default = stalwart-mail;
+    };
+
+    fqdn = lib.mkOption {
+      type = lib.types.str;
+      example = "mail.foss-syndicate.org";
+      description = ''
+        The fully qualified domain name for this mail server.
+      '';
+    };
+
+    principals = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule {
+        options = {
+          name = lib.mkOption {
+            type = lib.types.str;
+            description = "Specifies the username of the account";
+          };
+
+          class = lib.mkOption {
+            type = lib.types.enum ["individual" "admin"];
+            description = "Specifies the account type";
+          };
+
+          description = lib.mkOption {
+            type = lib.types.str;
+            description = "Provides a description or full name for the user";
+            default = "";
+          };
+
+          secret = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Sets the password for the user account.
+              Passwords can be stored hashed or in plain text (not recommended).
+              See <https://stalw.art/docs/auth/authentication/password/> for a description
+              of password encoding.
+            '';
+          };
+          email = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            description = ''
+              A list of email addresses associated with the user.
+              The first address in the list is considered the primary address.
+            '';
+          };
+        };
+      });
+    };
+
+    dataDirectory = lib.mkOption {
+      description = ''
+        The directory in which to store all storage things.
+      '';
+      default = "/var/lib/stalwart-mail";
+      type = lib.types.path;
+      readOnly = true;
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to open TCP firewall ports, which are specified in
+        {option}`services.stalwart-mail.settings.listener` on all interfaces.
+      '';
+    };
+
+    security = lib.mkOption {
+      type = lib.types.nullOr (lib.types.submodule {
+        options = {
+          dkimPrivateKeyPath = lib.mkOption {
+            type = lib.types.path;
+            description = ''
+              The path to the dkim private key agenix file.
+            '';
+          };
+        };
+      });
+      description = ''
+        Security options. This should only be set to `null` when testing.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.stalwart-mail = {
+      # NOTE(@bpeetz): We do not use the nixos service, as it comes with too much
+      # bothersome default configuration and not really any useful config.
+      # However, this decision could obviously be reverse in the future. <2025-02-08>
+      enable = false;
+      inherit (cfg) package;
+      # dataDir = cfg.dataDirectory;
+    };
+
+    security.acme.certs = {
+      "${cfg.fqdn}" = {
+        domain = cfg.fqdn;
+        group = "stalwart-mail";
+      };
+    };
+
+    age.secrets = lib.mkIf (cfg.security != null) {
+      stalwartMailDkim = {
+        file = cfg.security.dkimPrivateKeyPath;
+        mode = "600";
+        owner = "stalwart-mail";
+        group = "stalwart-mail";
+      };
+    };
+
+    vhack.persist.directories = [
+      {
+        directory = "${cfg.dataDirectory}";
+        user = "stalwart-mail";
+        group = "stalwart-mail";
+        mode = "0700";
+      }
+      {
+        directory = "${config.services.redis.servers."stalwart-mail".settings.dir}";
+        user = "stalwart-mail";
+        group = "redis";
+        mode = "0770";
+      }
+    ];
+
+    services.redis = {
+      servers = {
+        "stalwart-mail" = {
+          enable = true;
+
+          user = "stalwart-mail";
+
+          # Disable TCP listening. (We have a UNIX socket)
+          port = 0;
+          bind = null;
+
+          settings = {
+            protected-mode = true;
+            enable-protected-configs = false;
+            enable-debug-command = false;
+            enable-module-command = false;
+
+            supervised = "systemd";
+            stop-writes-on-bgsave-error = true;
+            sanitize-dump-payload = "clients";
+          };
+        };
+      };
+    };
+
+    # This service stores a potentially large amount of data.
+    # Running it as a dynamic user would force chown to be run every time the
+    # service is restarted on a potentially large number of files.
+    # That would cause unnecessary and unwanted delays.
