after = [
"postfix.service"
"openldap.service"
- "${networking.domain}.key.pem-key.service"
];
/*
preStart = ''
ssl_dh = <${../../../sec/openssl/dh.pem}
ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
ssl_prefer_server_ciphers = yes
- ssl_cert = <${loadFile (../../../sec + "/openssl/${networking.domain}/cert.self-signed.pem")}
- ssl_key = </run/keys/${networking.domain}.key.pem
+ ssl_cert = </var/lib/acme/${networking.domain}/fullchain.pem
+ ssl_key = </var/lib/acme/${networking.domain}/key.pem
#ssl_ca = <''${caPath}
#ssl_verify_client_cert = yes
userdb {
driver = ldap
# A different path than passdb's args enables non-blocking LDAP requests
- args = ${dovecot/ldap.conf}
+ args = ${pkgs.symlinkJoin {name="ldap"; paths=[./dovecot];}}/ldap.conf
default_fields =
override_fields =
}
--- /dev/null
+<?xml version="1.0"?>
+<clientConfig version="1.1">
+ <emailProvider id="%EMAILDOMAIN%">
+ <!-- <displayName></displayName> -->
+ <!-- <displayShortName></displayShortName> -->
+ <domain>%EMAILDOMAIN%</domain>
+ <incomingServer type="imap">
+ <hostname>mail.%EMAILDOMAIN%</hostname>
+ <port>993</port>
+ <socketType>SSL</socketType>
+ <username>%EMAILADDRESS%</username>
+ <authentication>password-cleartext</authentication>
+ </incomingServer>
+ <!--
+ <incomingServer type="pop3">
+ <hostname>mail.%EMAILDOMAIN%</hostname>
+ <port>995</port>
+ <socketType>SSL</socketType>
+ <username>%EMAILADDRESS%</username>
+ <authentication>password-cleartext</authentication>
+ <pop3>
+ <leaveMessagesOnServer>false</leaveMessagesOnServer>
+ <downloadOnBiff>true</downloadOnBiff>
+ </pop3>
+ </incomingServer>
+ -->
+ <outgoingServer type="smtp">
+ <hostname>mail.%EMAILDOMAIN%</hostname>
+ <port>465</port>
+ <socketType>SSL</socketType> <!-- see above -->
+ <username>%EMAILADDRESS%</username> <!-- if smtp-auth -->
+ <authentication>password-cleartext</authentication>
+ <!-- <restriction>client-IP-address</restriction> -->
+ <addThisServer>true</addThisServer>
+ <useGlobalPreferredServer>false</useGlobalPreferredServer>
+ </outgoingServer>
+ </emailProvider>
+ <!-- <clientConfigUpdate url="https://www.example.com/config/mozilla.xml" /> -->
+</clientConfig>
{ pkgs, lib, config, ... }:
let
+ inherit (builtins) readFile;
inherit (config.services) dovecot2;
stateDir = "/var/lib/dovecot";
domain = "autogeree.net";
domainGroup = "autogeree";
- domainConfig = ''
+in
+{
+services.dovecot2.extraConfig =
+ let domainConfig = ''
ssl_cert = <${../../../../sec/openssl/autogeree.net/cert.self-signed.pem}
ssl_key = </run/keys/${domain}.key.pem
'';
-in
-{
+ in lib.mkAfter ''
+ local_name mail.${domain} {
+ ${domainConfig}
+ }
+ local_name imap.${domain} {
+ ${domainConfig}
+ }
+ passdb {
+ username_filter = *@${domain}
+ # Because auth_bind=yes and auth_bind_userdn are used,
+ # this cannot prefetch any userdb_*.
+ driver = ldap
+ # The path to the ldap.conf must be unique,
+ # otherwise dovecot caches the result from other passdb,
+ # which may be wrong because of username_filter.
+ args = ${pkgs.writeText "${domain}-ldap.conf" (readFile ./ldap.conf)}
+ default_fields =
+ override_fields =
+ skip = authenticated
+ }
+'';
+systemd.services.dovecot2.after = [
+ "${domain}.key.pem-key.service"
+];
systemd.services.dovecot2 = {
preStart = ''
install -D -d -m 1770 \
chmod -t ${stateDir}/acl/${domain}
'';
};
-services.dovecot2 = {
- extraConfig = lib.mkAfter ''
- passdb {
- username_filter = *@${domain}
- driver = ldap
- # Because auth_bind=yes and auth_bind_userdn are used,
- # this cannot prefetch any userdb_*.
