diff options
| -rw-r--r-- | modules/vhack/ma/mail/module.nix | 53 |
1 files changed, 52 insertions, 1 deletions
diff --git a/modules/vhack/ma/mail/module.nix b/modules/vhack/ma/mail/module.nix index 75e20bb..034924a 100644 --- a/modules/vhack/ma/mail/module.nix +++ b/modules/vhack/ma/mail/module.nix @@ -222,6 +222,43 @@ in { ''; default = {}; }; + + security = lib.mkOption { + type = lib.types.submodule { + options = { + dkimKeys = lib.mkOption { + type = lib.types.nullOr (lib.types.attrsOf (lib.types.submodule { + options = { + dkimPublicKey = lib.mkOption { + type = lib.types.str; + description = '' + The base 64 encoded representation of the public dkim key. + ''; + }; + dkimPrivateKeyPath = lib.mkOption { + type = lib.types.path; + description = '' + Path to the file for the pre-generated dkim key file. + Should not point to the nixos store. + ''; + }; + keyAlgorithm = lib.mkOption { + type = lib.types.enum ["ed25519-sha256" "rsa-sha-256" "rsa-sha-1"]; + description = "The algorithm of the used key"; + }; + }; + })); + description = '' + Which key to use for which domain. The attr keys are the domains + ''; + default = null; + }; + }; + }; + description = '' + Security options. + ''; + }; }; config = lib.mkIf cfg.enable { @@ -284,7 +321,21 @@ in { path = "/var/lib/mail/vmail"; }; - dkim.keyDirectory = "/var/lib/mail/dkim"; + dkim = let + dkimKeys = + builtins.mapAttrs (name: value: { + selectors."mail".keyFile = + value.dkimPrivateKeyPath; + }) + cfg.security.dkimKeys; + in { + # domains."${cfg.fqdn}".selectors."mail" = lib.mkIf (cfg.dkimKey != null) { + # keyFile = cfg.dkimKey; + # }; + domains = lib.mkIf (cfg.security.dkimKeys != null) dkimKeys; + keyDirectory = lib.mkIf (cfg.security.dkimKeys == null) "/var/lib/mail/dkim"; + }; + backup.snapshotRoot = "/var/lib/mail/backup"; enableImap = false; |