update

diff --git a/install/logical/friot.nix b/install/logical/friot.nix
index a54748b6de38fa439fb7a4892b4b811b83dd1628..38d41b30861d96c4cca70b7d77d5d2aa8a061d0e 100644 (file)
--- a/install/logical/friot.nix
+++ b/install/logical/friot.nix
@@ -99,6 +99,7 @@ config = {
       domains =
        [ "www.${config.networking.domain}" ] ++
        [ "git.${config.networking.domain}" ] ++
+       [ "mail.${config.networking.domain}" ] ++
        builtins.attrNames dovecot2.domains;
     };
     postfix.aliases = {
@@ -109,8 +110,15 @@ config = {
     dovecot2.domains = {
       "${config.networking.domain}" = {
         accounts = {
+          julm = {
+            password = pass "${config.networking.domain}/mail/julm";
+             # "${config.networking.domain}/dovecot2/julm";
+               #  "{SSHA512}uyjL1KYx4z7HpfNvnKzuVxpMLD2KVueGGBvOcj7AF1EZCTVhT++IIKUVOC4xpZtWdqVD0OVmZqgYr2qpn/3t3Aj4oU0=";
+            aliases  = ["julien.moutinho@${config.networking.domain}"];
+            quota    = "512M";
+          };
           test = {
-            password = builtins.extraBuiltins.pass "${config.networking.domain}/dovecot2/test";
+            password = pass "${config.networking.domain}/mail/test";
              # "${config.networking.domain}/dovecot2/test";
                #  "{SSHA512}uyjL1KYx4z7HpfNvnKzuVxpMLD2KVueGGBvOcj7AF1EZCTVhT++IIKUVOC4xpZtWdqVD0OVmZqgYr2qpn/3t3Aj4oU0=";
             aliases  = ["test-alias@${config.networking.domain}"];
@@ -148,6 +156,7 @@ config = {
       inetutils
       cgit
       ncdu
+      #mailutils
     ];
   };
 };