+    users = {
+      groups.stalwart-mail = {};
+      users.stalwart-mail = {
+        isSystemUser = true;
+        group = "stalwart-mail";
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDirectory}' - stalwart-mail stalwart-mail - -"
+    ];
+
+    systemd = {
+      packages = [cfg.package];
+      services.stalwart-mail = {
+        wantedBy = ["multi-user.target"];
+        after = [
+          "local-fs.target"
+          "network.target"
+        ];
+
+        preStart = let
+          esa = lib.strings.escapeShellArg;
+          mkTmpFile = path: "[ -d ${esa path} ] || mkdir --parents ${esa path}";
+
+          # Create the directories for stalwart
+          storageDirectories = lib.lists.filter (v: v != null) (lib.attrsets.mapAttrsToList (_: {path ? null, ...}:
+            if (path != null)
+            then mkTmpFile path
+            else null)
+          topCfg.settings.store);
+        in
+          ''
+            # Stalwart actually wants to store _data_ (e.g., blocked ips) in it's own config file.
+            # Thus we need to make it writable.
+            cat ${esa configFile} >$CACHE_DIRECTORY/mutable_config_file.toml
+          ''
+          + (builtins.concatStringsSep "\n" storageDirectories);
+
+        serviceConfig = {
+          ExecStart = [
+            ""
+            "${cfg.package}/bin/stalwart-mail --config=$CACHE_DIRECTORY/mutable_config_file.toml"
+          ];
+
+          StandardOutput = "journal";
+          StandardError = "journal";
+
+          ReadWritePaths = [
+            cfg.dataDirectory
+          ];
+          CacheDirectory = "stalwart-mail";
+          StateDirectory = "stalwart-mail";
+
+          # Bind standard privileged ports
+          AmbientCapabilities = ["CAP_NET_BIND_SERVICE"];
+          CapabilityBoundingSet = ["CAP_NET_BIND_SERVICE"];
+
+          # Hardening
+          DeviceAllow = [""];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          PrivateDevices = true;
+          PrivateUsers = false; # incompatible with CAP_NET_BIND_SERVICE
+          ProcSubset = "pid";
+          PrivateTmp = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          UMask = "0077";
+        };
+        unitConfig.ConditionPathExists = [
+          ""
+          "${configFile}"
+        ];
+      };
+    };
+
+    # Make admin commands available in the shell
+    environment.systemPackages = [cfg.package];
+
+    networking.firewall = let
+      parsePorts = listeners: let
+        parseAddresses = listeners: lib.flatten (lib.mapAttrsToList (name: value: value.bind) listeners);
+        splitAddress = addr: lib.splitString ":" addr;
+        extractPort = addr: lib.toInt (builtins.foldl' (a: b: b) "" (splitAddress addr));
+      in
+        builtins.map extractPort (parseAddresses listeners);
+    in
+      lib.mkIf (cfg.openFirewall && (builtins.hasAttr "listener" topCfg.settings.server))
+      {
+        allowedTCPPorts = parsePorts topCfg.settings.server.listener;
+      };
+  };
+}
diff --git a/modules/by-name/st/stalwart-mail/patches/build-crates-main-Cargo.toml-Activate-appropriate-de.patch b/modules/by-name/st/stalwart-mail/patches/build-crates-main-Cargo.toml-Activate-appropriate-de.patch
new file mode 100644
index 0000000..bfea568
--- /dev/null
+++ b/modules/by-name/st/stalwart-mail/patches/build-crates-main-Cargo.toml-Activate-appropriate-de.patch
@@ -0,0 +1,26 @@
