Mostly working postfix+dovecot2+ldap setup

Missing:

1. Figure out how to do some useful aliases for the mail
   addresses. Either something like assigning @kas.agerlinskovgaard.dk
   to kaare@agerlinskovgaard.dk or usual + aliases.
2. Oauth2 login is not working yet.
3. Need to be able to create accounts not handled by LDAP, such
   that eg. forgejo can have an account to send mails from (maybe
   also an account to receive mails?).
4. Once support in kanidm lands, need to look into application passwords
   such that one doesn't have to use their regular posix password,
   and maybe, ideally, doesn't need a posix password at all.

nix/modules/nixos/infrastructure/mailserver/dkim.nix

@@ -164,15 +164,24 @@ in
     services.rspamd.locals."dkim_signing.conf" = lib.mkForce {
       text = ''
         enabled = true;
+        allow_username_mismatch = true;
         domain {
           ${lib.strings.concatStringsSep "\n " (lib.lists.map dkimSigningForDomain cfg.domains)}
         }
       '';
     };
+    services.postfix.config = {
+      # Need to include this as I disabled the in built support for dkim signing
+      # without this postfix won't forward the mails to rspamd to be signed.
+      non_smtpd_milters = [ "unix:/run/rspamd/rspamd-milter.sock" ];
+    };
     systemd.services.rspamd = {
       unitConfig = {
         ConditionPathExists = domainKeyPaths;
       };
+      serviceConfig = {
+        ReadOnlyPaths = domainKeyPaths;
+      };
     };
     systemd.services.postfix = {
       unitConfig = {