diff options
Diffstat (limited to '')
| -rw-r--r-- | modules/by-name/co/constants/module.nix | 10 | ||||
| -rw-r--r-- | modules/by-name/ma/mail/module.nix | 167 |
2 files changed, 177 insertions, 0 deletions
diff --git a/modules/by-name/co/constants/module.nix b/modules/by-name/co/constants/module.nix index fd00a34..4f241b6 100644 --- a/modules/by-name/co/constants/module.nix +++ b/modules/by-name/co/constants/module.nix @@ -31,6 +31,11 @@ redis-mastodon = 991; matrix-synapse = 224; mautrix-whatsapp = 225; + knot-resolver = 997; + redis-rspamd = 989; + rspamd = 225; + opendkim = 221; + virtualMail = 5000; # As per the NixOS file, the uids should not be greater or equal to 400; }; @@ -47,6 +52,11 @@ mastodon = 996; redis-mastodon = 991; matrix-synapse = 224; + knot-resolver = 997; + redis-rspamd = 989; + rspamd = 225; + opendkim = 221; + virtualMail = 5000; # The gid should match the uid. Thus should not be >= 400; }; diff --git a/modules/by-name/ma/mail/module.nix b/modules/by-name/ma/mail/module.nix new file mode 100644 index 0000000..55f2fb8 --- /dev/null +++ b/modules/by-name/ma/mail/module.nix @@ -0,0 +1,167 @@ +{ + config, + lib, + ... +}: let + cfg = config.vhack.mail; + all_admins = [ + "sils@vhack.eu" + "soispha@vhack.eu" + "nightingale@vhack.eu" + ]; +in { + options.vhack.mail = { + enable = lib.mkEnableOption "sophisticated mail setup with simple-nixos-mailserver"; + fqdn = lib.mkOption { + type = lib.types.str; + description = "The fqdn mailserver should be served on."; + }; + }; + + config = lib.mkIf cfg.enable { + vhack.persist.directories = [ + { + directory = "/var/lib/mail/backup"; + user = "virtualMail"; + group = "virtualMail"; + mode = "0700"; + } + { + directory = "/var/lib/mail/sieve"; + user = "virtualMail"; + group = "virtualMail"; + mode = "0700"; + } + { + directory = "/var/lib/mail/vmail"; + user = "virtualMail"; + group = "virtualMail"; + mode = "0700"; + } + { + directory = "/var/lib/mail/dkim"; + user = "opendkim"; + group = "opendkim"; + mode = "0700"; + } + { + directory = "/var/lib/postfix/data"; + user = "postfix"; + group = "postfix"; + mode = "0700"; + } + { + directory = "/var/lib/postfix/queue"; + user = "postfix"; + group = "postfix"; + mode = "0700"; + } + { + directory = "/var/lib/rspamd"; + user = "rspamd"; + group = "rspamd"; + mode = "0700"; + } + ]; + vhack.nginx.enable = true; + security.acme.certs = { + "${cfg.fqdn}" = { + domain = cfg.fqdn; + }; + }; + mailserver = { + enable = true; + inherit (cfg) fqdn; + + useFsLayout = true; + + extraVirtualAliases = { + "abuse@vhack.eu" = all_admins; + "postmaster@vhack.eu" = all_admins; + "admin@vhack.eu" = all_admins; + }; + + mailDirectory = "/var/lib/mail/vmail"; + dkimKeyDirectory = "/var/lib/mail/dkim"; + sieveDirectory = "/var/lib/mail/sieve"; + backup.snapshotRoot = "/var/lib/mail/backup"; + + enableImap = false; + enableImapSsl = true; + enablePop3 = false; + enablePop3Ssl = true; + # SMTP + enableSubmission = false; + enableSubmissionSsl = true; + openFirewall = true; + + keyFile = "/var/lib/acme/${cfg.fqdn}/key.pem"; + certificateScheme = "acme"; + certificateFile = "/var/lib/acme/${cfg.fqdn}/fullchain.pem"; + + domains = [ + "vhack.eu" + + "s-schoeffel.de" + "b-peetz.de" + + "sils.li" + "nightingale.sils.li" + "sils.sils.li" + ]; + + loginAccounts = { + "sils@vhack.eu" = { + hashedPassword = "$2b$05$RW/Svgk7iGxvP5W7ZwUZ1e.a3fj4fteevb2MtfFYYD0d1DQ17y9Fm"; + }; + "soispha@vhack.eu" = { + hashedPassword = "$2b$05$XX36sJuHNbTFvi8DFldscOeQBHahluSkiUqD9QGzQaET7NJusSuQW"; + }; + + "benedikt.peetz@b-peetz.de" = { + hashedPassword = "$2b$05$MfET8utot2OolPZNASqoDe4VXNoG2chnEWhdfQ2E92mit0TvI2gBy"; + aliases = ["@b-peetz.de"]; + }; + "silas.schoeffel@s-schoeffel.de" = { + hashedPassword = "$2b$05$Qb8rl7ncpCcTbsSdsduJBuOITp8RTD6sfOTjuxJsVtD9vjAYY9n8e"; + aliases = ["@s-schoeffel.de"]; + }; + + "nightingale@vhack.eu" = { + hashedPassword = "$2b$05$nDKVVq1EktKXWqGFhnOLP.plLovXFyvWSuptK9GIkxA5DScKFx6YS"; + aliases = [ + "@nightingale.sils.li" + ]; + }; + "sils@sils.li" = { + hashedPassword = "$2b$05$Ebzh2ZhuWkz1p4tqJ172IejNZg10FtCxPDY4k6umYrpirXg7ezIRq"; + aliases = [ + "@sils.sils.li" + "@sils.li" + ]; + }; + + # Mail-Account used by hosted software + "mastodon@vhack.eu" = { + hashedPassword = "$2b$05$pSby3x2p3cHg0FyAE8IiJ.nYUqtAIR10JA8HNpHwMAiLXqc.ltSK."; + }; + "peertube@vhack.eu" = { + hashedPassword = "$y$j9T$hyWQ8Awd2Xrc6qsK.2hwE1$LxACfaeW.yHGbkQL95dWtID9.zXL/aMwT6lp.yU/0g0"; + }; + }; + }; + + users = { + users = { + knot-resolver.uid = config.vhack.constants.ids.uids.knot-resolver; + redis-rspamd.uid = config.vhack.constants.ids.uids.redis-rspamd; + rspamd.uid = config.vhack.constants.ids.uids.rspamd; + }; + groups = { + knot-resolver.gid = lib.mkForce config.vhack.constants.ids.gids.knot-resolver; + redis-rspamd.gid = config.vhack.constants.ids.gids.redis-rspamd; + rspamd.gid = config.vhack.constants.ids.gids.rspamd; + }; + }; + }; +} |