+From 42cbd55c21196bdb57ac9795a938b94a781bb1e9 Mon Sep 17 00:00:00 2001
+From: Benedikt Peetz <benedikt.peetz@b-peetz.de>
+Date: Sun, 9 Feb 2025 00:17:52 +0100
+Subject: [PATCH] build(crates/main/Cargo.toml): Activate appropriate default
+ features
+
+---
+ crates/main/Cargo.toml | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/crates/main/Cargo.toml b/crates/main/Cargo.toml
+index 036d2dcf..baa320ef 100644
+--- a/crates/main/Cargo.toml
++++ b/crates/main/Cargo.toml
+@@ -35,7 +35,7 @@ jemallocator = "0.5.0"
+ 
+ [features]
+ #default = ["sqlite", "postgres", "mysql", "rocks", "elastic", "s3", "redis", "azure", "enterprise"]
+-default = ["rocks", "enterprise"]
++default = ["rocks", "redis"]
+ sqlite = ["store/sqlite"]
+ foundationdb = ["store/foundation", "common/foundation"]
+ postgres = ["store/postgres"]
+-- 
+2.47.1
+
diff --git a/modules/by-name/st/stalwart-mail/patches/fix-crates-directory-Guard-all-enterprise-only-featu.patch b/modules/by-name/st/stalwart-mail/patches/fix-crates-directory-Guard-all-enterprise-only-featu.patch
new file mode 100644
index 0000000..80c4b60
--- /dev/null
+++ b/modules/by-name/st/stalwart-mail/patches/fix-crates-directory-Guard-all-enterprise-only-featu.patch
@@ -0,0 +1,86 @@
+From 3d20702a481bfa4ecc692cd07a7f1fe0a66bb5d9 Mon Sep 17 00:00:00 2001
+From: Benedikt Peetz <benedikt.peetz@b-peetz.de>
+Date: Sun, 9 Feb 2025 00:38:13 +0100
+Subject: [PATCH] fix(crates/directory): Guard all enterprise only features
+ behind a `enterprise` cfg block
+
+---
+ crates/directory/src/core/config.rs   | 1 +
+ crates/directory/src/core/dispatch.rs | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/crates/directory/src/core/config.rs b/crates/directory/src/core/config.rs
+index dfb7bf9b..0c3ce96a 100644
+--- a/crates/directory/src/core/config.rs
++++ b/crates/directory/src/core/config.rs
+@@ -84,6 +84,7 @@ impl Directories {
+                 "memory" => MemoryDirectory::from_config(config, prefix, data_store.clone())
+                     .await
+                     .map(DirectoryInner::Memory),
++                #[cfg(feature = "enterprise")]
+                 "oidc" => OpenIdDirectory::from_config(config, prefix, data_store.clone())
+                     .map(DirectoryInner::OpenId),
+                 unknown => {
+diff --git a/crates/directory/src/core/dispatch.rs b/crates/directory/src/core/dispatch.rs
+index a99e54fe..062f29c9 100644
+--- a/crates/directory/src/core/dispatch.rs
++++ b/crates/directory/src/core/dispatch.rs
+@@ -24,6 +24,7 @@ impl Directory {
+             DirectoryInner::Imap(store) => store.query(by).await,
+             DirectoryInner::Smtp(store) => store.query(by).await,
+             DirectoryInner::Memory(store) => store.query(by).await,
++            #[cfg(feature = "enterprise")]
+             DirectoryInner::OpenId(store) => store.query(by, return_member_of).await,
+         }
+         .caused_by(trc::location!())
+@@ -37,6 +38,7 @@ impl Directory {
+             DirectoryInner::Imap(store) => store.email_to_id(address).await,
+             DirectoryInner::Smtp(store) => store.email_to_id(address).await,
+             DirectoryInner::Memory(store) => store.email_to_id(address).await,
++            #[cfg(feature = "enterprise")]
+             DirectoryInner::OpenId(store) => store.email_to_id(address).await,
+         }
+         .caused_by(trc::location!())
+@@ -57,6 +59,7 @@ impl Directory {
