mirror of
https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-config.git
synced 2025-03-12 17:03:49 +00:00
fix mailserver: evaluate without auth module
This commit is contained in:
Alexander Tomokhov
parent
0c7a8d51b0
commit
d8d1a1e86f
4 changed files with 127 additions and 118 deletions
sp-modules/simple-nixos-mailserver
|
|
@ -62,7 +62,7 @@ let
|
|||
'';
|
||||
};
|
||||
in
|
||||
lib.mkIf is-auth-enabled {
|
||||
{
|
||||
mailserver.ldap = {
|
||||
# note: in `ldapsearch` first comes filter, then attributes
|
||||
dovecot.userAttrs = "+"; # all operational attributes
|
||||
|
|
|
|||
|
|
@ -51,7 +51,7 @@ let
|
|||
destination = ldapVirtualMailboxMapFile;
|
||||
};
|
||||
in
|
||||
lib.mkIf is-auth-enabled {
|
||||
{
|
||||
mailserver.ldap = {
|
||||
postfix.mailAttribute = "mail";
|
||||
postfix.uidAttribute = "uid";
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
{ config, lib, options, pkgs, ... }@nixos-args:
|
||||
let
|
||||
sp = config.selfprivacy;
|
||||
|
||||
inherit (import ./common.nix {inherit config pkgs;})
|
||||
inherit (import ./common.nix { inherit config pkgs; })
|
||||
auth-passthru
|
||||
domain
|
||||
is-auth-enabled
|
||||
|
|
@ -67,63 +67,49 @@ let
|
|||
fi
|
||||
'';
|
||||
in
|
||||
lib.mkIf sp.modules.simple-nixos-mailserver.enable
|
||||
{
|
||||
fileSystems = lib.mkIf sp.useBinds
|
||||
{
|
||||
"/var/vmail" = {
|
||||
device =
|
||||
"/volumes/${sp.modules.simple-nixos-mailserver.location}/vmail";
|
||||
options = [
|
||||
"bind"
|
||||
"x-systemd.required-by=postfix.service"
|
||||
"x-systemd.before=postfix.service"
|
||||
];
|
||||
lib.mkIf sp.modules.simple-nixos-mailserver.enable (lib.mkMerge [
|
||||
{
|
||||
fileSystems = lib.mkIf sp.useBinds
|
||||
{
|
||||
"/var/vmail" = {
|
||||
device =
|
||||
"/volumes/${sp.modules.simple-nixos-mailserver.location}/vmail";
|
||||
options = [
|
||||
"bind"
|
||||
"x-systemd.required-by=postfix.service"
|
||||
"x-systemd.before=postfix.service"
|
||||
];
|
||||
};
|
||||
"/var/sieve" = {
|
||||
device =
|
||||
"/volumes/${sp.modules.simple-nixos-mailserver.location}/sieve";
|
||||
options = [
|
||||
"bind"
|
||||
"x-systemd.required-by=dovecot2.service"
|
||||
"x-systemd.before=dovecot2.service"
|
||||
];
|
||||
};
|
||||
};
|
||||
"/var/sieve" = {
|
||||
device =
|
||||
"/volumes/${sp.modules.simple-nixos-mailserver.location}/sieve";
|
||||
options = [
|
||||
"bind"
|
||||
"x-systemd.required-by=dovecot2.service"
|
||||
"x-systemd.before=dovecot2.service"
|
||||
];
|
||||
|
||||
users.users = {
|
||||
virtualMail = {
|
||||
isNormalUser = false;
|
||||
};
|
||||
};
|
||||
|
||||
users.users = {
|
||||
virtualMail = {
|
||||
isNormalUser = false;
|
||||
};
|
||||
};
|
||||
users.groups.acmereceivers.members = [ "dovecot2" "postfix" "virtualMail" ];
|
||||
|
||||
users.groups.acmereceivers.members = [ "dovecot2" "postfix" "virtualMail" ];
|
||||
mailserver = {
|
||||
enable = true;
|
||||
fqdn = sp.domain;
|
||||
domains = [ sp.domain ];
|
||||
