nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merged frace

Browse Source
This commit is contained in:
root 2020-07-21 01:16:30 -05:00
parent b82ec83d3c
commit 98fa41f171
3 changed files with 48 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
config/fudo/mail-container.nix
View File

@ -160,21 +160,21 @@ in rec {
}; };
}; };
users = { # users = {
users = { # users = {
${container-mail-user} = { # ${container-mail-user} = {
isSystemUser = true; # isSystemUser = true;
uid = container-mail-user-id; # uid = container-mail-user-id;
group = "mailer"; # group = "mailer";
}; # };
}; # };
groups = { # groups = {
${container-mail-group} = { # ${container-mail-group} = {
members = ["mailer"]; # members = ["mailer"];
}; # };
}; # };
}; # };
fudo.mail-server = { fudo.mail-server = {
enable = true; enable = true;
@ -193,10 +193,12 @@ in rec {
dovecot = { dovecot = {
ssl-certificate = "/etc/${container-dovecot-cert}"; ssl-certificate = "/etc/${container-dovecot-cert}";
ssl-private-key = "/etc/dovecot-certs/key.pem"; ssl-private-key = "/etc/dovecot-certs/key.pem";
ldap-ca = "/etc/${container-fudo-ca-cert}"; ldap = {
ldap-urls = cfg.dovecot.ldap-urls; # ca = "/etc/${container-fudo-ca-cert}";
ldap-reader-dn = cfg.dovecot.ldap-reader-dn; server-urls = cfg.dovecot.ldap.server-urls;
ldap-reader-passwd = cfg.dovecot.ldap-reader-passwd; reader-dn = cfg.dovecot.ldap.reader-dn;
reader-passwd = cfg.dovecot.ldap.reader-passwd;
};
}; };
local-domains = cfg.local-domains; local-domains = cfg.local-domains;

11
config/fudo/mail/dovecot.nix
View File

@ -53,10 +53,12 @@ let
} }
''; '';
ldapOpts = with types; { ldapOpts = {
options = with types; {
ca = mkOption { ca = mkOption {
type = str; type = nullOr str;
description = "The path to the CA cert used to sign the LDAP server certificate."; description = "The path to the CA cert used to sign the LDAP server certificate.";
default = null;
}; };
server-urls = mkOption { server-urls = mkOption {
@ -72,13 +74,14 @@ let
''; '';
}; };
reader-pw = mkOption { reader-passwd = mkOption {
type = str; type = str;
description = '' description = ''
Password for the user specified in ldap-reader-dn. Password for the user specified in ldap-reader-dn.
''; '';
}; };
}; };
};
dovecot-user = config.services.dovecot2.user; dovecot-user = config.services.dovecot2.user;
@ -204,7 +207,7 @@ in {
auth_mechanisms = login plain auth_mechanisms = login plain
${optionalString (cfg.dovecot.ldap != null) ${optionalString (cfg.dovecot.ldap != null)
(ldap-conf cfg.dovecot.ldap)} (ldap-passwd-entry cfg.dovecot.ldap)}
userdb { userdb {
driver = static driver = static
args = uid=${toString cfg.mail-user-id} home=${cfg.mail-directory}/%u args = uid=${toString cfg.mail-user-id} home=${cfg.mail-directory}/%u

12
hosts/france.nix
View File

@ -237,11 +237,13 @@ in {
state-directory = "${system-mail-directory}/var"; state-directory = "${system-mail-directory}/var";
mail-directory = "${system-mail-directory}/mailboxes"; mail-directory = "${system-mail-directory}/mailboxes";
dovecot.ldap-reader-dn = "cn=user_db_reader,dc=fudo,dc=org"; dovecot.ldap = {
dovecot.ldap-reader-passwd = fileContents /srv/ldap/secure/user_db.passwd; reader-dn = "cn=user_db_reader,dc=fudo,dc=org";
reader-passwd = fileContents /srv/ldap/secure/user_db.passwd;
# FIXME: use SSL once I can figure out Acme SSL cert CA for LDAP. # FIXME: use SSL once I can figure out Acme SSL cert CA for LDAP.
dovecot.ldap-urls = [ "ldap://france.fudo.org" ]; server-urls = [ "ldap://france.fudo.org" ];
};
clamav.enable = true; clamav.enable = true;
@ -277,7 +279,7 @@ in {
name = "webmail"; name = "webmail";
hostname = "localhost"; hostname = "localhost";
user = "webmail"; user = "webmail";
password-file = /srv/webmail/secure/db.passwd; password-file = "/srv/webmail/secure/db.passwd";
}; };
}; };
@ -290,7 +292,7 @@ in {
name = "webmail"; name = "webmail";
hostname = "localhost"; hostname = "localhost";
user = "webmail"; user = "webmail";
password-file = /srv/webmail/secure/db.passwd; password-file = "/srv/webmail/secure/db.passwd";
}; };
}; };
}; };