+             DirectoryInner::Imap(store) => store.is_local_domain(domain).await,
+             DirectoryInner::Smtp(store) => store.is_local_domain(domain).await,
+             DirectoryInner::Memory(store) => store.is_local_domain(domain).await,
++            #[cfg(feature = "enterprise")]
+             DirectoryInner::OpenId(store) => store.is_local_domain(domain).await,
+         }
+         .caused_by(trc::location!())?;
+@@ -84,6 +87,7 @@ impl Directory {
+             DirectoryInner::Imap(store) => store.rcpt(email).await,
+             DirectoryInner::Smtp(store) => store.rcpt(email).await,
+             DirectoryInner::Memory(store) => store.rcpt(email).await,
++            #[cfg(feature = "enterprise")]
+             DirectoryInner::OpenId(store) => store.rcpt(email).await,
+         }
+         .caused_by(trc::location!())?;
+@@ -104,6 +108,7 @@ impl Directory {
+             DirectoryInner::Imap(store) => store.vrfy(address).await,
+             DirectoryInner::Smtp(store) => store.vrfy(address).await,
+             DirectoryInner::Memory(store) => store.vrfy(address).await,
++            #[cfg(feature = "enterprise")]
+             DirectoryInner::OpenId(store) => store.vrfy(address).await,
+         }
+         .caused_by(trc::location!())
+@@ -117,6 +122,7 @@ impl Directory {
+             DirectoryInner::Imap(store) => store.expn(address).await,
+             DirectoryInner::Smtp(store) => store.expn(address).await,
+             DirectoryInner::Memory(store) => store.expn(address).await,
++            #[cfg(feature = "enterprise")]
+             DirectoryInner::OpenId(store) => store.expn(address).await,
+         }
+         .caused_by(trc::location!())
+@@ -130,6 +136,7 @@ impl Directory {
+             | DirectoryInner::Imap(_)
+             | DirectoryInner::Smtp(_)
+             | DirectoryInner::Memory(_) => false,
++            #[cfg(feature = "enterprise")]
+             DirectoryInner::OpenId(_) => true,
+         }
+     }
+-- 
+2.47.1
+
diff --git a/modules/by-name/st/stalwart-mail/settings.nix b/modules/by-name/st/stalwart-mail/settings.nix
new file mode 100644
index 0000000..0f382ee
--- /dev/null
+++ b/modules/by-name/st/stalwart-mail/settings.nix
@@ -0,0 +1,477 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.vhack.stalwart-mail;
+in {
+  config.services.stalwart-mail.settings = lib.mkIf cfg.enable {
+    signature."ed25519" = lib.mkIf (cfg.security != null) {
+      private-key = "%{file:${config.age.secrets.stalwartMailDkim.path}}%";
+      domain = "${cfg.fqdn}";
+      selector = "ed-default";
+      headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id" "User-Agent" "Thread-Topic" "Thread-Index"];
+      algorithm = "ed25519-sha256";
+      canonicalization = "relaxed/relaxed"; # TODO: What does this do? <2025-02-07>
+      expire = "50d";
+      report = true;
+    };
+
+    auth = {
+      iprev = {
+        verify = "relaxed";
+      };
+      spf = {
+        verify = {
+          ehlo = "relaxed";
+          mail-from = "relaxed";
+        };
+      };
+      dmarc = {
+        verify = "relaxed";
+      };
+      arc = {
+        seal = lib.mkIf (cfg.security != null) "ed25519";
+        verify = "relaxed";
+      };
+      dkim = {
+        verify = "relaxed";
+
+        # Ignore insecure dkim signed messages (i.e., messages containing both
+        # signed and appended not-signed content.)