localDnsResolver = false;
|
||||
|
||||
mailserver = {
|
||||
enable = true;
|
||||
fqdn = sp.domain;
|
||||
domains = [ sp.domain ];
|
||||
localDnsResolver = false;
|
||||
|
||||
# A list of all login accounts. To create the password hashes, use
|
||||
# mkpasswd -m sha-512 "super secret password"
|
||||
loginAccounts = lib.mkIf (!is-auth-enabled) ({
|
||||
"${sp.username}@${sp.domain}" = {
|
||||
hashedPassword = sp.hashedMasterPassword;
|
||||
sieveScript = ''
|
||||
require ["fileinto", "mailbox"];
|
||||
if header :contains "Chat-Version" "1.0"
|
||||
{
|
||||
fileinto :create "DeltaChat";
|
||||
stop;
|
||||
}
|
||||
'';
|
||||
};
|
||||
} // builtins.listToAttrs (builtins.map
|
||||
(user: {
|
||||
name = "${user.username}@${sp.domain}";
|
||||
value = {
|
||||
hashedPassword = user.hashedPassword;
|
||||
# A list of all login accounts. To create the password hashes, use
|
||||
# mkpasswd -m sha-512 "super secret password"
|
||||
loginAccounts = ({
|
||||
"${sp.username}@${sp.domain}" = {
|
||||
hashedPassword = sp.hashedMasterPassword;
|
||||
sieveScript = ''
|
||||
require ["fileinto", "mailbox"];
|
||||
if header :contains "Chat-Version" "1.0"
|
||||
|
|
@ -133,70 +119,95 @@ lib.mkIf sp.modules.simple-nixos-mailserver.enable
|
|||
}
|
||||
'';
|
||||
};
|
||||
})
|
||||
sp.users));
|
||||
} // builtins.listToAttrs (builtins.map
|
||||
(user: {
|
||||
name = "${user.username}@${sp.domain}";
|
||||
value = {
|
||||
hashedPassword = user.hashedPassword;
|
||||
sieveScript = ''
|
||||
require ["fileinto", "mailbox"];
|
||||
if header :contains "Chat-Version" "1.0"
|
||||
{
|
||||
fileinto :create "DeltaChat";
|
||||
stop;
|
||||
}
|
||||
'';
|
||||
};
|
||||
})
|
||||
sp.users));
|
||||
|
||||
extraVirtualAliases = lib.mkIf (!is-auth-enabled) {
|
||||
"admin@${sp.domain}" = "${sp.username}@${sp.domain}";
|
||||
extraVirtualAliases = {
|
||||
"admin@${sp.domain}" = "${sp.username}@${sp.domain}";
|
||||
};
|
||||
|
||||
certificateScheme = "manual";
|
||||
certificateFile = "/var/lib/acme/root-${sp.domain}/fullchain.pem";
|
||||
keyFile = "/var/lib/acme/root-${sp.domain}/key.pem";
|
||||
|
||||
# Enable IMAP and POP3
|
||||
enableImap = true;
|
||||
enableImapSsl = true;
|
||||
enablePop3 = false;
|
||||
enablePop3Ssl = false;
|
||||
dkimSelector = "selector";
|
||||
|
||||
# Enable the ManageSieve protocol
|
||||
enableManageSieve = true;
|
||||
|
||||
virusScanning = false;
|
||||
|
||||
mailDirectory = "/var/vmail";
|
||||
};
|
||||
|
||||
certificateScheme = "manual";
|
||||
certificateFile = "/var/lib/acme/root-${sp.domain}/fullchain.pem";
|
||||
keyFile = "/var/lib/acme/root-${sp.domain}/key.pem";
|
||||
|
||||
# Enable IMAP and POP3
|
||||
enableImap = true;
|
||||
enableImapSsl = true;
|
||||
enablePop3 = false;
|
||||
enablePop3Ssl = false;
|
||||
dkimSelector = "selector";
|
||||
|
||||
# Enable the ManageSieve protocol
|
||||
enableManageSieve = true;
|
||||
|
||||
virusScanning = false;
|
||||
|
||||
mailDirectory = "/var/vmail";
