]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/dovecot/sourcephile.fr.nix
security: no longer depend upon upstream's hardening
[sourcephile-nix.git] / machines / mermet / dovecot / sourcephile.fr.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (builtins) readFile;
4 inherit (config.services) dovecot2;
5 stateDir = "/var/lib/dovecot";
6 domain = "sourcephile.fr";
7 domainGroup = "sourcephile";
8 in
9 {
10 services.dovecot2.extraConfig =
11 let domainConfig = ''
12 ssl_cert = </var/lib/acme/${domain}/fullchain.pem
13 ssl_key = </var/lib/acme/${domain}/key.pem
14 '';
15 in lib.mkAfter ''
16 local_name mail.${domain} {
17 ${domainConfig}
18 }
19 local_name imap.${domain} {
20 ${domainConfig}
21 }
22 passdb {
23 username_filter = *@${domain}
24 # Because auth_bind=yes and auth_bind_userdn are used,
25 # this cannot prefetch any userdb_*.
26 driver = ldap
27 # The path to the ldap.conf must be unique,
28 # otherwise dovecot caches the result from other passdb,
29 # which may be wrong because of username_filter.
30 args = ${pkgs.writeText "${domain}-ldap.conf" (readFile ./ldap.conf)}
31 default_fields =
32 override_fields =
33 skip = authenticated
34 }
35 '';
36 security.acme.certs."${domain}" = {
37 postRun = "systemctl reload dovecot2";
38 };
39 systemd.services.dovecot2 = {
40 wants = [ "acme-selfsigned-${domain}.service" "acme-${domain}.service"];
41 after = [ "acme-selfsigned-${domain}.service" ];
42 preStart = ''
43 install -D -d -m 1770 \
44 -o "${dovecot2.user}" \
45 -g "${domainGroup}" \
46 ${stateDir}/home/${domain} \
47 ${stateDir}/control/${domain} \
48 ${stateDir}/index/${domain} \
49 ${stateDir}/acl/${domain}
50
51 # NOTE: do not set the sticky bit (+t)
52 # on acl/<domain>/, to let dovecot
53 # rename acl.db.lock (own by new user)
54 # to acl.db (own by old user)
55 chmod -t ${stateDir}/acl/${domain}
56 '';
57 };
58 services.nginx.virtualHosts."autoconfig.${domain}" = {
59 serverName = "autoconfig.${domain}";
60 #addSSL = true;
61 extraConfig = ''
62 access_log off;
63 log_not_found off;
64 '';
65 forceSSL = true;
66 useACMEHost = domain;
67 root = ./autoconfig;
68 };
69 }