+        strict = true;
+
+        sign = lib.mkIf (cfg.security != null) "['ed25519']";
+      };
+    };
+    report = {
+      domain = "${cfg.fqdn}";
+      submitter = "'${cfg.fqdn}'";
+      analysis = {
+        addresses = ["dmarc@*" "abuse@*"];
+        forward = true;
+        store = "30d";
+      };
+      tls.aggregate = {
+        from-name = "'TLS Report'";
+        from-address = "'noreply-tls@${cfg.fqdn}'";
+        org-name = "'Foss Syndicate Mail Handling'";
+        contact-info = "'admin@vhack.eu'";
+        send = "daily";
+        max-size = 26214400; # 25 MiB
+        sign = lib.mkIf (cfg.security != null) "['ed25519']";
+      };
+      dmarc = {
+        aggregate = {
+          from-name = "'DMARC Report'";
+          from-address = "'noreply-dmarc@${cfg.fqdn}'";
+          org-name = "'Foss Syndicate Mail Handling'";
+          contact-info = "'admin@vhack.eu'";
+          send = "weekly";
+          max-size = 26214400; # 25MiB
+          sign = lib.mkIf (cfg.security != null) "['ed25519']";
+        };
+        from-name = "'Report Subsystem'";
+        from-address = "'noreply-dmarc@${cfg.fqdn}'";
+        subject = "'DMARC Authentication Failure Report'";
+        send = "1/1d";
+        sign = lib.mkIf (cfg.security != null) "['ed25519']";
+      };
+      spf = {
+        from-name = "'Report Subsystem'";
+        from-address = "'noreply-spf@${cfg.fqdn}'";
+        subject = "'SPF Authentication Failure Report'";
+        send = "1/1d";
+        sign = lib.mkIf (cfg.security != null) "['ed25519']";
+      };
+      dkim = {
+        from-name = "'Report Subsystem'";
+        from-address = "'noreply-dkim@${cfg.fqdn}'";
+        subject = "'DKIM Authentication Failure Report'";
+        send = "1/1d";
+        sign = lib.mkIf (cfg.security != null) "['ed25519']";
+      };
+      dsn = {
+        from-name = "'Mail Delivery Subsystem'";
+        from-address = "'MAILER-DAEMON@${cfg.fqdn}'";
+        sign = lib.mkIf (cfg.security != null) "['ed25519']";
+      };
+    };
+    queue = {
+      schedule = {
+        retry = "[2m, 5m, 10m, 15m, 30m, 1h, 2h]";
+        notify = "[2h, 7h, 1d, 3d]";
+        expire = "5d";
+      };
+      outbound = {
+        tls = {
+          starttls = "require";
+          allow-invalid-certs = false;
+          ip-strategy = "ipv6_then_ipv4";
+        };
+      };
+    };
+    resolver = {
+      type = "system";
+      preserve-intermediates = true;
+      concurrency = 2;
+      timeout = "5s";
+      attempts = 2;
+      try-tcp-on-error = true;
+      public-suffix = [
+        "file://${pkgs.publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
+      ];
+    };
+
+    spam-filter = {
+      enable = true;
+      header = {
+        status = {
+          enable = true;
+          name = "X-Spam-Status";
+        };
+        result = {
+          enable = true;
+          name = "X-Spam-Result";
+        };
+      };
+      bayes = {
+        enable = true;
+
+        # Learn from users putting mail into JUNK or taking mail out of it.
+        account = {
+          enable = true;
+        };
+      };
+
+      # Fetch the newest spam-filter rules not from github, but from the nix
+      # package.
+      resource = "file://${cfg.package.passthru.spamfilter}/spam-filter.toml";
+      auto-update = false;
+    };
+
+    webadmin = {
+      # Fetch the newest webadmin bundle not from github, but from the nix
+      # package.
+      resource = "file://${cfg.package.passthru.webadmin}/webadmin.zip";
+      auto-update = false;
+      path = "/var/cache/stalwart-mail";
+    };
+
+    session = {
+      milter = {
+        # TODO: Add this <2025-02-07>
+        # "clamav" = {
+        #   enable = true;
+        #   hostname = "127.0.0.1";
+        #   port = 15112;
+        #   tls = false;
+        #   allow-invalid-certs = false;
+        # };
+      };
+      ehlo = {
+        require = true;
+      };
+      rcpt = {
+        directory = "'in-memory'";
+        catch-all = true;
+        subaddressing = true;
+      };
+      data = {
+        spam-filter = true;
+        add-headers = {
+          received = true;
+          received-spf = true;
+          auth-results = true;
+          message-id = true;
+          date = true;
+          return-path = true;
+          delivered-to = true;
+        };
+        auth = {
+          mechanisms = ["LOGIN" "PLAIN"];
+          directory = "'in-memory'";
+          require = true;
+          must-match-sender = true;
+          errors = {
+            total = 3;
+            wait = "5s";
+          };
+        };
+      };
+      extensions = {
+        pipelining = true;
+        chunking = true;