|
||||
|
||||
# LDAP is needed for Postfix to query Kanidm about email address ownership.
|
||||
# LDAP is needed for Dovecot also.
|
||||
ldap = lib.mkIf is-auth-enabled {
|
||||
# false; otherwise, simple-nixos-mailserver enables auth via LDAP
|
||||
enable = false;
|
||||
|
||||
# bind.dn = "uid=mail,ou=persons," + ldap_base_dn;
|
||||
bind.dn = "dn=token";
|
||||
# TODO change in this file should trigger system restart dovecot
|
||||
bind.passwordFile = mailserver-service-account-token-fp;
|
||||
|
||||
# searchBase = "ou=persons," + ldap_base_dn;
|
||||
searchBase = auth-passthru.ldap-base-dn; # TODO refine this
|
||||
|
||||
# NOTE: 127.0.0.1 instead of localhost doesn't work (maybe because of TLS)
|
||||
uris = [ "ldaps://localhost:${toString auth-passthru.ldap-port}" ];
|
||||
systemd = {
|
||||
services = {
|
||||
dovecot2.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
postfix.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
rspamd.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
redis-rspamd.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
opendkim.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
};
|
||||
slices."simple_nixos_mailserver" = {
|
||||
name = "simple_nixos_mailserver.slice";
|
||||
description = "Simple NixOS Mailserver service slice";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
# the following part is active only when "auth" module is enabled
|
||||
(lib.attrsets.optionalAttrs
|
||||
(options.selfprivacy.modules ? "auth")
|
||||
(lib.mkIf is-auth-enabled {
|
||||
mailserver = {
|
||||
extraVirtualAliases = lib.mkForce { };
|
||||
loginAccounts = lib.mkForce { };
|
||||
# LDAP is needed for Postfix to query Kanidm about email address ownership.
|
||||
# LDAP is needed for Dovecot also.
|
||||
ldap = {
|
||||
# false; otherwise, simple-nixos-mailserver enables auth via LDAP
|
||||
enable = false;
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
dovecot2.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
postfix.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
rspamd.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
redis-rspamd.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
opendkim.serviceConfig.Slice = "simple_nixos_mailserver.slice";
|
||||
# bind.dn = "uid=mail,ou=persons," + ldap_base_dn;
|
||||
bind.dn = "dn=token";
|
||||
# TODO change in this file should trigger system restart dovecot
|
||||
bind.passwordFile = mailserver-service-account-token-fp;
|
||||
|
||||
# searchBase = "ou=persons," + ldap_base_dn;
|
||||
searchBase = auth-passthru.ldap-base-dn; # TODO refine this
|
||||
|
||||
# NOTE: 127.0.0.1 instead of localhost doesn't work (maybe because of TLS)
|
||||
uris = [ "ldaps://localhost:${toString auth-passthru.ldap-port}" ];
|
||||
};
|
||||
};
|
||||
# FIXME set auth module option instead
|
||||
kanidm.serviceConfig.ExecStartPost =
|
||||
lib.mkIf is-auth-enabled
|
||||
(lib.mkAfter
|
||||
[
|
||||
("+" + kanidmExecStartPostScriptRoot)
|
||||
kanidmExecStartPostScript
|
||||
]
|
||||
);
|
||||
};
|
||||
slices."simple_nixos_mailserver" = {
|
||||
name = "simple_nixos_mailserver.slice";
|
||||
description = "Simple NixOS Mailserver service slice";
|
||||
};
|
||||
};
|
||||
}
|
||||
systemd.services.kanidm.serviceConfig.ExecStartPost = lib.mkAfter [
|
||||
("+" + kanidmExecStartPostScriptRoot)
|
||||
kanidmExecStartPostScript
|
||||
];
|
||||
}))
|
||||
(lib.attrsets.optionalAttrs
|
||||
(options.selfprivacy.modules ? "auth")
|
||||
(lib.mkIf is-auth-enabled (import ./auth-dovecot.nix nixos-args)))
|
||||
(lib.attrsets.optionalAttrs
|
||||
(options.selfprivacy.modules ? "auth")
|
||||
(lib.mkIf is-auth-enabled (import ./auth-postfix.nix nixos-args)))
|
||||
])
|
||||
|
|
|
|||
|
|
@ -10,8 +10,6 @@
|
|||
mailserver.nixosModules.default
|
||||
./options.nix
|
||||
./config.nix
|
||||
./auth-postfix.nix
|
||||
./auth-dovecot.nix
|
||||
];
|
||||
};
|
||||
configPathsNeeded =
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue