misc_nixos-mailserver/default.nix

283 lines
7.8 KiB
Nix
Raw Normal View History

2017-08-29 22:58:44 +00:00
# nixos-mailserver: a simple mail server
# Copyright (C) 2016-2017 Robin Raymond
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.mailserver;
in
{
options.mailserver = {
enable = mkEnableOption "nixos-mailserver";
fqdn = mkOption {
2017-08-29 22:58:44 +00:00
type = types.str;
example = "example.com";
description = "The fully qualified domain name of the mail server.";
2017-11-09 21:13:27 +00:00
};
domains = mkOption {
2017-11-09 21:13:27 +00:00
type = types.listOf types.str;
example = [ "example.com" ];
2017-11-09 22:17:03 +00:00
default = [];
description = "The domains that this mail server serves.";
2017-08-29 22:58:44 +00:00
};
2017-09-02 11:23:37 +00:00
loginAccounts = mkOption {
2017-08-29 22:58:44 +00:00
type = types.loaOf (types.submodule ({ name, ... }: {
options = {
name = mkOption {
type = types.str;
example = "user1";
description = "Username";
};
hashedPassword = mkOption {
type = types.str;
example = "$6$evQJs5CFQyPAW09S$Cn99Y8.QjZ2IBnSu4qf1vBxDRWkaIZWOtmu1Ddsm3.H3CFpeVc0JU4llIq8HQXgeatvYhh5O33eWG3TSpjzu6/";
description = ''
Hashed password. Use `mkpasswd` as follows
```
mkpasswd -m sha-512 "super secret password"
```
'';
};
};
config.name = mkDefault name;
}));
example = {
user1 = {
hashedPassword = "$6$evQJs5CFQyPAW09S$Cn99Y8.QjZ2IBnSu4qf1vBxDRWkaIZWOtmu1Ddsm3.H3CFpeVc0JU4llIq8HQXgeatvYhh5O33eWG3TSpjzu6/";
};
user2 = {
hashedPassword = "$6$oE0ZNv2n7Vk9gOf$9xcZWCCLGdMflIfuA0vR1Q1Xblw6RZqPrP94mEit2/81/7AKj2bqUai5yPyWE.QYPyv6wLMHZvjw3Rlg7yTCD/";
};
};
description = ''
The login account of the domain. Every account is mapped to a unix user,
e.g. `user1@example.com`. To generate the passwords use `mkpasswd` as
follows
```
mkpasswd -m sha-512 "super secret password"
```
'';
2017-09-02 10:59:07 +00:00
default = {};
2017-08-29 22:58:44 +00:00
};
2017-09-02 11:23:37 +00:00
virtualAliases = mkOption {
type = types.attrsOf (types.enum (builtins.attrNames cfg.loginAccounts));
2017-08-29 22:58:44 +00:00
example = {
info = "user1";
postmaster = "user1";
abuse = "user1";
};
description = ''
Virtual Aliases. A virtual alias `info = "user1"` means that
all mail to `info@example.com` is forwarded to `user1@example.com`. Note
that it is expected that `postmaster@example.com` and `abuse@example.com` is
forwarded to some valid email address. (Alternatively you can create login
accounts for `postmaster` and (or) `abuse`).
'';
2017-09-02 10:59:07 +00:00
default = {};
2017-08-29 22:58:44 +00:00
};
2017-09-02 11:23:37 +00:00
vmailUIDStart = mkOption {
2017-08-29 22:58:44 +00:00
type = types.int;
default = 5000;
description = ''
2017-09-02 11:23:37 +00:00
The unix UID where the loginAccounts are created. 5000 means that the first
2017-08-29 22:58:44 +00:00
user will get 5000, the second 5001, ...
'';
};
2017-09-02 11:23:37 +00:00
vmailUserName = mkOption {
2017-08-29 22:58:44 +00:00
type = types.str;
2017-10-18 07:20:44 +00:00
default = "virtualMail";
2017-08-29 22:58:44 +00:00
description = ''
The user name and group name of the user that owns the directory where all
the mail is stored.
'';
};
2017-09-02 11:23:37 +00:00
vmailGroupName = mkOption {
2017-08-29 22:58:44 +00:00
type = types.str;
2017-10-18 07:20:44 +00:00
default = "virtualMail";
2017-08-29 22:58:44 +00:00
description = ''
The user name and group name of the user that owns the directory where all
the mail is stored.
'';
};
2017-09-02 11:23:37 +00:00
mailDirectory = mkOption {
type = types.path;
2017-08-29 22:58:44 +00:00
default = "/var/vmail";
description = ''
Where to store the mail.
