136 lines
4.3 KiB
Nix
136 lines
4.3 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
hostname = config.instance.hostname;
|
|
mailserver = "locum";
|
|
authentikHost = "locum";
|
|
userdbPasswd = pkgs.lib.passwd.stablerandom-passwd-file "userdb-passwd"
|
|
config.instance.build-seed;
|
|
|
|
in {
|
|
imports =
|
|
[ (import ./informis.land/authentik.nix { inherit authentikHost; }) ];
|
|
|
|
config = {
|
|
fudo = {
|
|
acme.host-domains = {
|
|
"imap.informis.land".extra-domains = [ "mail.informis.land" ];
|
|
"smtp.informis.land".extra-domains = [ "mail.informis.land" ];
|
|
};
|
|
|
|
zones."informis.land" = let
|
|
mailserverIps = config.fudo.zones."informis.land".hosts."${mailserver}";
|
|
in {
|
|
hosts = {
|
|
imap = {
|
|
ipv4-address = mailserverIps.ipv4-address;
|
|
ipv6-address = mailserverIps.ipv6-address;
|
|
};
|
|
smtp = {
|
|
ipv4-address = mailserverIps.ipv4-address;
|
|
ipv6-address = mailserverIps.ipv6-address;
|
|
};
|
|
mail = {
|
|
ipv4-address = mailserverIps.ipv4-address;
|
|
ipv6-address = mailserverIps.ipv6-address;
|
|
};
|
|
};
|
|
verbatim-dns-records = [
|
|
''
|
|
mail._domainkey IN TXT ( "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKiTSUDxDPwMxLMT7wzR0ZaGuGzU1xnhti0zqi6xGJVxe9O8wfpX1vTSAasGYGzg5r24Hc8tSTogUgy0uJXsIbPBiqXj3WsoL/vf7+tAmrmZA4DQn1hN+C0R/7knhTNPWKnIAMqReAH/yf3XvFGmBMpU3UGRNGc2MoCQ4iXBcbsQIDAQAB" ) ; ----- DKIM key mail for all-domains-generic-key''
|
|
];
|
|
# srv-records = let srv-record = host: port: [{ inherit host port; }];
|
|
# in {
|
|
# tcp = {
|
|
# imap = srv-record "imap.informis.land" 143;
|
|
# imaps = srv-record "imap.informis.land" 993;
|
|
|
|
# smtp = srv-record "smtp.informis.land" 25;
|
|
# submission = srv-record "smtp.informis.land" 587;
|
|
# };
|
|
# };
|
|
};
|
|
|
|
services.dns.zones."informis.land" = {
|
|
default-host = pkgs.lib.getHostIpv4 "locum";
|
|
};
|
|
|
|
postgresql.package = pkgs.postgresql_15_gssapi;
|
|
|
|
system-users.userdb = {
|
|
description = "User Database Lookup.";
|
|
ldap-hashed-password =
|
|
pkgs.lib.passwd.hash-ldap-passwd "userdb-passwd.hashed" userdbPasswd;
|
|
};
|
|
|
|
secrets.host-secrets."${hostname}".userdbPasswd = {
|
|
source-file = userdbPasswd;
|
|
target-file = "/run/ldap/userdbPasswd";
|
|
};
|
|
|
|
mail = {
|
|
enable = hostname == mailserver;
|
|
debug = false;
|
|
primary-domain = "informis.land";
|
|
sasl-domain = "INFORMIS.LAND";
|
|
trusted-networks = config.instance.local-networks;
|
|
smtp = {
|
|
hostname = "smtp.informis.land";
|
|
ssl-directory =
|
|
config.security.acme.certs."smtp.informis.land".directory;
|
|
};
|
|
imap = {
|
|
hostname = "imap.informis.land";
|
|
ssl-directory =
|
|
config.security.acme.certs."imap.informis.land".directory;
|
|
};
|
|
ldap = {
|
|
authentik-host = "https://authentik.informis.land";
|
|
outpost-token = readFile
|
|
config.fudo.secrets.files.service-secrets."${hostname}"."authentik-ldap.token";
|
|
base = "dc=informis,dc=land";
|
|
bind-dn = "cn=userdb,ou=users,dc=informis,dc=land";
|
|
bind-password-file =
|
|
config.fudo.secrets.files.service-passwords.locum.userdb;
|
|
};
|
|
aliases = {
|
|
alias-users = let admins = config.instance.local-admins;
|
|
in {
|
|
admin = admins;
|
|
dmarc-reports = admins;
|
|
ftp = admins;
|
|
hostmaster = admins;
|
|
irc = admins;
|
|
postmaster = admins;
|
|
root = admins;
|
|
system = admins;
|
|
webmaster = admins;
|
|
www-data = admins;
|
|
};
|
|
user-aliases =
|
|
let hasAliases = _: userOpts: userOpts.email-aliases != [ ];
|
|
in mapAttrs (user: userOpts: userOpts.email-aliases)
|
|
(filterAttrs hasAliases config.fudo.users);
|
|
};
|
|
};
|
|
};
|
|
|
|
services.nginx = mkIf (hostname == mailserver) {
|
|
enable = true;
|
|
virtualHosts = {
|
|
"smtp.informis.land" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/".return = "404";
|
|
};
|
|
"imap.informis.land" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/".return = "404";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|