forked from
lass.pds.lassul.us/superconfig
This repository has no description
3.1 kB
132 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 relayHosts = map (host: host.nets.retiolum.ip6.addr) [
10 config.krebs.hosts.aergia
11 config.krebs.hosts.ignavia
12 config.krebs.hosts.coaxmetal
13 config.krebs.hosts.green
14 config.krebs.hosts.mors
15 ];
16
17 mynetworks = map (ip: "[${ip}]") relayHosts;
18in
19{
20 imports = [
21 self.inputs.nixos-mailserver.nixosModules.default
22 ];
23
24 mailserver = {
25 enable = true;
26 fqdn = "mail.lassul.us";
27 domains = [ "lassul.us" ];
28
29 loginAccounts = {
30 "lass@lassul.us" = {
31 hashedPasswordFile =
32 config.clan.core.vars.generators.mailserver-lass.files."lass-mail-password-hash".path;
33 aliases = [
34 "postmaster@lassul.us"
35 "root@lassul.us"
36 "abuse@lassul.us"
37 "hostmaster@lassul.us"
38 "webmaster@lassul.us"
39 "security@lassul.us"
40 "noc@lassul.us"
41 "mailer-daemon@lassul.us"
42 "nobody@lassul.us"
43 "lassulus@lassul.us"
44 ];
45 catchAll = [ "lassul.us" ];
46 };
47 "bot@lassul.us" = {
48 hashedPasswordFile =
49 config.clan.core.vars.generators.mailserver-bot.files."bot-mail-password-hash".path;
50 };
51 };
52
53 # TLS via existing ACME cert
54 x509.useACMEHost = "mail.lassul.us";
55
56 # DKIM — auto-managed by module
57 dkimSigning = true;
58 dkimSelector = "mail";
59
60 # ManageSieve: lets mail clients manage sieve rules dynamically (port 4190)
61 enableManageSieve = true;
62
63 # Full-text search for IMAP clients
64 fullTextSearch = {
65 enable = true;
66 memoryLimit = 500;
67 };
68
69 stateVersion = 3;
70 };
71
72 # Password generation for mail accounts
73 clan.core.vars.generators.mailserver-lass = {
74 files."lass-mail-password" = { };
75 files."lass-mail-password-hash" = { };
76 runtimeInputs = with pkgs; [
77 coreutils
78 mkpasswd
79 pwgen
80 ];
81 script = ''
82 pwgen -s 32 1 > "$out/lass-mail-password"
83 mkpasswd -sm bcrypt < "$out/lass-mail-password" > "$out/lass-mail-password-hash"
84 '';
85 };
86
87 clan.core.vars.generators.mailserver-bot = {
88 files."bot-mail-password" = { };
89 files."bot-mail-password-hash" = { };
90 runtimeInputs = with pkgs; [
91 coreutils
92 mkpasswd
93 pwgen
94 ];
95 script = ''
96 pwgen -s 32 1 > "$out/bot-mail-password"
97 mkpasswd -sm bcrypt < "$out/bot-mail-password" > "$out/bot-mail-password-hash"
98 '';
99 };
100
101 # Retiolum relay: allow krebs hosts to relay through postfix
102 services.postfix.settings.main.mynetworks = lib.mkForce (
103 [
104 "127.0.0.0/8"
105 "[::1]/128"
106 ]
107 ++ mynetworks
108 );
109
110 # ACME cert — reuse existing setup
111 security.acme.certs."mail.lassul.us" = {
112 group = "lasscert";
113 webroot = "/var/lib/acme/acme-challenge";
114 };
115 users.groups.lasscert.members = [
116 "dovecot2"
117 "postfix"
118 "nginx"
119 ];
120
121 # Firewall: SMTP(25), submission(587), submissions(465), IMAPS(993), ManageSieve(4190)
122 networking.firewall.allowedTCPPorts = [
123 25
124 587
125 465
126 993
127 4190
128 ];
129
130 # msmtp for local submission via SSH
131 environment.systemPackages = [ pkgs.msmtp ];
132}