'';
};
2017-09-02 11:23:37 +00:00
certificateScheme = mkOption {
2017-09-23 07:56:09 +00:00
type = types.enum [ 1 2 3 ];
2017-08-29 22:58:44 +00:00
default = 2;
description = ''
Certificate Files. There are three options for these.
1) You specify locations and manually copy certificates there.
2) You let the server create new (self signed) certificates on the fly.
3) You let the server create a certificate via `Let's Encrypt`. Note that
this implies that a stripped down webserver has to be started. This also
implies that the FQDN must be set as an `A` record to point to the IP of
the server. TODO: Explain more details
'';
};
2017-09-02 11:23:37 +00:00
certificateFile = mkOption {
2017-08-29 22:58:44 +00:00
type = types.path;
example = "/root/mail-server.crt";
description = ''
Scheme 1)
Location of the certificate
'';
};
2017-09-02 11:23:37 +00:00
keyFile = mkOption {
2017-08-29 22:58:44 +00:00
type = types.path;
example = "/root/mail-server.key";
description = ''
Scheme 1)
Location of the key file
'';
};
2017-09-02 11:29:49 +00:00
certificateDirectory = mkOption {
2017-08-29 22:58:44 +00:00
type = types.path;
default = "/var/certs";
description = ''
Sceme 2)
This is the folder where the certificate will be created. The name is
hardcoded to "cert-<domain>.pem" and "key-<domain>.pem" and the
certificate is valid for 10 years.
'';
};
2017-09-02 11:29:49 +00:00
enableImap = mkOption {
2017-08-29 22:58:44 +00:00
type = types.bool;
default = true;
description = ''
Whether to enable imap / pop3. Both variants are only supported in the
(sane) startTLS configuration. The ports are
2017-08-29 22:58:44 +00:00
110 - Pop3
143 - IMAP
587 - SMTP with login
'';
};
enableImapSsl = mkOption {
type = types.bool;
default = false;
description = ''
Whether to enable IMAPS, setting this option to true will open port 993
in the firewall.
'';
};
2017-09-02 11:29:49 +00:00
enablePop3 = mkOption {
2017-08-29 22:58:44 +00:00
type = types.bool;
default = false;
description = ''
Whether to enable POP3. Both variants are only supported in the (sane)
startTLS configuration. The ports are
2017-08-29 22:58:44 +00:00
110 - Pop3
143 - IMAP
587 - SMTP with login
'';
};
enablePop3Ssl = mkOption {
type = types.bool;
default = false;
description = ''
Whether to enable POP3S, setting this option to true will open port 995
in the firewall.
'';
};
2017-08-29 22:58:44 +00:00
2017-09-02 11:23:37 +00:00
virusScanning = mkOption {
2017-08-29 22:58:44 +00:00
type = types.bool;
default = false;
description = ''
Whether to activate virus scanning. Note that virus scanning is _very_
expensive memory wise.
'';
};
2017-09-02 11:29:49 +00:00
dkimSigning = mkOption {
2017-08-29 22:58:44 +00:00
type = types.bool;
default = true;
description = ''
Whether to activate dkim signing.
TODO: Explain how to put signature into domain record
'';
};
2017-09-02 11:29:49 +00:00
dkimSelector = mkOption {
type = types.str;
2017-08-29 22:58:44 +00:00
default = "mail";
description = ''
'';
};
2017-09-02 11:29:49 +00:00
dkimKeyDirectory = mkOption {
2017-08-29 22:58:44 +00:00
type = types.path;
default = "/var/dkim";
description = ''
'';
};
2017-11-13 21:46:59 +00:00
debug = mkOption {
type = types.bool;
default = false;
description = ''
Whether to enable verbose logging for mailserver related services. This
intended be used for development purposes only, you probably don't want
to enable this unless you're hacking on nixos-mailserver.
'';
};
2017-08-29 22:58:44 +00:00
};
2017-09-02 10:59:07 +00:00
imports = [
./mail-server/clamav.nix
2017-09-02 11:58:42 +00:00
./mail-server/users.nix
2017-09-02 12:04:07 +00:00
./mail-server/environment.nix
2017-09-02 12:58:33 +00:00
./mail-server/networking.nix
2017-09-02 13:08:50 +00:00
./mail-server/systemd.nix
2017-09-03 09:13:34 +00:00
./mail-server/dovecot.nix
./mail-server/postfix.nix
./mail-server/rmilter.nix
2017-09-23 07:56:09 +00:00
./mail-server/nginx.nix
2017-09-02 10:59:07 +00:00
];
2017-08-29 22:58:44 +00:00
}