- args = ${./ldap.conf}
- default_fields =
- override_fields =
- }
- local_name mail.${domain} {
- ${domainConfig}
- }
- local_name imap.${domain} {
- ${domainConfig}
- }
- '';
-};
services.nginx.virtualHosts."autoconfig.${domain}" = {
serverName = "autoconfig.${domain}";
#addSSL = true;
access_log off;
log_not_found off;
'';
- root = pkgs.writeTextFile {
- name = "autoconfig";
- destination = "/mail/config-v1.1.xml";
- text = ''
- <?xml version="1.0"?>
- <clientConfig version="1.1">
- <emailProvider id="%EMAILDOMAIN%">
- <!-- <displayName></displayName> -->
- <!-- <displayShortName></displayShortName> -->
- <domain>%EMAILDOMAIN%</domain>
- <incomingServer type="imap">
- <hostname>mail.%EMAILDOMAIN%</hostname>
- <port>993</port>
- <socketType>SSL</socketType>
- <username>%EMAILADDRESS%</username>
- <authentication>password-cleartext</authentication>
- </incomingServer>
- <incomingServer type="pop3">
- <hostname>mail.%EMAILDOMAIN%</hostname>
- <port>995</port>
- <socketType>SSL</socketType>
- <username>%EMAILADDRESS%</username>
- <authentication>password-cleartext</authentication>
- <pop3>
- <leaveMessagesOnServer>false</leaveMessagesOnServer>
- <downloadOnBiff>true</downloadOnBiff>
- </pop3>
- </incomingServer>
- <outgoingServer type="smtp">
- <hostname>mail.%EMAILDOMAIN%</hostname>
- <port>465</port>
- <socketType>SSL</socketType> <!-- see above -->
- <username>%EMAILADDRESS%</username> <!-- if smtp-auth -->
- <authentication>password-cleartext</authentication>
- <!-- <restriction>client-IP-address</restriction> -->
- <addThisServer>true</addThisServer>
- <useGlobalPreferredServer>false</useGlobalPreferredServer>
- </outgoingServer>
- </emailProvider>
- <!-- <clientConfigUpdate url="https://www.example.com/config/mozilla.xml" /> -->
- </clientConfig>
- '';
- };
+ root = ./autoconfig;
};
}
{ pkgs, lib, config, ... }:
let
+ inherit (builtins) readFile;
inherit (config.services) dovecot2;
stateDir = "/var/lib/dovecot";
domain = "sourcephile.fr";
domainGroup = "sourcephile";
- domainConfig = ''
- ssl_cert = <${../../../../sec/openssl/sourcephile.fr/cert.self-signed.pem}
- ssl_key = </run/keys/${domain}.key.pem
- '';
in
{
+services.dovecot2.extraConfig =
+ let domainConfig = ''
+ ssl_cert = </var/lib/acme/${domain}/fullchain.pem
+ ssl_key = </var/lib/acme/${domain}/key.pem
+ '';
+ in lib.mkAfter ''
+ local_name mail.${domain} {
+ ${domainConfig}
+ }
+ local_name imap.${domain} {
+ ${domainConfig}
+ }
+ passdb {
+ username_filter = *@${domain}
+ # Because auth_bind=yes and auth_bind_userdn are used,
+ # this cannot prefetch any userdb_*.
+ driver = ldap
+ # The path to the ldap.conf must be unique,
+ # otherwise dovecot caches the result from other passdb,
+ # which may be wrong because of username_filter.
+ args = ${pkgs.writeText "${domain}-ldap.conf" (readFile ./ldap.conf)}
+ default_fields =
+ override_fields =
+ skip = authenticated
+ }
+'';
+users.groups.acme.members = [ dovecot2.user ];
+systemd.services.dovecot2.after = [
+ "acme-${domain}.service"
+];
systemd.services.dovecot2 = {
preStart = ''
install -D -d -m 1770 \
chmod -t ${stateDir}/acl/${domain}
'';
};
-services.dovecot2 = {
- extraConfig = lib.mkAfter ''
- passdb {
- username_filter = *@${domain}
- driver = ldap
- # Because auth_bind=yes and auth_bind_userdn are used,
- # this cannot prefetch any userdb_*.