diff --git a/install/logical/friot/dovecot.nix b/install/logical/friot/dovecot.nix
index 67083321694259c28aa61fcdcfbc6ab440eb7f4e..17ec3aa093140e693cdec5504b5aaf01ec5000dc 100644 (file)
--- a/install/logical/friot/dovecot.nix
+++ b/install/logical/friot/dovecot.nix
@@ -19,71 +19,71 @@ let inherit (builtins) toString toFile attrNames;
 in
 {
 config = {
-  environment.etc."nginx/site.d/autoconfig.conf".source =
-    let servers = lib.concatMapStringsSep " "
-                   (dom: "autoconfig.${dom}")
-                   (attrNames dovecot2.domains);
-        autoconfigSite = pkgs.writeTextFile {
-          name = "autoconfig";
-          destination = "/mail/config-v1.1.xml";
-          text = ''
-            <?xml version="1.0"?>
-            <clientConfig version="1.1">
-              <emailProvider id="%EMAILDOMAIN%">
-                <!-- <displayName></displayName> -->
-                <!-- <displayShortName></displayShortName> -->
-                <domain>%EMAILDOMAIN%</domain>
-                <incomingServer type="imap">
-                  <hostname>imap.%EMAILDOMAIN%</hostname>
-                  <port>993</port>
-                  <socketType>SSL</socketType>
-                  <username>%EMAILADDRESS%</username>
-                  <authentication>password-cleartext</authentication>
-                </incomingServer>
-                <incomingServer type="pop3">
-                  <hostname>pop.%EMAILDOMAIN%</hostname>
-                  <port>995</port>
-                  <socketType>SSL</socketType>
-                  <username>%EMAILADDRESS%</username>
-                  <authentication>password-cleartext</authentication>
-                  <pop3>
-                    <leaveMessagesOnServer>false</leaveMessagesOnServer>
-                    <downloadOnBiff>true</downloadOnBiff>
-                  </pop3>
-                </incomingServer>
-                <outgoingServer type="smtp">
-                  <hostname>smtp.%EMAILDOMAIN%</hostname>
-                  <port>465</port>
-                  <socketType>SSL</socketType> <!-- see above -->
-                  <username>%EMAILADDRESS%</username> <!-- if smtp-auth -->
-                  <authentication>password-cleartext</authentication>
-                  <!-- <restriction>client-IP-address</restriction> -->
-                  <addThisServer>true</addThisServer>
-                  <useGlobalPreferredServer>false</useGlobalPreferredServer>
-                </outgoingServer>
-              </emailProvider>
-              <!-- <clientConfigUpdate url="https://www.example.com/config/mozilla.xml" /> -->
-            </clientConfig>
-          '';
-        };
-    in
-    pkgs.writeText "autoconfig.conf" ''
-      server {
-        listen 80;
-        server_name ${servers};
-        root ${autoconfigSite};
-        access_log off;
-        log_not_found off;
-      }
-      server {
-        listen 443 ssl http2;
-        ssl on;
-        server_name ${servers};
-        root ${autoconfigSite};
-        access_log off;
-        log_not_found off;
-      }
-    '';
+  #environment.etc."nginx/site.d/autoconfig.conf".source =
+  #  let servers = lib.concatMapStringsSep " "
+  #                 (dom: "autoconfig.${dom}")
+  #                 (attrNames dovecot2.domains);
+  #      autoconfigSite = pkgs.writeTextFile {
+  #        name = "autoconfig";
+  #        destination = "/mail/config-v1.1.xml";
+  #        text = ''
+  #          <?xml version="1.0"?>
+  #          <clientConfig version="1.1">
+  #            <emailProvider id="%EMAILDOMAIN%">
+  #              <!-- <displayName></displayName> -->
+  #              <!-- <displayShortName></displayShortName> -->
+  #              <domain>%EMAILDOMAIN%</domain>
+  #              <incomingServer type="imap">
+  #                <hostname>imap.%EMAILDOMAIN%</hostname>
+  #                <port>993</port>
+  #                <socketType>SSL</socketType>
+  #                <username>%EMAILADDRESS%</username>
+  #                <authentication>password-cleartext</authentication>
+  #              </incomingServer>
+  #              <incomingServer type="pop3">
+  #                <hostname>pop.%EMAILDOMAIN%</hostname>
+  #                <port>995</port>
+  #                <socketType>SSL</socketType>
+  #                <username>%EMAILADDRESS%</username>
+  #                <authentication>password-cleartext</authentication>
+  #                <pop3>
+  #                  <leaveMessagesOnServer>false</leaveMessagesOnServer>
+  #                  <downloadOnBiff>true</downloadOnBiff>
+  #                </pop3>
+  #              </incomingServer>
+  #              <outgoingServer type="smtp">
+  #                <hostname>smtp.%EMAILDOMAIN%</hostname>
+  #                <port>465</port>
+  #                <socketType>SSL</socketType> <!-- see above -->
+  #                <username>%EMAILADDRESS%</username> <!-- if smtp-auth -->
+  #                <authentication>password-cleartext</authentication>
+  #                <!-- <restriction>client-IP-address</restriction> -->
+  #                <addThisServer>true</addThisServer>
+  #                <useGlobalPreferredServer>false</useGlobalPreferredServer>
+  #              </outgoingServer>
+  #            </emailProvider>
+  #            <!-- <clientConfigUpdate url="https://www.example.com/config/mozilla.xml" /> -->
+  #          </clientConfig>
+  #        '';
+  #      };
+  #  in
+  #  pkgs.writeText "autoconfig.conf" ''
+  #    server {
+  #      listen 80;
+  #      server_name ${servers};
+  #      root ${autoconfigSite};
+  #      access_log off;
+  #      log_not_found off;
+  #    }
+  #    server {
+  #      listen 443 ssl http2;
+  #      ssl on;
+  #      server_name ${servers};
+  #      root ${autoconfigSite};
+  #      access_log off;
+  #      log_not_found off;
+  #    }
+  #  '';
   #services.postfix.mapFiles."transport-dovecot" =
   #  toFile "transport-dovecot"
   #   (unlines
@@ -217,6 +217,7 @@ config = {
       # Install users
       ''
       + unlines (lib.mapAttrsToList (user: acct: ''
+        (
         home=${mailDir}/${domain}/${user}
         gecos=
         shell=/run/current-system/sw/bin/nologin
@@ -260,6 +261,7 @@ config = {
         }
         printf '%s\n' >>$new_passwd \
          "${user}:$pass:$uid:$gid:$gecos:$home:$shell:$extra_fields"
+        )
       '') accounts)
       + ''
       install -o ${authUser} -g ${authGroup} -m 0640 $new_passwd $old_passwd
@@ -537,8 +539,8 @@ config = {
       ssl = required
       #ssl_ca   = <''${caPath}
       ssl_cert = <${x509.cert}
-      # Only with dovecot >= 2.3
-      #ssl_dh   = <${x509.dir}/dh.pem
+      ssl_dh   = <${x509.dir}/dh.pem
+        # gOTE: only with dovecot >= 2.3
       ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL
       ssl_key = <${x509.key}
       #ssl_verify_client_cert = yes

