151 lines
4.2 KiB
Nix
151 lines
4.2 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
let
|
|
|
|
submissionHeaderCleanupRules = pkgs.writeText "submission_header_cleanup_rules" ''
|
|
/^Received:/ IGNORE
|
|
/^X-Originating-IP:/ IGNORE
|
|
/^X-Mailer:/ IGNORE
|
|
/^User-Agent:/ IGNORE
|
|
/^X-Enigmail:/ IGNORE
|
|
/^Message-ID:\s+<(.*?)@.*?>/ REPLACE Message-ID: <$1@ktiu.net>
|
|
'';
|
|
|
|
in {
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
993 # IMAP
|
|
25 # SMTP
|
|
587 # SMTP w/ TLS
|
|
];
|
|
|
|
services.opendkim = {
|
|
enable = true;
|
|
domains = "csl:ktiu.net,t9e.me";
|
|
selector = "202412";
|
|
settings.UMask = "007";
|
|
};
|
|
users.users.postfix.extraGroups = [ "opendkim" ];
|
|
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
virtualHosts = {
|
|
"ktiu.net" = {
|
|
addSSL = true;
|
|
enableACME = true;
|
|
locations."/" = {
|
|
return = "418 'Ich bin eine Teekanne.'";
|
|
};
|
|
};
|
|
"${config.networking.fqdn}" = {
|
|
addSSL = true;
|
|
enableACME = true;
|
|
locations."/.well-known/acme-challenge" = {
|
|
root = "/var/lib/acme/.challenges";
|
|
};
|
|
locations."/" = {
|
|
return = "301 http://${config.networking.domain}";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
security.acme.certs."${config.networking.fqdn}-postfix" = {
|
|
domain = config.networking.fqdn;
|
|
webroot = "/var/lib/acme/.challenges";
|
|
group = config.services.postfix.group;
|
|
};
|
|
|
|
services.postfix = {
|
|
enable = true;
|
|
domain = "ktiu.net";
|
|
origin = "ktiu.net";
|
|
hostname = "arielle.ktiu.net";
|
|
destination = [
|
|
"ktiu.net"
|
|
"mail.ktiu.net"
|
|
"t9e.me"
|
|
"localhost"
|
|
"localhost.localdomain"
|
|
];
|
|
virtual = ''
|
|
@ktiu.net till
|
|
@t9e.me till
|
|
till till
|
|
'';
|
|
networks = [ "127.0.0.0/8" "[::ffff:127.0.0.0]/104" "[::1]/128" ];
|
|
sslKey = config.security.acme.certs."${config.networking.fqdn}-postfix".directory + "/key.pem";
|
|
sslCert = config.security.acme.certs."${config.networking.fqdn}-postfix".directory + "/cert.pem";
|
|
config = {
|
|
smtpd_tls_security_level = "may";
|
|
smtpd_milters = [ "unix:/run/opendkim/opendkim.sock" ];
|
|
};
|
|
enableSubmission = true;
|
|
submissionOptions = {
|
|
milter_macro_daemon_name = "ORIGINATING";
|
|
cleanup_service_name = "submission-header-cleanup";
|
|
smtpd_tls_security_level = "encrypt";
|
|
smtpd_sasl_auth_enable = "yes";
|
|
smtpd_sasl_type = "dovecot";
|
|
smtpd_sasl_path = "/var/run/dovecot2/auth";
|
|
smtpd_sasl_security_options = "noanonymous";
|
|
smtpd_client_restrictions = "permit_mynetworks,permit_sasl_authenticated,reject";
|
|
smtpd_recipient_restrictions = "reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject";
|
|
};
|
|
masterConfig = {
|
|
"submission-header-cleanup" = {
|
|
type = "unix";
|
|
private = false;
|
|
chroot = false;
|
|
maxproc = 0;
|
|
command = "cleanup";
|
|
args = ["-o" "header_checks=pcre:${submissionHeaderCleanupRules}"];
|
|
};
|
|
};
|
|
};
|
|
|
|
security.acme.certs."${config.networking.fqdn}-dovecot" = {
|
|
domain = config.networking.fqdn;
|
|
webroot = "/var/lib/acme/.challenges";
|
|
group = config.services.dovecot2.group;
|
|
};
|
|
|
|
services.dovecot2 = {
|
|
enable = true;
|
|
sslServerKey = config.security.acme.certs."${config.networking.fqdn}-dovecot".directory + "/key.pem";
|
|
sslServerCert = config.security.acme.certs."${config.networking.fqdn}-dovecot".directory + "/cert.pem";
|
|
mailboxes = {
|
|
Junk = { specialUse = "Junk"; auto = "subscribe"; };
|
|
Sent = { specialUse = "Sent"; auto = "subscribe"; };
|
|
Drafts = { specialUse = "Drafts"; auto = "subscribe"; };
|
|
Trash = { specialUse = "Trash"; auto = "subscribe"; };
|
|
Archive = { specialUse = "Archive"; auto = "subscribe"; };
|
|
};
|
|
extraConfig = ''
|
|
ssl = required
|
|
service auth {
|
|
unix_listener auth {
|
|
mode = 0660
|
|
user = postfix
|
|
group = postfix
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
|
|
services.roundcube = {
|
|
enable = true;
|
|
hostName = "webmail.ktiu.net";
|
|
extraConfig = ''
|
|
$config['smtp_host'] = 'tls://%h';
|
|
$config['smtp_conn_options'] = [
|
|
'ssl' => [
|
|
'verify_peer' => false,
|
|
'verify_peer_name' => false,
|
|
],
|
|
];
|
|
'';
|
|
};
|
|
|
|
}
|