certificate scheme 2

On the fly create certificates via openssl (Maybe change this to
libressl in the future?). This is probably the best scheme to get
something that simply works. Self signed certificates only pose a
problem when connecting to retrieve the email via imap or pop3.

mail-server/dovecot.nix

@@ -14,23 +14,13 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ vmail_group_name, vmail_user_name, mail_dir, enable_imap, enable_pop3,
-certificate_scheme, cert_file, key_file }:
+{ vmail_group_name, vmail_user_name, mail_dir, enable_imap, enable_pop3, cert,
+key }:
+
 let
   # maildir in format "/${domain}/${user}/"
   dovecot_maildir = "maildir:${mail_dir}/%d/%n/";
 
-  # cert :: PATH
-  cert = if certificate_scheme == 1
-         then cert_file
-         else "";
-
-  # key :: PATH
-  key = if certificate_scheme == 1
-        then key_file
-        else "";
-
-
 in
 {
   enable = true;

mail-server/environment.nix

@@ -14,10 +14,10 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ pkgs, ... }:
+{ pkgs, certificate_scheme }:
 
 {
   systemPackages = with pkgs; [
     dovecot opendkim openssh postfix clamav rspamd rmilter
-  ];
+  ] ++ (if certificate_scheme == 2 then [ openssl ] else []);
 }

mail-server/postfix.nix

@@ -14,7 +14,7 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ mail_dir, domain, valiases, certificate_scheme, cert_file, key_file }:
+{ mail_dir, domain, valiases, cert, key }:
 
 let
   # valiasToString :: { from = "..."; to = "..." } -> String
@@ -34,16 +34,6 @@ let
   # vhosts_file :: Path
   vhosts_file = builtins.toFile "vhosts" domain;
 
-  # cert :: PATH
-  cert = if certificate_scheme == 1
-         then cert_file
-         else "";
-
-  # key :: PATH
-  key = if certificate_scheme == 1
-        then key_file
-        else "";
-
 in
 {
   enable = true;

mail-server/services.nix

@@ -16,8 +16,23 @@
 
 { mail_dir, vmail_user_name, vmail_group_name, valiases, domain, enable_imap,
 enable_pop3, virus_scanning, dkim_signing, certificate_scheme, cert_file,
-key_file }:
+key_file, cert_dir }:
 
+let
+  # cert :: PATH
+  cert = if certificate_scheme == 1
+         then cert_file
+         else if certificate_scheme == 2
+              then "${cert_dir}/cert-${domain}.pem"
+              else "";
+
+  # key :: PATH
+  key = if certificate_scheme == 1
+        then key_file
+        else if certificate_scheme == 2
+             then "${cert_dir}/key-${domain}.pem"
+             else "";
+in
 {
   # rspamd
   rspamd = {
@@ -29,11 +44,11 @@ key_file }:
   };
 
   postfix = import ./postfix.nix {
-    inherit mail_dir domain valiases certificate_scheme cert_file key_file;
+    inherit mail_dir domain valiases cert key;
   };
 
   dovecot2 = import ./dovecot.nix {
     inherit vmail_group_name vmail_user_name mail_dir enable_imap
-            enable_pop3 certificate_scheme cert_file key_file;
+            enable_pop3 cert key;
   };
 }

mail-server/systemd.nix

@@ -14,8 +14,29 @@
 #  You should have received a copy of the GNU General Public License
 #  along with this program. If not, see <http://www.gnu.org/licenses/>
 
-{ mail_dir, vmail_group_name }:
+{ pkgs, mail_dir, vmail_group_name, certificate_scheme, cert_dir, host_prefix,
+domain }:
 
+let
+  create_certificate = if certificate_scheme == 2 then
+        ''
+          # Create certificates if they do not exist yet
+          dir="${cert_dir}"
+          fqdn="${host_prefix}.${domain}"
+          case $fqdn in /*) fqdn=$(cat "$fqdn");; esac
+          key="''${dir}/key-${domain}.pem";
+          cert="''${dir}/cert-${domain}.pem";
+
+          if [ ! -f "''${key}" ] || [ ! -f "''${cert}" ]
+          then
+              mkdir -p "${cert_dir}"
+              (umask 077; "${pkgs.openssl}/bin/openssl" genrsa -out "''${key}" 2048) &&
+                  "${pkgs.openssl}/bin/openssl" req -new -key "''${key}" -x509 -subj "/CN=''${fqdn}" \
+                          -days 3650 -out "''${cert}"
+          fi
+        ''
+        else "";
+in
 {
   # Set the correct permissions for dovecot vmail folder. See
   # <http://wiki2.dovecot.org/SharedMailboxes/Permissions>. We choose
@@ -23,8 +44,18 @@
   # dovecot gets started.
   services.dovecot2.preStart =
   ''
-    mkdir -p ${mail_dir}
-    chgrp ${vmail_group_name} ${mail_dir}
-    chmod 02770 ${mail_dir}
+    # Create mail directory and set permissions
+    mkdir -p "${mail_dir}"
+    chgrp "${vmail_group_name}" "${mail_dir}"
+    chmod 02770 "${mail_dir}"
+
+    ${create_certificate}
+  '';
+
+  # Check for certificate before both postfix and dovecot to make sure it
+  # exists.
+  services.postfix.preStart = 
+  ''
+    ${create_certificate}
   '';
 }