+        requiretls = true;
+        no-soliciting = "";
+        dsn = [
+          {
+            "if" = "!is_empty(authenticated_as)";
+            "then" = true;
+          }
+          {"else" = false;}
+        ];
+        future-release = [
+          {
+            "if" = "!is_empty(authenticated_as)";
+            "then" = "7d";
+          }
+          {"else" = false;}
+        ];
+        deliver-by = [
+          {
+            "if" = "!is_empty(authenticated_as)";
+            "then" = "15d";
+          }
+          {"else" = false;}
+        ];
+        mt-priority = [
+          {
+            "if" = "!is_empty(authenticated_as)";
+            "then" = "mixer";
+          }
+          {"else" = false;}
+        ];
+        vrfy = [
+          {
+            "if" = "!is_empty(authenticated_as)";
+            "then" = true;
+          }
+          {"else" = false;}
+        ];
+        expn = [
+          {
+            "if" = "!is_empty(authenticated_as)";
+            "then" = true;
+          }
+          {"else" = false;}
+        ];
+      };
+    };
+
+    jmap = {
+      account = {
+        purge.frequency = "0 0 *";
+      };
+      protocol = {
+        changes.max-history = "14d";
+      };
+      email = {
+        # NOTE(@bpeetz): We probably want to enable the auto-deletion of emails in
+        # the "Junk" and "Deleted" items mail folders, but this should be
+        # communicated to the users. <2025-02-07>
+        auto-expunge = false;
+      };
+      mailbox = {
+        max-depth = 50;
+        max-name-length = 255;
+      };
+      folders = let
+        mkFolder = name: {
+          inherit name;
+          create = true;
+          subscribe = true;
+        };
+      in {
+        inbox = mkFolder "inbox";
+        drafts = mkFolder "drafts";
+        sent = mkFolder "sent";
+        trash = mkFolder "trash";
+        archive = mkFolder "archive";
+        junk = mkFolder "junk";
+        shared = {name = "shared";};
+      };
+    };
+    imap = {
+      auth = {
+        # Allow password login over non tls connection
+        allow-plain-text = false;
+      };
+    };
+
+    server = {
+      hostname = cfg.fqdn;
+
+      listener = {
+        # TODO(@bpeetz): Add this <2025-02-08>
+        # # HTTP (used for jmap)
+        # "http" = {
+        #   bind = ["[::]:8080"];
+        #   protocol = "http";
+        #   tls.implicit = true;
+        # };
+
+        # IMAP
+        "imap" = {
+          bind = ["[::]:993"];
+          protocol = "imap";
+          tls.implicit = true;
+        };
+        # SMTP
+        "smtp" = {
+          bind = ["[::]:465"];
+          protocol = "smtp";
+          tls.implicit = true;
+        };
+
+        # # POP3 (should be disabled, unless there is a real reason to use it)
+        # "pop3" = {
+        #   bind = ["[::]:995"];
+        #   protocol = "pop3";
+        #   tls.implicit = true;
+        # };
+
+        # # LMTP
+        # "lmtp" = {
+        #   bind = ["[::]:24"];
+        #   protocol = "lmtp";
+        # };
+
+        # ManageSieve
+        "managesieve" = {
+          bind = ["[::]:4190"];
+          protocol = "managesieve";
+          tls.implicit = true;
+        };
+      };
+
+      tls = {
+        enable = true;
+
+        # Expect the client connection to be encrypted from the start (i.e.,
+        # without STARTTLS)
+        implicit = true;
+
+        certificate = "default";
+      };
+
+      # TODO(@bpeetz): Configure that <2025-02-07>
+      # http = {
+      #   url = "";
+      #   allowed-endpoint = ["404"];
+      # };
+
+      auto-ban = {
+        # Ban if the same IP fails to login 10 times in a day
+        rate = "10/1d";
+
+        # Ban the login for an user account, if different IP-Addresses tried and
+        # failed to login 100 times in single day
+        auth.rate = "100/1d";
+
+        abuse.rate = "35/1d";
+
+        loiter.rate = "150/1d";
+
+        scan.rate = "150/1d";
+      };
+
+      cache = let
+        MiB = 1024 * 1024;
+      in {
+        access-token.size = 10 * MiB;
+        http-auth.size = 1 * MiB;
+        permission.size = 5 * MiB;
+        account.size = 10 * MiB;
+        mailbox.size = 10 * MiB;
+        thread.size = 10 * MiB;
+        bayes.size = 10 * MiB;
+        dns = {
+          txt.size = 5 * MiB;
+          mx.size = 5 * MiB;
+          ptr.size = 1 * MiB;
+          ipv4.size = 5 * MiB;
+          ipv6.size = 5 * MiB;
+          tlsa.size = 1 * MiB;
+          mta-sts.size = 1 * MiB;
+          rbl.size = 5 * MiB;
+        };
+      };
+    };
+
+    tracer = {
+      # NOTE(@bpeetz):
+      # We are using the console logger, because that has nice color output.
