derped/nixos
1
0
Fork 0
Code Releases Activity

Fix mailserver service + sops config.

Browse source
This commit is contained in:
Kevin Baensch 2023-09-10 15:22:33 +02:00
parent 2f4472263d
commit b5a6498620
Signed by: derped
GPG key ID: C0F1D326C7626543
2 changed files with 15 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
flake.nix
View file

@ -11,7 +11,7 @@
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
}; };
outputs = { self, nixpkgs, mailserver, sops-nix, ... }@attrs: let outputs = { self, nixpkgs, sops-nix, mailserver, ... }@attrs: let
lib = nixpkgs.lib; lib = nixpkgs.lib;
fn = import ./fn.nix { inherit lib; }; fn = import ./fn.nix { inherit lib; };
system = "x86_64-linux"; system = "x86_64-linux";

20
services/mailserver.nix
View file

@ -1,8 +1,12 @@
{ config, lib, ... }: { config, lib, fn, mailserver, ... }:
with lib; with lib;
mkIf (elem "mailserver" config.machine.services) { {
imports = [
mailserver.nixosModules.mailserver
];
} // mkIf (elem "mailserver" config.machine.services) {
mailserver = let mailserver = let
cfg = config.machine; cfg = config.machine;
domain = cfg.domain; domain = cfg.domain;
@ -12,7 +16,7 @@ mkIf (elem "mailserver" config.machine.services) {
mkUser = user: rec { mkUser = user: rec {
name = "${user.name}@${domain}"; name = "${user.name}@${domain}";
value = { value = {
hashedPassword = (fileContents "${cfg.secretPath}/${user.name}.mail"); hashedPasswordFile = config.sops.secrets."users/${user.name}/mail".path;
aliases = [ "${user.name}@${fdomain}" ] aliases = [ "${user.name}@${fdomain}" ]
++ (flatten (map mkFqdnAlias user.aliases)) ++ (flatten (map mkFqdnAlias user.aliases))
++ (flatten (map mkExDomAlias ([ user.name ] ++ user.aliases))); ++ (flatten (map mkExDomAlias ([ user.name ] ++ user.aliases)));
@ -26,9 +30,9 @@ mkIf (elem "mailserver" config.machine.services) {
# Use Let's Encrypt certificates. Note that this needs to set up a stripped # Use Let's Encrypt certificates. Note that this needs to set up a stripped
# down nginx and opens port 80. # down nginx and opens port 80.
certificateScheme = 1; certificateScheme = "manual";
certificateFile = "/var/lib/acme/" + fqdn + "/fullchain.pem"; certificateFile = "/var/lib/acme/" + fdomain + "/fullchain.pem";
keyFile = "/var/lib/acme/" + fqdn + "/key.pem"; keyFile = "/var/lib/acme/" + fdomain + "/key.pem";
#dhParamBitLength = 4096; # this doesn't exist??? #dhParamBitLength = 4096; # this doesn't exist???
@ -45,4 +49,8 @@ mkIf (elem "mailserver" config.machine.services) {
# 1 Gb RAM for the server. Without virus scanning 256 MB RAM should be plenty) # 1 Gb RAM for the server. Without virus scanning 256 MB RAM should be plenty)
virusScanning = false; virusScanning = false;
}; };
sops.secrets = (fn.sopsHelper
(user: "users/${user.name}/mail")
config.machine.mailAccounts
{});
} }