diff --git a/install/logical/friot/postfix.nix b/install/logical/friot/postfix.nix
index 41aefab1c13fa94c2c9c9736ad09ecc9e69f30ee..c51b9e2614658f3dc6edce7ef8d6a09402420ab6 100644 (file)
--- a/install/logical/friot/postfix.nix
+++ b/install/logical/friot/postfix.nix
@@ -32,7 +32,7 @@ options.services.postfix.aliases = lib.mkOption {
 config = {
   systemd.services.postfix.after =
     if x509.scheme == "letsencrypt"
-    then [ "nginx.service" ]
+    then [ "nginx.service" ] # XXX: not sure if this is enough
     else [];
   services.postfix = {
     enable = true;

diff --git a/install/logical/friot/rmilter.nix b/install/logical/friot/rmilter.nix
index ed5b2694b57510fd00dc761be43b9838ac5af3c6..6cef2e8b72707c829546882b933120c2efe8f4dc 100644 (file)
--- a/install/logical/friot/rmilter.nix
+++ b/install/logical/friot/rmilter.nix
@@ -3,15 +3,15 @@ let inherit (builtins) attrNames;
     inherit (lib) types;
     inherit (config.services) dkim dovecot2 rmilter;
 
-    createDomainDkimCert = dom:
-      let dkim_key = "${dkim.keyDir}/${dom}.${dkim.selector}.key";
-          dkim_txt = "${dkim.keyDir}/${dom}.${dkim.selector}.txt";
+    createDomainDkimCert = domain:
+      let dkim_key = "${dkim.keyDir}/${domain}.${dkim.selector}.key";
+          dkim_txt = "${dkim.keyDir}/${domain}.${dkim.selector}.txt";
       in ''
       if [ ! -f "${dkim_key}" ] || [ ! -f "${dkim_txt}" ]
        then
         ${pkgs.opendkim}/bin/opendkim-genkey \
-          -s "${dkim.selector}" \
-          -d "${dom}" \
+          --domain "${domain}" \
+          --selector "${dkim.selector}" \
           --directory="${dkim.keyDir}"
         mv "${dkim.keyDir}/${dkim.selector}.private" "${dkim_key}"
         mv "${dkim.keyDir}/${dkim.selector}.txt" "${dkim_txt}"
@@ -70,7 +70,9 @@ config = {
         auth_only = yes;
       };
     '';
+    bindSocket.type = "inet";
   };
+  #systemd.sockets.rmilter.socketConfig.Accept = true;
   systemd.services.rmilter = {
     requires = [ "rmilter.socket" ];
     after    = [ "rmilter.socket" ];