modules/nixos/mailserver.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

{config, ...}: {
  mailserver = {
    enable = true;
    stateVersion = 3;

    # domain bs
    fqdn = "mail.${config.networking.domain}";
    domains = ["${config.networking.domain}"];
    x509.useACMEHost = config.mailserver.fqdn;

    loginAccounts = {
      # test acc
      "test@${config.networking.domain}" = {
        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-test-pw.path;
      };
      "admin@${config.networking.domain}" = {
        hashedPasswordFile = builtins.toString config.age.secrets.mailserver-acc-admin-pw.path;
        aliases = ["@${config.networking.domain}"];
      };
    };
  };

  # put dkim key into /etc for declarability
  mailserver.dkimKeyDirectory = "/etc/dkim";
  environment.etc."dkim/${config.networking.domain}.${config.mailserver.dkimSelector}.key" = {
    source = config.age.secrets."dkim-${config.networking.domain}.${config.mailserver.dkimSelector}.key".path;
    mode = "600";
    user = config.services.rspamd.user;
    group = config.services.rspamd.group;
  };

  # does acme for me
  services.nginx = {
    enable = true;
    virtualHosts = {
      "mail.${config.networking.domain}" = {
        forceSSL = true;
        enableACME = true;
      };
      "matrix.${config.networking.domain}" = {
        forceSSL = true;
        enableACME = true;
      };
      "${config.networking.domain}" = {
        forceSSL = true;
        enableACME = true;
      };
    };
  };
  security.acme = {
    acceptTerms = true;
    defaults.email = "mtgmonket@gmail.com";
  };
}