- args = ${./ldap.conf}
- default_fields =
- override_fields =
- }
- local_name mail.${domain} {
- ${domainConfig}
- }
- local_name imap.${domain} {
- ${domainConfig}
- }
- '';
-};
services.nginx.virtualHosts."autoconfig.${domain}" = {
serverName = "autoconfig.${domain}";
#addSSL = true;
'';
forceSSL = true;
useACMEHost = domain;
- root = pkgs.writeTextFile {
- name = "autoconfig";
- destination = "/mail/config-v1.1.xml";
- text = ''
- <?xml version="1.0"?>
- <clientConfig version="1.1">
- <emailProvider id="%EMAILDOMAIN%">
- <!-- <displayName></displayName> -->
- <!-- <displayShortName></displayShortName> -->
- <domain>%EMAILDOMAIN%</domain>
- <incomingServer type="imap">
- <hostname>mail.%EMAILDOMAIN%</hostname>
- <port>993</port>
- <socketType>SSL</socketType>
- <username>%EMAILADDRESS%</username>
- <authentication>password-cleartext</authentication>
- </incomingServer>
- <incomingServer type="pop3">
- <hostname>mail.%EMAILDOMAIN%</hostname>
- <port>995</port>
- <socketType>SSL</socketType>
- <username>%EMAILADDRESS%</username>
- <authentication>password-cleartext</authentication>
- <pop3>
- <leaveMessagesOnServer>false</leaveMessagesOnServer>
- <downloadOnBiff>true</downloadOnBiff>
- </pop3>
- </incomingServer>
- <outgoingServer type="smtp">
- <hostname>mail.%EMAILDOMAIN%</hostname>
- <port>465</port>
- <socketType>SSL</socketType> <!-- see above -->
- <username>%EMAILADDRESS%</username> <!-- if smtp-auth -->
- <authentication>password-cleartext</authentication>
- <!-- <restriction>client-IP-address</restriction> -->
- <addThisServer>true</addThisServer>
- <useGlobalPreferredServer>false</useGlobalPreferredServer>
- </outgoingServer>
- </emailProvider>
- <!-- <clientConfigUpdate url="https://www.example.com/config/mozilla.xml" /> -->
- </clientConfig>
- '';
- };
+ root = ./autoconfig;
};
}
# neither sorting them by date).
"maildir:${stateDir}/home/${d}/${uid}/mail:LAYOUT=maildir++:UTF-8:CONTROL=${stateDir}/control/${d}/${uid}:INDEX=${stateDir}/index/${d}/${uid}";
}
- #{ uid="sevy"; uidNumber=10001; cn="Séverine Popek"; sn="sévy";
- # mailAlias = ["severine.popek" "ouais-ouais"]; }
- #{ uid="nomail"; uidNumber=10002; mailAlias = ["noalias"]; mailEnabled = false; }
- #{ uid="post"; mailForwardingAddress = ["ju@${domain}"]; }
- #{ uid="host"; mailForwardingAddress = ["ju@${domain}"]; }
];
};
}
{ pkgs, lib, config, ... }:
let
inherit (pkgs.lib) loadFile;
+ inherit (config.services) postfix;
domain = "sourcephile.fr";
domainSuffix = "dc=sourcephile,dc=fr";
in
{
+users.groups.acme.members = [ postfix.user ];
systemd.services.postfix.after = [
- "${domain}.key.pem-key.service"
+ "acme-${domain}.service"
];
services.postfix = {
extraAliases = ''
'';
tls_server_sni_maps =
let chain = [
- "/run/keys/${domain}.key.pem"
- (loadFile (../../../../sec/openssl + "/${domain}/cert.self-signed.pem"))
+ "/var/lib/acme/${domain}/key.pem"
+ "/var/lib/acme/${domain}/fullchain.pem"
]; in {
"smtp.${domain}" = chain;
"mail.${domain}" = chain;
sourcephile / git / sourcephile-nix.git / commitdiff