nix/machines
1
0
Fork 0
Code Issues Releases Packages Activity Actions

Begin attempting to configure stalwart
Some checks failed
/ dev-shell (push) Successful in 1m50s
Details
/ rust-packages (push) Successful in 11m58s
Details
/ check (push) Failing after 1m16s
Details
/ systems (push) Successful in 38m10s
Details
/ terraform-providers (push) Successful in 15m4s
Details

Browse source
This commit is contained in:
Kaare Hoff Skovgaard 2025-07-27 00:39:55 +02:00
parent 6e665a70bc
commit c97b19c495
Signed by: khs
GPG key ID: C7D890804F01E9F0
4 changed files with 265 additions and 80 deletions
Download patch file Download diff file Expand all files Collapse all files

65
nix/modules/nixos/infrastructure/mailserver/dkim.nix
View file

@ -52,25 +52,35 @@ in
};
};
config = lib.mkIf (cfg.enable) {
mailserver = {
dkimSigning = false;
};
services.rspamd.locals."dkim_signing.conf" = lib.mkForce {
text = ''
enabled = true;
domain {
${lib.strings.concatStringsSep "\n " (lib.lists.map dkimSigningForDomain cfg.domains)}
}
'';
};
systemd.services.rspamd = {
# mailserver = {
# dkimSigning = false;
# };
# services.rspamd.locals."dkim_signing.conf" = lib.mkForce {
# text = ''
# enabled = true;
# domain {
# ${lib.strings.concatStringsSep "\n " (lib.lists.map dkimSigningForDomain cfg.domains)}
# }
# '';
# };
# systemd.services.rspamd = {
# unitConfig = {
# ConditionPathExists = domainKeyPaths;
# };
# };
# systemd.services.postfix = {
# unitConfig = {
# ConditionPathExists = domainKeyPaths;
# };
# };
systemd.services.stalwart-mail = {
unitConfig = {
ConditionPathExists = domainKeyPaths;
};
};
systemd.services.postfix = {
unitConfig = {
ConditionPathExists = domainKeyPaths;
serviceConfig = {
ReadOnlyPaths = [
"/run/secret/dkim"
];
};
};
khscodes.infrastructure.vault-server-approle.policy = {
@ -121,8 +131,7 @@ in
}) cfg.domains)
++ (lib.lists.map (domain: {
fqdn = domain;
# TODO: Use something here that doesn't require knowing the IP, such that we don't tie this down to hcloud instances.
content = ''"v=spf1 ip4:${config.khscodes.hcloud.output.server.compute.ipv4_address} ip6:${config.khscodes.hcloud.output.server.compute.ipv6_address} -all"'';
content = ''"v=spf1 mx -all"'';
ttl = 600;
}) cfg.domains)
++ (lib.lists.map (domain: {
@ -159,7 +168,11 @@ in
}
)
];
systemd.services.stalwart-mail.serviceConfig = {
ReadWritePaths = [
"/run/secret/dkim"
];
};
khscodes.services.vault-agent.templates = lib.lists.flatten (
lib.lists.map (domain: [
{
@ -170,11 +183,10 @@ in
'';
destination = rsaKeyPath domain;
perms = "0600";
owner = "rspamd";
group = "rspamd";
owner = "stalwart-mail";
group = "stalwart-mail";
restartUnits = [
"rspamd.service"
"postfix.service"
"stalwart-mail.service"
];
}
{
@ -185,11 +197,10 @@ in
'';
destination = ed25519KeyPath domain;
perms = "0600";
owner = "rspamd";
group = "rspamd";
owner = "stalwart-mail";
group = "stalwart-mail";
restartUnits = [
"rspamd.service"
"postfix.service"
"stalwart-mail.service"
];
}
]) cfg.domains