This repository has no description
configs.roundcube: replace snappymail, log in via id.lassul.us
author
lassulus
committer
lassulus
date
(Oct 18, 2026, 10:15 PM CEST)
commit
e2e0fb01
e2e0fb016896797fe2eaf95634b66646129bd723
parent
43e2db13
43e2db130007f82b5f10c86eaa64b7e9eaf2cea2
+96
-69
+95
configs/roundcube.nix
+95
configs/roundcube.nix
···
1
+
{ config, ... }:
2
+
let
3
+
domain = "mail.lassul.us";
4
+
zitadelEnv = config.lass.zitadel.projects.mail.apps.roundcube.envFile.path;
5
+
# Basic-auth introspection URL with the roundcube client's id and secret,
6
+
# read by dovecot at config parse time.
7
+
introspectionUrl = "/var/lib/dovecot-oauth2/introspection-url";
8
+
in
9
+
{
10
+
# Webmail on mail.lassul.us. Login only via Zitadel (id.lassul.us); roundcube
11
+
# hands the access token to dovecot (IMAP, ManageSieve) and postfix (SMTP via
12
+
# dovecot SASL) with OAUTHBEARER/XOAUTH2, so no mail password is stored.
13
+
services.roundcube = {
14
+
enable = true;
15
+
hostName = domain;
16
+
maxAttachmentSize = 25;
17
+
plugins = [
18
+
"archive"
19
+
"managesieve"
20
+
"zipdownload"
21
+
];
22
+
extraConfig = ''
23
+
$config['product_name'] = 'lassulus webmail';
24
+
$config['default_list_mode'] = 'threads';
25
+
$config['imap_host'] = 'ssl://${domain}:993';
26
+
$config['smtp_host'] = 'ssl://${domain}:465';
27
+
$config['managesieve_host'] = 'tls://${domain}:4190';
28
+
29
+
$oidc = parse_ini_file('${zitadelEnv}', false, INI_SCANNER_RAW);
30
+
$config['oauth_provider'] = 'generic';
31
+
$config['oauth_provider_name'] = 'lassul.us ID';
32
+
$config['oauth_client_id'] = $oidc['CLIENT_ID'];
33
+
$config['oauth_client_secret'] = $oidc['CLIENT_SECRET'];
34
+
$config['oauth_config_uri'] = 'https://id.lassul.us/.well-known/openid-configuration';
35
+
$config['oauth_scope'] = 'openid email profile offline_access';
36
+
$config['oauth_identity_fields'] = ['email'];
37
+
$config['oauth_login_redirect'] = true;
38
+
'';
39
+
};
40
+
41
+
services.nginx.virtualHosts.${domain} = {
42
+
enableACME = false;
43
+
useACMEHost = domain;
44
+
};
45
+
46
+
# Only lass may log in; dovecot maps the token's email to the mailbox.
47
+
lass.zitadel.projects.mail = {
48
+
access = "declarative";
49
+
users = [ "lass@lassul.us" ];
50
+
apps.roundcube = {
51
+
redirectUris = [ "https://${domain}/index.php/login/oauth" ];
52
+
# roundcube sends the client secret in the token request body
53
+
authMethod = "post";
54
+
refreshTokens = true;
55
+
envFile.owner = "roundcube";
56
+
};
57
+
};
