losurdo: add creds

[sourcephile-nix.git] / hosts / mermet / dovecot.nix

diff --git a/hosts/mermet/dovecot.nix b/hosts/mermet/dovecot.nix
index 17b6f99b75c2da19c69d4377f0e85352f420c969..e6dd468b5a544685fc2ee84e1996b47b9e2fb61e 100644 (file)
--- a/hosts/mermet/dovecot.nix
+++ b/hosts/mermet/dovecot.nix
@@ -1,4 +1,4 @@
-{ inputs, pkgs, lib, config, system, host, ... }:
+{ pkgs, lib, config, host, hostName, ... }:
 let
   inherit (builtins) toString toFile readFile;
   inherit (lib) types;
@@ -6,7 +6,6 @@ let
   inherit (config) networking;
   inherit (config.services) dovecot2 postfix openldap;
 
-  # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
   stateDir = "/var/lib/dovecot";
 
   sieve_pipe_bin_dir = pkgs.buildEnv {
@@ -63,6 +62,9 @@ imports = [
   dovecot/sourcephile.fr.nix
   dovecot/autogeree.net.nix
 ];
+environment.systemPackages = [
+  pkgs.dovecot_pigeonhole
+];
 users.groups.acme.members = [ dovecot2.user ];
 systemd.services.dovecot2 = {
   after = [
@@ -95,17 +97,20 @@ systemd.services.dovecot2 = {
 };
 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
 networking.nftables.ruleset = ''
-  add rule inet filter net2fw tcp dport 993 counter accept comment "IMAPS"
-  #add rule inet filter net2fw tcp dport 995 counter accept comment "POP3S"
-  add rule inet filter net2fw tcp dport 4190 counter accept comment "Sieve"
+  table inet filter {
+    chain input-net {
+      tcp dport imaps counter accept comment "dovecot: IMAPS"
+      #tcp dport 995 counter accept comment "dovecot: POP3S"
+      tcp dport sieve counter accept comment "dovecot: Sieve"
+    }
+  }
 '';
 fileSystems."/var/lib/dovecot" = {
   device = "rpool/var/mail";
   fsType = "zfs";
 };
 services.sanoid.datasets."rpool/var/mail" = {
-  use_template = [ "local" ];
-  hourly = 12;
+  use_template = [ "snap" ];
   daily = 7;
 };
 services.dovecot2 = {
@@ -139,7 +144,7 @@ services.dovecot2 = {
     log_timestamp = "%Y-%m-%d %H:%M:%S "
 
     ssl = required
-    ssl_dh = <${inputs.secrets + "/openssl/dh.pem"}
+    ssl_dh = <${dovecot/dh4096.pem}
     ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
     ssl_prefer_server_ciphers = yes
     ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
@@ -288,7 +293,7 @@ services.dovecot2 = {
     protocol lda {
       hostname = ${networking.domain}
       mail_plugins = $mail_plugins sieve
-      postmaster_address = postmaster+dovecot+lda@${networking.domain}
+      postmaster_address = root+dovecot+lda@${networking.domain}
       syslog_facility = mail
     }
     lda_mailbox_autocreate = yes
@@ -296,7 +301,7 @@ services.dovecot2 = {
 
     protocol lmtp {
       mail_plugins = $mail_plugins sieve
-      postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
+      postmaster_address = root+dovecot+lmtp@${networking.domain}
     }
     service lmtp {
       process_min_avail = ${toString host.CPUs}
@@ -497,7 +502,7 @@ services.dovecot2 = {
           USER=$2
           cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
           "plugin/quota=maildir:User quota:noenforcing"
-          From: postmaster@${networking.domain}
+          From: root+docevot@${networking.domain}
           Subject: [WARNING] your mailbox is now $PERCENT% full.
 
           Please remove some mails to make room for new ones.