nixos-config/lib/fudo/mail-container.nix

{ lib, config, ... }:
with lib;
let
  hostname = config.instance.hostname;
  cfg = config.fudo.mail-server;
  container-maildir = "/var/lib/mail";
  container-statedir = "/var/lib/mail-state";

  # Don't bother with group-id, nixos doesn't seem to use it anyway
  container-mail-user = "mailer";
  container-mail-user-id = 542;
  container-mail-group = "mailer";

in rec {
  config = mkIf (cfg.enableContainer) {
    # Disable postfix on this host--it'll be run in the container instead
    services.postfix.enable = false;

    fudo.acme.host-domains.${hostname}.${cfg.mail-hostname} = {
      local-copies = {
        postfix = {
          user = "root";
        };
        dovecot-cert = {
          user = "root";
        };
      };
    };

    services.nginx = mkIf cfg.monitoring {
      enable = true;

      virtualHosts = let
        proxy-headers = ''
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header Host $host;
        '';
        trusted-network-string =
          optionalString ((length config.instance.local-networks) > 0)
          (concatStringsSep "\n"
            (map (network: "allow ${network};")
              config.instance.local-networks)) + ''

              deny all;'';

      in {
        "${cfg.mail-hostname}" = {
          enableACME = true;
          forceSSL = true;

          locations."/metrics/postfix" = {
            proxyPass = "http://127.0.0.1:9154/metrics";

            extraConfig = ''
              ${proxy-headers}

              ${trusted-network-string}
            '';
          };

          locations."/metrics/dovecot" = {
            proxyPass = "http://127.0.0.1:9166/metrics";

            extraConfig = ''
              ${proxy-headers}

              ${trusted-network-string}
            '';
          };

          locations."/metrics/rspamd" = {
            proxyPass = "http://127.0.0.1:7980/metrics";

            extraConfig = ''
              ${proxy-headers}

              ${trusted-network-string}
            '';
          };
        };
      };
    };

    containers.mail-server = {

      autoStart = true;

      bindMounts = let
        cert-copies = config.fudo.acme.host-domains.${hostname}.${cfg.mail-hostname}.local-copies;
      in {
        "${container-maildir}" = {
          hostPath = cfg.mail-directory;
          isReadOnly = false;
        };

        "${container-statedir}" = {
          hostPath = cfg.state-directory;
          isReadOnly = false;
        };

        "/etc/${container-shared}" = {
          hostPath = "/etc/${container-shared}";
          isReadOnly = true;
        };

        "/run/mail/certs/postfix/cert.pem" = {
          hostPath = cert-copies.postfix.certificate;
          isReadOnly = true;
        };

        "/run/mail/certs/postfix/key.pem" = {
          hostPath = cert-copies.postfix.private-key;
          isReadOnly = true;
        };

        "/run/mail/certs/dovecot/cert.pem" = {
          hostPath = cert-copies.dovecot.certificate;
          isReadOnly = true;
        };

        "/run/mail/certs/dovecot/key.pem" = {
          hostPath = cert-copies.dovecot.private-key;
          isReadOnly = true;
        };
      };

      imports = let
        initialize-host = import ../../initialize-host.nix;
        build-timestamp = config.instance.build-timestamp;
        site = config.instance.site;
        domain = config.instance.domain;
        profile = "container";
      in [
        (initialize-host {
          inherit
            lib
            pkgs
            build-timestamp
            site
            domain
            profile;
          hostname = "mail-container";
        })
      ];

      config = { config, pkgs, ... }: {

        environment.etc = {
          "mail-server/postfix/cert.pem" = {
            source = "/run/mail/certs/postfix/cert.pem";
            user = config.services.postfix.user;
            mode = "0444";
          };
          "mail-server/postfix/key.pem" = {
            source = "/run/mail/certs/postfix/key.pem";
            user = config.services.postfix.user;
            mode = "0400";
          };
          "mail-server/dovecot/cert.pem" = {
            source = "/run/mail/certs/dovecot/cert.pem";
            user = config.services.dovecot.user;
            mode = "0444";
          };
          "mail-server/dovecot/key.pem" = {
            source = "/run/mail/certs/dovecot/key.pem";
            user = config.services.dovecot.user;
            mode = "0400";
          };
        };

        imports = [ ./mail.nix ];

        fudo.mail-server = {
          enable = true;
          hostname = cfg.hostname;
          domain = cfg.domain;

          debug = cfg.debug;
          monitoring = cfg.monitoring;

          state-directory = container-statedir;
          mail-directory = container-maildir;

          postfix = {
            ssl-certificate = "/etc/mail-server/postfix/cert.pem";
            ssl-private-key = "/etc/mail-server/postfix/key.pem";
          };

          dovecot = {
            ssl-certificate = "/etc/mail-server/dovecot/cert.pem";
            ssl-private-key = "/etc/mail-server/dovecot/key.pem";
            ldap = {
              server-urls = cfg.dovecot.ldap.server-urls;
              reader-dn = cfg.dovecot.ldap.reader-dn;
              reader-passwd = cfg.dovecot.ldap.reader-passwd;
            };
          };

          local-domains = cfg.local-domains;

          alias-users = cfg.alias-users;
          user-aliases = cfg.user-aliases;
          sender-blacklist = cfg.sender-blacklist;
          recipient-blacklist = cfg.recipient-blacklist;
          trusted-networks = cfg.trusted-networks;

          mail-user = container-mail-user;
          mail-user-id = container-mail-user-id;
          mail-group = container-mail-group;

          clamav.enable = cfg.clamav.enable;

          dkim.signing = cfg.dkim.signing;
        };
      };
    };
  };
}