machines/mermet/dovecot/sourcephile.fr.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins) readFile;
   4   inherit (config.services) dovecot2;
   5   stateDir = "/var/lib/dovecot";
   6   domain = "sourcephile.fr";
   7   domainGroup = "sourcephile";
   8 in
   9 {
  10 services.dovecot2.extraConfig =
  11   let domainConfig = ''
  12     ssl_cert = </var/lib/acme/${domain}/fullchain.pem
  13     ssl_key = </var/lib/acme/${domain}/key.pem
  14   '';
  15   in lib.mkAfter ''
  16   local_name mail.${domain} {
  17     ${domainConfig}
  18   }
  19   local_name imap.${domain} {
  20     ${domainConfig}
  21   }
  22   passdb {
  23     username_filter = *@${domain}
  24     # Because auth_bind=yes and auth_bind_userdn are used,
  25     # this cannot prefetch any userdb_*.
  26     driver = ldap
  27     # The path to the ldap.conf must be unique,
  28     # otherwise dovecot caches the result from other passdb,
  29     # which may be wrong because of username_filter.
  30     args = ${pkgs.writeText "${domain}-ldap.conf" (readFile ./ldap.conf)}
  31     default_fields =
  32     override_fields =
  33     skip = authenticated
  34   }
  35 '';
  36 security.acme.certs."${domain}" = {
  37   postRun = "systemctl reload dovecot2";
  38 };
  39 systemd.services.dovecot2 = {
  40   wants = [ "acme-selfsigned-${domain}.service" "acme-${domain}.service"];
  41   after = [ "acme-selfsigned-${domain}.service" ];
  42   preStart = ''
  43     install -D -d -m 1770 \
  44      -o "${dovecot2.user}" \
  45      -g "${domainGroup}" \
  46      ${stateDir}/home/${domain} \
  47      ${stateDir}/control/${domain} \
  48      ${stateDir}/index/${domain} \
  49      ${stateDir}/acl/${domain}
  50
  51     # NOTE: do not set the sticky bit (+t)
  52     #       on acl/<domain>/, to let dovecot
  53     #       rename acl.db.lock (own by new user)
  54     #       to     acl.db      (own by old user)
  55     chmod -t ${stateDir}/acl/${domain}
  56   '';
  57 };
  58 services.nginx.virtualHosts."autoconfig.${domain}" = {
  59   serverName = "autoconfig.${domain}";
  60   #addSSL = true;
  61   extraConfig = ''
  62     access_log off;
  63     log_not_found off;
  64   '';
  65   forceSSL = true;
  66   useACMEHost = domain;
  67   root = ./autoconfig;
  68 };
  69 }