refactored system

system/mail-server/default.nix

@@ -0,0 +1,16 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./postfix.nix
+    ./dkim.nix
+    ./dovecot.nix
+    ./roundcube.nix
+  ];
+
+  security.acme.certs."${config.networking.domain}".reloadServices = [
+    "nginx"
+    "dovecot2"
+    "postfix"
+  ];
+}

system/mail-server/dkim.nix

@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+
+{
+  services.opendkim = {
+    enable = true;
+    domains = "csl:ktiu.net,t9e.me";
+    selector = "202412";
+    settings.UMask = "007";
+  };
+
+  users.users.postfix.extraGroups = [ "opendkim" ];
+
+  services.postfix.config.smtpd_milters = [ "unix:/run/opendkim/opendkim.sock" ];
+}

system/mail-server/dovecot.nix

@@ -0,0 +1,65 @@
+{ config, pkgs, ... }:
+
+{
+  networking.firewall.allowedTCPPorts = [
+    993 # IMAP
+  ];
+
+  security.acme.certs."${config.networking.fqdn}-dovecot" = {
+    domain = config.networking.fqdn;
+    webroot = "/var/lib/acme/.challenges";
+    group = config.services.dovecot2.group;
+  };
+
+  users.groups."vmail" = {};
+  users.users."vmail" = {
+    group = "vmail";
+    isSystemUser = true;
+  };
+
+  services.dovecot2 = {
+    enable = true;
+    sslServerKey = config.security.acme.certs."${config.networking.fqdn}-dovecot".directory + "/key.pem";
+    sslServerCert = config.security.acme.certs."${config.networking.fqdn}-dovecot".directory + "/cert.pem";
+    mailboxes = {
+      Junk = { specialUse = "Junk"; auto = "subscribe"; };
+      Sent = { specialUse = "Sent"; auto = "subscribe"; };
+      Drafts = { specialUse = "Drafts"; auto = "subscribe"; };
+      Trash = { specialUse = "Trash"; auto = "subscribe"; };
+      Archive = { specialUse = "Archive"; auto = "subscribe"; };
+    };
+    mailUser = "vmail";
+    mailGroup = "vmail";
+    enablePAM = false;
+    enableLmtp = true;
+    mailLocation = "maildir:/var/spool/mail/vmail/mailboxes/%u";
+    extraConfig = ''
+      ssl = required
+      service auth {
+        unix_listener auth {
+          mode = 0660
+          user = postfix
+          group = postfix
+        }
+      }
+      mail_home = /var/spool/mail/vmail/users/%u
+      passdb {
+        driver = passwd-file
+        args = /var/custom-access/dovecot.passwd
+      }
+      userdb {
+        driver = passwd-file
+        args = /var/custom-access/dovecot.passwd
+        default_fields = uid=vmail gid=vmail home=/var/spool/mail/vmail/users/%u
+      }
+      service lmtp {
+        unix_listener lmtp {
+          group = postfix
+          mode = 0600
+          user = postfix
+        }
+      }
+    '';
+  };
+
+}

system/mail-server/postfix.nix

@@ -0,0 +1,93 @@
+{ config, pkgs, ... }:
+
+let
+
+  submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''
+     /^Received:/            ignore
+     /^X-Originating-IP:/    ignore
+     /^X-Mailer:/            ignore
+     /^User-Agent:/          ignore
+     /^X-Enigmail:/          ignore
+     /^Message-ID:\s+<(.*?)@.*?>/ replace Message-ID: <$1@ktiu.net>
+  '';
+
+in {
+
+  networking.firewall.allowedTCPPorts = [
+    25  # SMTP
+    587 # SMTP w/ TLS
+  ];
+
+  security.acme.certs."${config.networking.fqdn}-postfix" = {
+    domain = config.networking.fqdn;
+    webroot = "/var/lib/acme/.challenges";
+    group = config.services.postfix.group;
+  };
+
+  services.postfix = {
+    enable = true;
+    virtual = ''
+      @ktiu.net till.straube@t9e.me
+      @t9e.me till.straube@t9e.me
+    '';
+
+    mapFiles.virtual-mailboxes = pkgs.writeText "postfix-virtual-mailboxes" ''
+      @ktiu.net anything
+      @t9e.me anything
+    '';
+
+    mapFiles.reject-recipients = pkgs.writeText "postfix-reject-recipients" ''
+      123rf@ktiu.net REJECT
+      jcb-co.jp-ktiu@ktiu.net REJECT
+      info@ktiu.net REJECT
+    '';
+
+
+    enableSubmission = true;
+
+    submissionOptions = {
+      milter_macro_daemon_name = "ORIGINATING";
+      cleanup_service_name = "submission-header-cleanup";
+      smtpd_tls_security_level = "encrypt";
+      smtpd_sasl_auth_enable = "yes";
+      smtpd_sasl_type = "dovecot";
+      smtpd_sasl_path = "/var/run/dovecot2/auth";
+      smtpd_sasl_security_options = "noanonymous";
+      smtpd_client_restrictions = "permit_mynetworks,permit_sasl_authenticated,reject";
+      smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
+    };
+    settings = {
+
+      main = {
+        virtual_mailbox_domains = [ "t9e.me" "ktiu.net" ];
+        virtual_mailbox_maps = "hash:/etc/postfix/virtual-mailboxes";
+        virtual_transport = "lmtp:unix:/var/run/dovecot2/lmtp";
+        smtpd_tls_security_level = "may";
+        mydomain = config.networking.domain;
+        myhostname = config.networking.fqdn;
+        mynetworks = [
+          "127.0.0.0/8"
+          "[::ffff:127.0.0.0]/104"
+          "[::1]/128"
+        ];
+        smtpd_tls_chain_files = [
+          "${config.security.acme.certs."${config.networking.fqdn}-postfix".directory + "/key.pem"}"
+          "${config.security.acme.certs."${config.networking.fqdn}-postfix".directory + "/cert.pem"}"
+        ];
+        smtpd_recipient_restrictions = "check_recipient_access hash:/etc/postfix/reject-recipients";
+      };
+
+      master = {
+        "submission-header-cleanup" = {
+          type = "unix";
+          private = false;
+          chroot = false;
+          maxproc = 0;
+          command = "cleanup";
+          args = ["-o" "header_checks=pcre:${submissionHeaderCleanupRules}"];
+        };
+      };
+
+    };
+  };
+}

system/mail-server/roundcube.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, ... }:
+
+{
+  services.roundcube = {
+    enable = true;
+    hostName = "webmail.ktiu.net";
+    extraConfig = ''
+      $config['smtp_host'] = 'tls://%h';
+      $config['smtp_conn_options'] = [
+        'ssl' => [
+          'verify_peer' => false,
+          'verify_peer_name' => false,
+        ],
+      ];
+    '';
+  };
+}