110 lines
3.2 KiB
Nix
110 lines
3.2 KiB
Nix
{
|
|
inputs,
|
|
pkgs,
|
|
config,
|
|
...
|
|
}: {
|
|
imports = [
|
|
inputs.nixos-mailserver.nixosModules.default
|
|
./reverse-proxy.nix
|
|
];
|
|
mailserver = {
|
|
enable = true;
|
|
fqdn = "mail.moritz.place";
|
|
domains = ["moritz.place"];
|
|
|
|
fullTextSearch = {
|
|
enable = true;
|
|
# index new email as they arrive
|
|
autoIndex = true;
|
|
enforced = "body";
|
|
memoryLimit = 500; # in MiB
|
|
};
|
|
|
|
loginAccounts = {
|
|
"main@moritz.place" = {
|
|
hashedPasswordFile = config.clan.core.vars.generators.mail-server.files.main-password-hash.path;
|
|
aliases = ["@moritz.place"];
|
|
};
|
|
};
|
|
|
|
# Use Let's Encrypt certificates. Note that this needs to set up a stripped
|
|
# down nginx and opens port 80.
|
|
certificateScheme = "acme";
|
|
acmeCertificateName = "any.moritz.place";
|
|
};
|
|
|
|
clan.core.vars.generators.mail-server = {
|
|
prompts.main-password.type = "hidden";
|
|
prompts.main-password.persist = true;
|
|
prompts.main-password.description = "You can autogenerate a password, if you leave this prompt blank.";
|
|
files.main-password.deploy = false;
|
|
files.main-password-hash = {};
|
|
|
|
runtimeInputs = [
|
|
pkgs.coreutils
|
|
pkgs.xkcdpass
|
|
pkgs.mkpasswd
|
|
];
|
|
script = ''
|
|
prompt_value=$(cat "$prompts"/main-password)
|
|
if [[ -n "''${prompt_value-}" ]]; then
|
|
echo "$prompt_value" | tr -d "\n" > "$out"/main-password
|
|
else
|
|
xkcdpass --numwords 3 --delimiter - --count 1 | tr -d "\n" > "$out"/main-password
|
|
fi
|
|
mkpasswd -s -m sha-512 < "$out"/main-password | tr -d "\n" > "$out"/main-password-hash
|
|
'';
|
|
};
|
|
|
|
services.roundcube = {
|
|
enable = true;
|
|
hostName = "webmail.moritz.place";
|
|
dicts = with pkgs.aspellDicts; [en de];
|
|
extraConfig = ''
|
|
# starttls needed for authentication, so the fqdn required to match
|
|
# the certificate
|
|
$config['smtp_host'] = "tls://${config.mailserver.fqdn}";
|
|
$config['smtp_user'] = "%u";
|
|
$config['smtp_pass'] = "%p";
|
|
'';
|
|
};
|
|
services.nginx.virtualHosts."webmail.moritz.place".enableACME = false;
|
|
services.nginx.virtualHosts."webmail.moritz.place".useACMEHost = "any.moritz.place";
|
|
|
|
services.borgbackup.jobs = {
|
|
mailDirectory = {
|
|
paths = config.mailserver.mailDirectory;
|
|
repo = "u461386-sub1@u461386.your-storagebox.de:mailDirectory";
|
|
doInit = true;
|
|
encryption = {
|
|
mode = "repokey";
|
|
passCommand = "cat ${config.clan.core.vars.generators.borg-mail-server.files.password.path}";
|
|
};
|
|
environment = {BORG_RSH = "ssh -i ${config.clan.core.vars.generators.borg-mail-server.files."ssh.id_ed25519".path} -p 23";};
|
|
compression = "auto,zstd";
|
|
startAt = "hourly";
|
|
persistentTimer = true;
|
|
prune.keep = {
|
|
within = "1d"; # Keep all archives from the last day
|
|
daily = 7;
|
|
weekly = 3;
|
|
monthly = 3;
|
|
};
|
|
};
|
|
};
|
|
|
|
clan.core.vars.generators.borg-mail-server = {
|
|
prompts.password.persist = true;
|
|
|
|
files."ssh.id_ed25519" = {};
|
|
files."ssh.id_ed25519.pub".secret = false;
|
|
runtimeInputs = [
|
|
pkgs.coreutils
|
|
pkgs.openssh
|
|
];
|
|
script = ''
|
|
ssh-keygen -t ed25519 -N "" -f "$out"/ssh.id_ed25519
|
|
'';
|
|
};
|
|
}
|