58
+
59
+
# Dovecot checks tokens at Zitadel's introspection endpoint as the roundcube
60
+
# client. Zitadel reports a token as active only if its audience contains
61
+
# this project, so tokens issued to other lassul.us ID apps are refused.
62
+
services.dovecot2.settings = {
63
+
auth_mechanisms = [
64
+
"oauthbearer"
65
+
"xoauth2"
66
+
];
67
+
oauth2_introspection_mode = "post";
68
+
oauth2_introspection_url = "<${introspectionUrl}";
69
+
oauth2_force_introspection = true;
70
+
oauth2_active_attribute = "active";
71
+
oauth2_active_value = "true";
72
+
oauth2_username_attribute = "email";
73
+
oauth2.ssl_client_ca_file = "/etc/ssl/certs/ca-certificates.crt";
74
+
};
75
+
76
+
systemd.services.dovecot-oauth2-url = {
77
+
wants = [ "zitadel-reconcile.service" ];
78
+
after = [ "zitadel-reconcile.service" ];
79
+
before = [ "dovecot.service" ];
80
+
wantedBy = [ "dovecot.service" ];
81
+
serviceConfig = {
82
+
Type = "oneshot";
83
+
RemainAfterExit = true;
84
+
StateDirectory = "dovecot-oauth2";
85
+
StateDirectoryMode = "0700";
86
+
UMask = "0077";
87
+
EnvironmentFile = zitadelEnv;
88
+
};
89
+
script = ''
90
+
printf '%s' "https://$CLIENT_ID:$CLIENT_SECRET@id.lassul.us/oauth/v2/introspect" \
91
+
> ${introspectionUrl}.tmp
92
+
mv ${introspectionUrl}.tmp ${introspectionUrl}
93
+
'';
94
+
};
95
+
}
-68
configs/snappymail.nix
-68
configs/snappymail.nix
···
1
-
{ config, pkgs, ... }:
2
-
let
3
-
snappymail = pkgs.snappymail;
4
-
dataDir = "/var/lib/snappymail";
5
-
pool = "snappymail";
6
-
fpmSocket = config.services.phpfpm.pools.${pool}.socket;
7
-
in
8
-
{
9
-
services.phpfpm.pools.${pool} = {
10
-
user = "snappymail";
11
-
group = "snappymail";
12
-
settings = {
13
-
"listen.owner" = "nginx";
14
-
"listen.group" = "nginx";
15
-
"pm" = "dynamic";
16
-
"pm.max_children" = 4;
17
-
"pm.start_servers" = 1;
18
-
"pm.min_spare_servers" = 1;
19
-
"pm.max_spare_servers" = 2;
20
-
};
21
-
phpOptions = ''
22
-
upload_max_filesize = 25M
23
-
post_max_size = 25M
24
-
default_socket_timeout = 30
25
-
max_execution_time = 60
26
-
'';
27
-
phpEnv = {
28
-
SNAPPYMAIL_DATA_PATH = dataDir;
29
-
};
30
-
};
31
-
32
-
users.users.snappymail = {
33
-
isSystemUser = true;
34
-
group = "snappymail";
35
-
home = dataDir;
36
-
createHome = true;
37
-
};
38
-
users.groups.snappymail = { };
39
-
40
-
systemd.tmpfiles.rules = [
41
-
"d ${dataDir} 0750 snappymail snappymail -"
42
-
];
43
-
44
-
services.nginx.virtualHosts."mail.lassul.us" = {
45
-
forceSSL = true;
46
-
useACMEHost = "mail.lassul.us";
47
-
root = "${snappymail}";
48
-
locations."/" = {
49
-
index = "index.php";
50
-
tryFiles = "$uri $uri/ /index.php$is_args$args";
51
-
};
52
-
locations."~ \\.php$" = {
53
-
extraConfig = ''
54
-
fastcgi_pass unix:${fpmSocket};
55
-
include ${pkgs.nginx}/conf/fastcgi.conf;
56
-
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
57
-
fastcgi_param SNAPPYMAIL_DATA_PATH ${dataDir};
58
-
fastcgi_read_timeout 60s;
59
-
'';
60
-
};
61
-
locations."~ /\\." = {
62
-
extraConfig = "deny all;";
63
-
};
64
-
locations."^~ /data" = {
65
-
extraConfig = "deny all;";
66
-
};
67
-
};
68
-
}
+1
-1
machines/neoprism/config.nix
+1
-1
machines/neoprism/config.nix