diff options
| author | Benedikt Peetz <benedikt.peetz@b-peetz.de> | 2025-04-12 16:12:05 +0200 |
|---|---|---|
| committer | Benedikt Peetz <benedikt.peetz@b-peetz.de> | 2025-04-23 12:10:31 +0200 |
| commit | b4d3b4a6663e66c508ded05ea9668083e7e5c73f (patch) | |
| tree | 332c38f017fe47a4be486263214ab44d2a4fbc76 /modules | |
| parent | modules/nginx: Set the "acme" group as group of the "acme" user (diff) | |
| download | nixos-server-b4d3b4a6663e66c508ded05ea9668083e7e5c73f.zip | |
modules/stalwart-mail: Enable the http self-service interface
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/by-name/st/stalwart-mail/module.nix | 1 | ||||
| -rw-r--r-- | modules/by-name/st/stalwart-mail/settings.nix | 25 |
2 files changed, 14 insertions, 12 deletions
diff --git a/modules/by-name/st/stalwart-mail/module.nix b/modules/by-name/st/stalwart-mail/module.nix index ed1821a..f65ba38 100644 --- a/modules/by-name/st/stalwart-mail/module.nix +++ b/modules/by-name/st/stalwart-mail/module.nix @@ -189,6 +189,7 @@ in { }; nginx.virtualHosts."${cfg.fqdn}" = { + locations."/".proxyPass = "http://${builtins.elemAt config.services.stalwart-mail.settings.server.listener.http.bind 0}"; useACMEHost = "${cfg.fqdn}"; forceSSL = true; }; diff --git a/modules/by-name/st/stalwart-mail/settings.nix b/modules/by-name/st/stalwart-mail/settings.nix index 17f045d..907cea9 100644 --- a/modules/by-name/st/stalwart-mail/settings.nix +++ b/modules/by-name/st/stalwart-mail/settings.nix @@ -344,13 +344,13 @@ in { hostname = cfg.fqdn; listener = { - # TODO(@bpeetz): Add this <2025-02-08> - # # HTTP (used for jmap) - # "http" = { - # bind = ["[::]:8080"]; - # protocol = "http"; - # tls.implicit = true; - # }; + # HTTP (used for jmap) + "http" = { + bind = ["127.0.0.1:8112"]; + protocol = "http"; + # handled by ngnix + tls.implicit = false; + }; # IMAP "imap" = { @@ -406,11 +406,12 @@ in { certificate = "default"; }; - # TODO(@bpeetz): Configure that <2025-02-07> - # http = { - # url = ""; - # allowed-endpoint = ["404"]; - # }; + http = { + url = "protocol + '://' + config_get('server.hostname') + ':' + local_port"; + + # We are behind a nginx proxy, and can thus trust this header. + use-x-forwarded = true; + }; auto-ban = { # Ban if the same IP fails to login 10 times in a day |