+      # Simply using the console should be fine, as systemd pipes that to the journal
+      # either way. <2025-02-08>
+      console = {
+        enable = true;
+        ansi = true;
+        level = "info";
+        type = "console";
+      };
+    };
+
+    store = {
+      "rocksdb-data" = {
+        type = "rocksdb";
+        path = "${cfg.dataDirectory}/storage/data";
+        compression = "lz4";
+
+        # Perform “maintenance” every day at 3 am local time.
+        purge.frequency = "0 3 *";
+      };
+      "rocksdb-full-text-search" = {
+        type = "rocksdb";
+        path = "${cfg.dataDirectory}/storage/full-text-search";
+        compression = "lz4";
+
+        # Perform “maintenance” every day at 2 am local time.
+        purge.frequency = "0 2 *";
+      };
+      "file-system" = {
+        type = "fs";
+        path = "${cfg.dataDirectory}/storage/blobs";
+        depth = 2;
+        compression = "lz4";
+
+        # Perform “maintenance” every day at 5:30 am local time.
+        purge.frequency = "30 5 *";
+      };
+      "redis" = {
+        type = "redis";
+        redis-type = "single";
+        urls = "unix://${config.services.redis.servers."stalwart-mail".unixSocket}";
+        timeout = "10s";
+
+        # Perform “maintenance” every day at 2:30 am local time.
+        purge.frequency = "30 2 *";
+      };
+    };
+    storage = {
+      # PostgreSQL is an option, but this is recommended for single node
+      # configurations.
+      data = "rocksdb-data";
+
+      # We could also re-use the data storage backend for that.
+      blob = "file-system";
+
+      full-text.default-language = "en";
+      fts = "rocksdb-full-text-search";
+
+      directory = "in-memory";
+
+      lookup = "redis";
+
+      # NOTE(@bpeetz): This will encrypt all emails with the users pgp key (if it
+      # can be determined.) This is a wonderful feature, but quite tiresome, if
+      # the user intends to read their email without a their pgp key present (for
+      # example via their smartphone.) <2025-02-07>
+      encryption.enable = false;
+    };
+
+    directory."in-memory" = {
+      type = "memory";
+      inherit (cfg) principals;
+    };
+
+    certificate = {
+      "default" = {
+        cert = "%{file:${config.security.acme.certs.${cfg.fqdn}.directory}/fullchain.pem}%";
+        private-key = "%{file:${config.security.acme.certs.${cfg.fqdn}.directory}/key.pem}%";
+        default = true;
+      };
+    };
+  };
+}
diff --git a/modules/by-name/st/stalwart-mail/spam-filter.nix b/modules/by-name/st/stalwart-mail/spam-filter.nix
new file mode 100644
index 0000000..ce3466d
--- /dev/null
+++ b/modules/by-name/st/stalwart-mail/spam-filter.nix
@@ -0,0 +1,24 @@
+{
+  stdenv,
+  fetchFromGitHub,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "spam-filter";
+  version = "2.0.2";
+
+  src = fetchFromGitHub {
+    owner = "stalwartlabs";
+    repo = "spam-filter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-p2F0bwYBNWeoHjp9csWWaqeOISk9dNQT28OqkhUr7ew=";
+  };
+
+  buildPhase = ''
+    bash ./build.sh
+  '';
+
+  installPhase = ''
+    mkdir --parents "$out"
+    cp ./spam-filter.toml "$out/"
+  '';
+})