misc_nixos-mailserver/mail-config.nix

162 lines
4.8 KiB
Nix
Raw Normal View History

2016-07-25 15:30:03 +00:00
# nixos-mailserver: a simple mail server
# Copyright (C) 2016-2017 Robin Raymond
2016-07-25 15:30:03 +00:00
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{ config, pkgs, ... }:
let
2017-08-12 14:41:43 +00:00
#
# The domain that this mail server serves. So far only one domain is supported
#
2016-07-25 15:30:03 +00:00
domain = "example.com";
2017-08-12 14:41:43 +00:00
#
# The prefix of the FQDN of the server. In this example the FQDN of the server
# is given by 'mail.example.com'
#
2016-07-25 15:30:03 +00:00
host_prefix = "mail";
2017-08-12 14:41:43 +00:00
#
# The login account of the domain. Every account is mapped to a unix user,
2017-08-13 13:51:41 +00:00
# e.g. `user1@example.com`. To generate the passwords use `mkpasswd` as
# follows
2017-08-12 14:41:43 +00:00
#
2017-08-13 13:51:41 +00:00
# ```
# mkpasswd -m sha-512 "super secret password"
# ```
#
login_accounts = [
{ name = "user1";
password = "$6$evQJs5CFQyPAW09S$Cn99Y8.QjZ2IBnSu4qf1vBxDRWkaIZWOtmu1Ddsm3.H3CFpeVc0JU4llIq8HQXgeatvYhh5O33eWG3TSpjzu6/";
}
{ name = "user2";
password = "$6$oE0ZNv2n7Vk9gOf$9xcZWCCLGdMflIfuA0vR1Q1Xblw6RZqPrP94mEit2/81/7AKj2bqUai5yPyWE.QYPyv6wLMHZvjw3Rlg7yTCD/";
}
];
2017-08-12 14:41:43 +00:00
#
# Virtual Aliases. A virtual alias { from = "info"; to = "user1"; } means that
# all mail to `info@example.com` is forwarded to `user1@example.com`. Note
# that it is expected that `postmaster@example.com` and `abuse@example.com` is
# forwarded to some valid email address. (Alternatively you can create login
# accounts for `postmaster` and (or) `abuse`).
#
2016-07-25 16:06:57 +00:00
valiases = [
{ from = "info";
to = "user1";
}
{ from = "postmaster";
to = "user1";
}
{ from = "abuse";
to = "user1";
}
];
2017-08-12 14:41:43 +00:00
#
# The unix UID where the login_accounts are created. 5000 means that the first
# user will get 5000, the second 5001, ...
#
2016-07-25 15:30:03 +00:00
vmail_id_start = 5000;
2017-08-12 14:41:43 +00:00
#
# The user name and group name of the user that owns the directory where all
# the mail is stored.
#
2016-07-25 15:30:03 +00:00
vmail_user_name = "vmail";
vmail_group_name = "vmail";
2017-08-12 14:41:43 +00:00
#
# Where to store the mail.
#
2016-07-25 15:30:03 +00:00
mail_dir = "/var/vmail";
2017-08-12 14:41:43 +00:00
#
# Certificate Files. There are three options for these.
#
# 1) You specify locations and manually copy certificates there.
# 2) You let the server create new (self signed) certificates on the fly.
2017-08-12 15:09:32 +00:00
# 3) You let the server create a certificate via `Let's Encrypt`. Note that
# this implies that a stripped down webserver has to be started. This also
# implies that the FQDN must be set as an `A` record to point to the IP of
# the server. TODO: Explain more details
2017-08-12 14:41:43 +00:00
#
# TODO: Only certificate scheme 1) and 2) work as of yet.
certificate_scheme = 2;
2017-08-12 15:09:32 +00:00
# Sceme 1)
cert_file = "/root/mail-server.crt";
key_file = "/root/mail-server.key";
2017-08-12 14:41:43 +00:00
2017-08-12 16:27:22 +00:00
# Sceme 2)
# This is the folder where the certificate will be created. The name is
# hardcoded to "cert-${domain}.pem" and "key-${domain}.pem" and the
# certificate is valid for 10 years.
2017-08-23 15:22:44 +00:00
cert_dir = "/var/certs";
2017-08-12 16:27:22 +00:00
2017-08-12 14:41:43 +00:00
#
# Whether to enable imap / pop3. Both variants are only supported in the
# (sane) startTLS configuration. (TODO: Allow SSL ports). The ports are
#
# 110 - Pop3
# 143 - IMAP
# 587 - SMTP with login
#
2016-07-25 15:30:03 +00:00
enable_imap = true;
enable_pop3 = false;
2017-08-13 12:20:18 +00:00
# imap_ssl = false; #< TODO
# pop3_ssl = false; #< TODO
2017-08-12 14:41:43 +00:00
#
# Whether to activate virus scanning. Note that virus scanning is _very_
# expensive memory wise.
#
2017-08-23 15:22:44 +00:00
virus_scanning = false;
2017-08-12 15:09:32 +00:00
#
# Whether to activate dkim signing.
# TODO: Explain how to put signature into domain record
#
dkim_signing = true;
2017-08-23 15:22:44 +00:00
dkim_selector = "mail";
dkim_dir = "/var/dkim";
2016-07-25 15:30:03 +00:00
in
{
services = import ./mail-server/services.nix {
inherit mail_dir vmail_user_name vmail_group_name valiases domain
2017-08-23 15:22:44 +00:00
enable_imap enable_pop3 virus_scanning dkim_signing dkim_selector
dkim_dir certificate_scheme cert_file key_file cert_dir;
};
environment = import ./mail-server/environment.nix {
inherit pkgs certificate_scheme;
};
networking = import ./mail-server/networking.nix {
2017-08-13 12:20:18 +00:00
inherit domain host_prefix enable_imap enable_pop3;
};
2017-08-12 09:47:52 +00:00
systemd = import ./mail-server/systemd.nix {
inherit mail_dir vmail_group_name certificate_scheme cert_dir host_prefix
2017-08-23 15:22:44 +00:00
domain pkgs dkim_selector dkim_dir;
};
users = import ./mail-server/users.nix {
inherit vmail_id_start vmail_user_name vmail_group_name domain mail_dir
login_accounts;
2017-08-12 09:47:52 +00:00
};
2016-07-25 15:30:03 +00:00
}