This repository has no description
1.4 kB
53 lines
1{ config, pkgs, ... }:
2{
3 networking.firewall.allowedTCPPorts = [ 25 ];
4
5 security.acme.certs."mail.lassul.us" = {
6 group = "lasscert";
7 webroot = "/var/lib/acme/acme-challenge";
8 };
9 users.groups.lasscert.members = [
10 "exim"
11 "nginx"
12 ];
13
14 clan.core.vars.generators.lassul-us-dkim = {
15 files."lassul.us.dkim.priv" = { };
16 files."lassul.us.dkim.pub" = { };
17 migrateFact = "lassul.us-dkim";
18 runtimeInputs = with pkgs; [
19 coreutils
20 openssl
21 ];
22 script = ''
23 openssl genrsa -out "$out"/lassul.us.dkim.priv 2048
24 openssl rsa -in "$out"/lassul.us.dkim.priv -pubout -outform der 2>/dev/null | openssl base64 -A > "$out"/lassul.us.dkim.pub
25 '';
26 };
27
28 krebs.exim-smarthost = {
29 enable = true;
30 primary_hostname = "lassul.us";
31 dkim = [
32 {
33 domain = "lassul.us";
34 private_key = config.clan.core.vars.generators.lassul-us-dkim.files."lassul.us.dkim.priv".path;
35 }
36 ];
37 ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
38 ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
39 sender_domains = [ "lassul.us" ];
40 local_domains = [
41 "localhost"
42 "lassul.us"
43 ];
44 extraRouters = ''
45 forward_lassul_us:
46 driver = manualroute
47 domains = lassul.us
48 transport = remote_smtp
49 route_list = * green.r
50 no_more
51 '';
52 };
53}